Where to Find Language-Specific Dependency Allowlists in the AI Engineering Curriculum

The language-specific dependency allowlists for the AI Engineering From Scratch curriculum are defined in the AGENTS.md file under the "Dependencies" section, which serves as the single source of truth for all permitted third-party libraries.

The rohitg00/ai-engineering-from-scratch repository maintains a strict "stdlib-first" philosophy to ensure students implement core algorithms manually. All allowed dependencies are documented in a centralized markdown table that maps each language to its permitted packages, enabling automated CI validation through the repository's audit scripts.

Location of the Dependency Allowlists

The definitive source for all language-specific dependency allowlists resides in the repository's AGENTS.md file. Specifically, the "Dependencies" section contains a markdown table that explicitly lists every permitted third-party library for each supported language.

This table is the authoritative reference that the CI pipeline uses to validate code submissions. Any import statement or package reference outside the defined allowlist will trigger a build failure in the automated audit step.

Complete Language-Specific Allowlists

The curriculum supports four languages, each with carefully curated dependencies to maintain the educational focus on foundational implementation.

Python

The Python track allows specific scientific computing libraries while restricting broader data science ecosystems:

• Allowed packages: numpy, torch, h5py, zstandard, safetensors
• Standard library: All modules permitted
• Rationale: These libraries support linear algebra operations and deep learning demonstrations while avoiding high-level abstractions that would defeat the "from scratch" learning objective

TypeScript

The TypeScript/JavaScript track permits modern web framework utilities with strict runtime constraints:

• Allowed packages: hono, zod, ws (WebSocket only when needed), @hono/node-server
• Runtime: Node.js 20+ standard library
• Rationale: Focuses on lightweight, edge-compatible frameworks rather than monolithic server libraries

Rust

The Rust track enforces the most restrictive policy:

• Allowed packages: Standard library only
• Compilation: Single-file rustc --edition 2021 targets
• Rationale: Forces manual implementation of algorithms without external crate dependencies

Julia

The Julia track permits specific standard library modules:

• Allowed packages: Random, Statistics, LinearAlgebra, Printf (all from stdlib)
• External packages: None permitted
• Rationale: Maintains focus on mathematical foundations using only built-in linear algebra and statistical capabilities

CI Enforcement and Automated Auditing

The repository enforces these allowlists through scripts/audit_lessons.py, which runs as part of the continuous integration workflow. This script parses each lesson's code/ directory files and validates import statements against the AGENTS.md table.

When the audit detects a dependency violation—such as an import of pandas in Python or express in TypeScript—the CI pipeline fails and rejects the submission. This automated enforcement ensures that all lesson implementations remain aligned with the curriculum's foundational teaching philosophy.

Valid Import Patterns by Language

The following examples demonstrate compliant import patterns that pass the CI audit. Attempting to use any package not listed in AGENTS.md will result in immediate rejection.

Python (allowed imports):

import numpy as np          # ✅ allowed

import torch               # ✅ allowed

# import pandas as pd      # ❌ NOT allowed – will be rejected by CI

TypeScript (allowed imports):

import { Hono } from 'hono'          // ✅ allowed
import { z } from 'zod'              // ✅ allowed
// import express from 'express'    // ❌ NOT allowed – not on the allowlist

Rust (allowed imports):

use std::collections::HashMap; // ✅ allowed
// use serde_json::json;         // ❌ NOT allowed – external crate not permitted

Julia (allowed imports):

using LinearAlgebra   # ✅ allowed

using Statistics     # ✅ allowed

# using DataFrames    # ❌ NOT allowed – external package not on the allowlist

Summary

• The AGENTS.md file contains the definitive dependency allowlist table in its "Dependencies" section.
• Python permits numpy, torch, h5py, zstandard, and safetensors alongside the standard library.
• TypeScript allows hono, zod, ws, and @hono/node-server for Node.js 20+ environments.
• Rust and Julia enforce standard-library-only policies to maximize algorithmic implementation from first principles.
• The scripts/audit_lessons.py CI script automatically validates all lesson code against these allowlists.

Frequently Asked Questions

What happens if I import a package not on the allowlist?

The CI pipeline will fail during the automated audit step. The scripts/audit_lessons.py script scans all lesson code/ files and flags any import statements referencing packages outside the AGENTS.md table, preventing the submission from being accepted until the violation is resolved.

Why does the Rust track only allow the standard library?

According to the curriculum philosophy implemented in rohitg00/ai-engineering-from-scratch, Rust lessons must compile as single-file rustc --edition 2021 targets without external crates. This restriction ensures students implement data structures and algorithms manually rather than relying on ecosystem crates like serde or rand.

Where can I find the CI audit script that checks dependencies?

The dependency validation logic resides in scripts/audit_lessons.py. This script executes during the CI workflow to verify that all import statements in lesson implementations comply with the allowlist defined in AGENTS.md.

Are there any exceptions to the allowlist for specific lessons?

No. The AGENTS.md table represents the universal source of truth for all lessons in the curriculum. The "stdlib-first" approach is applied consistently across all modules, with no provisions for importing additional packages beyond those explicitly listed for each language.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}