Dependency Allowlist Rules for Python, TypeScript, Rust, and Julia in AI Engineering From Scratch

The AI Engineering from Scratch curriculum enforces strict dependency allowlists defined in AGENTS.md, permitting only specific packages—standard libraries for Rust and Julia, plus vetted third-party libraries for Python and TypeScript—to maintain educational clarity and reproducibility.

The dependency allowlist rule governs all lesson code in the rohitg00/ai-engineering-from-scratch repository to prevent hidden complexity from obscuring core AI concepts. This policy is explicitly defined in the Dependencies section of AGENTS.md and applies to every file within the phases/ directory. By restricting imports to a curated set of stable, well-documented packages, the curriculum ensures students can trace exactly which APIs are being invoked without "magic" from obscure third-party code.

Language-Specific Allowlist Requirements

Each language supported by the curriculum maintains its own approved dependency surface. The following breakdown details exactly which packages may be imported in lesson submissions.

Python Approved Packages

Python lessons may import from the standard library plus five specific third-party libraries: numpy, torch, h5py, zstandard, and safetensors. These packages cover numerical computation, deep learning primitives, data serialization, and compression while remaining stable across platforms used by the CI system.

import numpy as np          # ✅ allowed

import torch               # ✅ allowed

# import pandas as pd     # ❌ not on the allowlist → remove or replace

def matmul(a: np.ndarray, b: np.ndarray) -> np.ndarray:
    return a @ b

TypeScript Approved Packages

TypeScript lessons permit hono for HTTP servers, zod for schema validation, ws (only when WebSockets are required), and @hono/node-server for Node.js runtime compatibility. No other npm packages may appear in lesson code.

import { Hono } from 'hono';          // ✅ allowed
import { z } from 'zod';               // ✅ allowed
// import express from 'express';      // ❌ not allowed

const app = new Hono();
app.get('/', (c) => c.text('Hello AI!'));
export default app;

Rust Standard Library Only

Rust lessons must compile as single-file scripts using rustc --edition 2021 with zero external crates. All functionality must derive from the standard library to ensure zero-dependency reproducibility and force students to implement algorithms from first principles.

// ✅ No external crates – only std
fn main() {
    let nums = [1, 2, 3, 4];
    let sum: i32 = nums.iter().sum();
    println!("Sum = {}", sum);
}

Julia Standard Library Modules

Julia restricts lessons to specific standard library modules: Random, Statistics, LinearAlgebra, and Printf. While these ship with Julia, they require explicit using statements, making the dependency surface transparent and auditable.

using Random          # ✅ part of Julia stdlib

using Statistics      # ✅ part of Julia stdlib

rng = MersenneTwister(1234)
samples = rand(rng, Normal(0, 1), 1000)
println(mean(samples))

Automated Enforcement with audit_lessons.py

Compliance verification happens automatically via scripts/audit_lessons.py, which runs in CI to scan every lesson file for forbidden imports. This script parses import statements across all four languages and flags any reference to packages outside the approved list defined in AGENTS.md. If a lesson requires functionality unavailable in the allowlist, authors must implement it using the standard library and document the rationale in the lesson's code header.

Summary

• The dependency allowlist rule lives in AGENTS.md and restricts all lesson code to approved packages only.
• Python permits numpy, torch, h5py, zstandard, and safetensors alongside the standard library.
• TypeScript allows hono, zod, ws, and @hono/node-server for specific use cases.
• Rust enforces standard-library-only development with rustc --edition 2021.
• Julia limits imports to Random, Statistics, LinearAlgebra, and Printf from the standard library.
• The scripts/audit_lessons.py CI script automatically validates compliance across the phases/ directory.

Frequently Asked Questions

What happens if a lesson uses a dependency not on the allowlist?

The continuous integration pipeline will reject the pull request. The scripts/audit_lessons.py scanner detects non-compliant imports and fails the build, requiring the author to remove the banned dependency and replace it with standard library code or an approved package.

Why does the curriculum restrict Rust to the standard library only?

Rust lessons must compile as single-file scripts without external crates to guarantee educational clarity and reproducibility. This restriction forces students to understand memory management and algorithms without relying on external abstractions, ensuring the lesson focuses on core systems concepts rather than crate ecosystem knowledge.

How does the CI system verify compliance with the dependency allowlist?

The repository uses scripts/audit_lessons.py to parse import statements across Python, TypeScript, Rust, and Julia files within the phases/ directory. This script cross-references each import against the Dependencies table in AGENTS.md and generates a failure report if any forbidden packages are detected.

Can contributors request additions to the dependency allowlist?

While the curriculum maintains a strict policy to preserve consistency, contributors may propose additions by opening an issue explaining the educational necessity of the package. However, the default expectation requires authors to implement functionality using existing approved packages or standard library primitives, documenting the approach in the lesson header.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}