Dependency Allowlist Policy for the AI Engineering Curriculum: A Complete Guide

The AI Engineering From Scratch curriculum enforces a strict dependency allowlist defined in AGENTS.md that permits only essential packages like numpy, torch, hono, and language standard libraries to maintain pedagogical clarity and reproducibility.

The rohitg00/ai-engineering-from-scratch repository implements a stdlib-first philosophy to ensure learners focus on algorithmic fundamentals rather than external package quirks. This dependency allowlist policy for the AI engineering curriculum explicitly restricts third-party imports to a curated set of libraries across Python, TypeScript, Rust, and Julia. Every lesson must adhere to these constraints or provide explicit justification for educational clarity.

What Is the Dependency Allowlist Policy?

The dependency allowlist policy is the set of rules governing which external packages contributors may import when building lessons for the curriculum. Defined in the repository’s AGENTS.md file under the Dependencies section, this policy mandates that lessons remain stdlib-first—prioritizing language-native capabilities over third-party abstractions.

If a lesson requires functionality not available in the standard library, contributors must select from the pre-approved allowlist. Any library outside this list requires contributors to skip the dependency and document the rationale, typically noting that the implementation "stays stdlib-first for educational clarity."

Allowed Dependencies by Language

The curriculum supports four languages with specific package restrictions for each.

Python

Python lessons may import from the standard library plus six specific packages:

• numpy
• torch
• h5py
• zstandard
• safetensors

import numpy as np
import torch
import h5py
import zstandard as zstd
import safetensors

# Standard-library imports are always permitted

import json
import pathlib

TypeScript

TypeScript lessons target Node.js 20+ and allow the following packages in addition to the Node standard library:

• hono
• zod
• ws (only when WebSocket functionality is explicitly required)
• @hono/node-server

import { Hono } from 'hono';
import { z } from 'zod';
import { WebSocket } from 'ws';
import { serve } from '@hono/node-server';
// Node standard library is always available
import fs from 'fs';

Rust

Rust lessons enforce the strictest constraint: only the standard library is permitted. All code must compile as a single file using rustc --edition 2021.

use std::fs;
use std::io::{self, Read};

Julia

Julia lessons restrict imports to four specific standard library modules:

• Random
• Statistics
• LinearAlgebra
• Printf

using Random
using Statistics
using LinearAlgebra
using Printf

How the Policy Is Enforced

The repository automates compliance checks through scripts/audit_lessons.py, a CI linter that scans lesson directories for forbidden imports. When a contributor submits code, this script validates all import statements against the allowlist. Attempting to import any package outside the approved lists triggers an automatic rejection of the change.

For example, a Python lesson located at phases/01-intro-to-ml/code/main.py would be scanned to ensure it only imports from the allowed set or the standard library. Similarly, TypeScript, Rust, and Julia files undergo equivalent validation to ensure no external dependencies leak into the curriculum.

Why the Curriculum Uses a Strict Allowlist

The dependency restrictions serve three core educational objectives:

• Pedagogical clarity. Students concentrate on algorithmic concepts rather than debugging third-party package quirks or version mismatches.
• Reproducibility. A minimal dependency footprint ensures lessons run reliably across Linux, macOS, and Windows without complex environment setup.
• Security and maintenance. Limiting external packages reduces the attack surface for supply-chain vulnerabilities and eliminates the burden of tracking upstream updates for educational content.

Summary

• The dependency allowlist policy is defined in AGENTS.md and restricts lessons to specific approved packages plus language standard libraries.
• Python allows numpy, torch, h5py, zstandard, and safetensors; TypeScript allows hono, zod, ws, and @hono/node-server; Rust allows only the standard library; Julia allows four specific stdlib modules.
• The scripts/audit_lessons.py CI linter automatically rejects contributions containing forbidden dependencies.
• Contributors must skip non-allowed libraries and provide rationale emphasizing stdlib-first educational value.

Frequently Asked Questions

What happens if I need a library not on the allowlist?

You must skip the dependency and provide a rationale in your contribution notes. Acceptable justifications include phrases like "stays stdlib-first for educational clarity" or explanations demonstrating that the concept can be taught without the external abstraction.

Where is the dependency allowlist officially defined?

The canonical source resides in AGENTS.md at the repository root, specifically within the Dependencies section. This document serves as the single source of truth for all contribution rules regarding external packages.

How does the CI check for forbidden dependencies?

The repository uses scripts/audit_lessons.py to parse lesson files and validate imports against the allowlist. This script runs automatically on pull requests and blocks merging if it detects any imports from unapproved packages.

Why does the Rust track only allow the standard library?

Rust lessons are designed to compile as single files using rustc --edition 2021 without Cargo or external crates. This constraint forces learners to understand memory management and algorithmic implementation using only core language features, reinforcing fundamental systems programming concepts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}