Design decision: no AI model at serving time

Status: accepted (2026-06-10)

Planning, recipe adaptation, the deterministic parts of recipe verification, and certificates run with zero calls to a language model. Language models are used only to author new material — new recipes, which pass automated checks and a judge before they can be used — to score judgment-call quality dimensions, and to turn free-text wishes into proposed configuration changes that a person confirms before anything is applied.

Why:

1. Trust — a number a model asserted cannot be certified; a number computed from verified data can.
2. Resilience and cost — the daily product keeps working through an AI provider outage and serves without any per-request model cost.
3. Determinism — the same household, the same week and the same data build always give the same plan, which makes regression testing against reference plans possible.

Enforcement: nothing on the planning path can load the AI authoring code; an automated structural test enforces this on every change. When the quality judge runs without a model, it falls back to its deterministic scoring, and the certificate notes that the AI judge was switched off.