# Dependency Allowlist Rules for Python, TypeScript, Rust, and Julia in AI Engineering From Scratch

> Discover dependency allowlist rules for Python, TypeScript, Rust, and Julia in AI Engineering From Scratch. Learn how specific package vetting ensures clarity and reproducibility in your AI projects.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: best-practices
- Published: 2026-09-01

---

**The AI Engineering from Scratch curriculum enforces strict dependency allowlists defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md), permitting only specific packages—standard libraries for Rust and Julia, plus vetted third-party libraries for Python and TypeScript—to maintain educational clarity and reproducibility.**

The **dependency allowlist rule** governs all lesson code in the `rohitg00/ai-engineering-from-scratch` repository to prevent hidden complexity from obscuring core AI concepts. This policy is explicitly defined in the *Dependencies* section of [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) and applies to every file within the `phases/` directory. By restricting imports to a curated set of stable, well-documented packages, the curriculum ensures students can trace exactly which APIs are being invoked without "magic" from obscure third-party code.

## Language-Specific Allowlist Requirements

Each language supported by the curriculum maintains its own approved dependency surface. The following breakdown details exactly which packages may be imported in lesson submissions.

### Python Approved Packages

Python lessons may import from the standard library plus five specific third-party libraries: **numpy**, **torch**, **h5py**, **zstandard**, and **safetensors**. These packages cover numerical computation, deep learning primitives, data serialization, and compression while remaining stable across platforms used by the CI system.

```python
import numpy as np          # ✅ allowed

import torch               # ✅ allowed

# import pandas as pd     # ❌ not on the allowlist → remove or replace

def matmul(a: np.ndarray, b: np.ndarray) -> np.ndarray:
    return a @ b

```

### TypeScript Approved Packages

TypeScript lessons permit **hono** for HTTP servers, **zod** for schema validation, **ws** (only when WebSockets are required), and **@hono/node-server** for Node.js runtime compatibility. No other npm packages may appear in lesson code.

```typescript
import { Hono } from 'hono';          // ✅ allowed
import { z } from 'zod';               // ✅ allowed
// import express from 'express';      // ❌ not allowed

const app = new Hono();
app.get('/', (c) => c.text('Hello AI!'));
export default app;

```

### Rust Standard Library Only

Rust lessons must compile as single-file scripts using `rustc --edition 2021` with **zero external crates**. All functionality must derive from the standard library to ensure zero-dependency reproducibility and force students to implement algorithms from first principles.

```rust
// ✅ No external crates – only std
fn main() {
    let nums = [1, 2, 3, 4];
    let sum: i32 = nums.iter().sum();
    println!("Sum = {}", sum);
}

```

### Julia Standard Library Modules

Julia restricts lessons to specific standard library modules: **Random**, **Statistics**, **LinearAlgebra**, and **Printf**. While these ship with Julia, they require explicit `using` statements, making the dependency surface transparent and auditable.

```julia
using Random          # ✅ part of Julia stdlib

using Statistics      # ✅ part of Julia stdlib

rng = MersenneTwister(1234)
samples = rand(rng, Normal(0, 1), 1000)
println(mean(samples))

```

## Automated Enforcement with audit_lessons.py

Compliance verification happens automatically via [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py), which runs in CI to scan every lesson file for forbidden imports. This script parses import statements across all four languages and flags any reference to packages outside the approved list defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md). If a lesson requires functionality unavailable in the allowlist, authors must implement it using the standard library and document the rationale in the lesson's code header.

## Summary

- The **dependency allowlist rule** lives in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) and restricts all lesson code to approved packages only.
- **Python** permits `numpy`, `torch`, `h5py`, `zstandard`, and `safetensors` alongside the standard library.
- **TypeScript** allows `hono`, `zod`, `ws`, and `@hono/node-server` for specific use cases.
- **Rust** enforces standard-library-only development with `rustc --edition 2021`.
- **Julia** limits imports to `Random`, `Statistics`, `LinearAlgebra`, and `Printf` from the standard library.
- The [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) CI script automatically validates compliance across the `phases/` directory.

## Frequently Asked Questions

### What happens if a lesson uses a dependency not on the allowlist?

The continuous integration pipeline will reject the pull request. The [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) scanner detects non-compliant imports and fails the build, requiring the author to remove the banned dependency and replace it with standard library code or an approved package.

### Why does the curriculum restrict Rust to the standard library only?

Rust lessons must compile as single-file scripts without external crates to guarantee **educational clarity** and **reproducibility**. This restriction forces students to understand memory management and algorithms without relying on external abstractions, ensuring the lesson focuses on core systems concepts rather than crate ecosystem knowledge.

### How does the CI system verify compliance with the dependency allowlist?

The repository uses [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) to parse import statements across Python, TypeScript, Rust, and Julia files within the `phases/` directory. This script cross-references each import against the *Dependencies* table in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) and generates a failure report if any forbidden packages are detected.

### Can contributors request additions to the dependency allowlist?

While the curriculum maintains a strict policy to preserve consistency, contributors may propose additions by opening an issue explaining the educational necessity of the package. However, the default expectation requires authors to implement functionality using existing approved packages or standard library primitives, documenting the approach in the lesson header.