# Dependency Allowlist Policy for the AI Engineering Curriculum: A Complete Guide

> Understand the AI Engineering From Scratch dependency allowlist policy. Learn which essential packages like numpy torch and hono are permitted for clarity and reproducibility. Read the complete guide.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: how-to-guide
- Published: 2026-09-04

---

**The AI Engineering From Scratch curriculum enforces a strict dependency allowlist defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) that permits only essential packages like `numpy`, `torch`, `hono`, and language standard libraries to maintain pedagogical clarity and reproducibility.**

The `rohitg00/ai-engineering-from-scratch` repository implements a **stdlib-first** philosophy to ensure learners focus on algorithmic fundamentals rather than external package quirks. This dependency allowlist policy for the AI engineering curriculum explicitly restricts third-party imports to a curated set of libraries across Python, TypeScript, Rust, and Julia. Every lesson must adhere to these constraints or provide explicit justification for educational clarity.

## What Is the Dependency Allowlist Policy?

The dependency allowlist policy is the set of rules governing which external packages contributors may import when building lessons for the curriculum. Defined in the repository’s **[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md)** file under the **Dependencies** section, this policy mandates that lessons remain **stdlib-first**—prioritizing language-native capabilities over third-party abstractions.

If a lesson requires functionality not available in the standard library, contributors must select from the pre-approved allowlist. Any library outside this list requires contributors to **skip** the dependency and document the rationale, typically noting that the implementation "stays stdlib-first for educational clarity."

## Allowed Dependencies by Language

The curriculum supports four languages with specific package restrictions for each.

### Python

Python lessons may import from the standard library plus six specific packages:

- `numpy`
- `torch`
- `h5py`
- `zstandard`
- `safetensors`

```python
import numpy as np
import torch
import h5py
import zstandard as zstd
import safetensors

# Standard-library imports are always permitted

import json
import pathlib

```

### TypeScript

TypeScript lessons target Node.js 20+ and allow the following packages in addition to the Node standard library:

- `hono`
- `zod`
- `ws` (only when WebSocket functionality is explicitly required)
- `@hono/node-server`

```typescript
import { Hono } from 'hono';
import { z } from 'zod';
import { WebSocket } from 'ws';
import { serve } from '@hono/node-server';
// Node standard library is always available
import fs from 'fs';

```

### Rust

Rust lessons enforce the strictest constraint: **only the standard library** is permitted. All code must compile as a single file using `rustc --edition 2021`.

```rust
use std::fs;
use std::io::{self, Read};

```

### Julia

Julia lessons restrict imports to four specific standard library modules:

- `Random`
- `Statistics`
- `LinearAlgebra`
- `Printf`

```julia
using Random
using Statistics
using LinearAlgebra
using Printf

```

## How the Policy Is Enforced

The repository automates compliance checks through **[`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py)**, a CI linter that scans lesson directories for forbidden imports. When a contributor submits code, this script validates all import statements against the allowlist. Attempting to import any package outside the approved lists triggers an automatic rejection of the change.

For example, a Python lesson located at [`phases/01-intro-to-ml/code/main.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/phases/01-intro-to-ml/code/main.py) would be scanned to ensure it only imports from the allowed set or the standard library. Similarly, TypeScript, Rust, and Julia files undergo equivalent validation to ensure no external dependencies leak into the curriculum.

## Why the Curriculum Uses a Strict Allowlist

The dependency restrictions serve three core educational objectives:

- **Pedagogical clarity.** Students concentrate on algorithmic concepts rather than debugging third-party package quirks or version mismatches.
- **Reproducibility.** A minimal dependency footprint ensures lessons run reliably across Linux, macOS, and Windows without complex environment setup.
- **Security and maintenance.** Limiting external packages reduces the attack surface for supply-chain vulnerabilities and eliminates the burden of tracking upstream updates for educational content.

## Summary

- The **dependency allowlist policy** is defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) and restricts lessons to specific approved packages plus language standard libraries.
- **Python** allows `numpy`, `torch`, `h5py`, `zstandard`, and `safetensors`; **TypeScript** allows `hono`, `zod`, `ws`, and `@hono/node-server`; **Rust** allows only the standard library; **Julia** allows four specific stdlib modules.
- The **[`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py)** CI linter automatically rejects contributions containing forbidden dependencies.
- Contributors must skip non-allowed libraries and provide rationale emphasizing **stdlib-first** educational value.

## Frequently Asked Questions

### What happens if I need a library not on the allowlist?

You must **skip** the dependency and provide a rationale in your contribution notes. Acceptable justifications include phrases like "stays stdlib-first for educational clarity" or explanations demonstrating that the concept can be taught without the external abstraction.

### Where is the dependency allowlist officially defined?

The canonical source resides in **[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md)** at the repository root, specifically within the Dependencies section. This document serves as the single source of truth for all contribution rules regarding external packages.

### How does the CI check for forbidden dependencies?

The repository uses **[`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py)** to parse lesson files and validate imports against the allowlist. This script runs automatically on pull requests and blocks merging if it detects any imports from unapproved packages.

### Why does the Rust track only allow the standard library?

Rust lessons are designed to compile as **single files** using `rustc --edition 2021` without Cargo or external crates. This constraint forces learners to understand memory management and algorithmic implementation using only core language features, reinforcing fundamental systems programming concepts.