# Where to Find Language-Specific Dependency Allowlists in the AI Engineering Curriculum

> Find language-specific dependency allowlists for the AI engineering curriculum in AGENTS.md. This document is the definitive source for all allowed third-party libraries.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: how-to-guide
- Published: 2026-06-18

---

**The language-specific dependency allowlists for the AI Engineering From Scratch curriculum are defined in the [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) file under the "Dependencies" section, which serves as the single source of truth for all permitted third-party libraries.**

The rohitg00/ai-engineering-from-scratch repository maintains a strict "stdlib-first" philosophy to ensure students implement core algorithms manually. All allowed dependencies are documented in a centralized markdown table that maps each language to its permitted packages, enabling automated CI validation through the repository's audit scripts.

## Location of the Dependency Allowlists

The definitive source for all language-specific dependency allowlists resides in the repository's **[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md)** file. Specifically, the **"Dependencies"** section contains a markdown table that explicitly lists every permitted third-party library for each supported language.

This table is the authoritative reference that the CI pipeline uses to validate code submissions. Any import statement or package reference outside the defined allowlist will trigger a build failure in the automated audit step.

## Complete Language-Specific Allowlists

The curriculum supports four languages, each with carefully curated dependencies to maintain the educational focus on foundational implementation.

### Python

The Python track allows specific scientific computing libraries while restricting broader data science ecosystems:

- **Allowed packages**: `numpy`, `torch`, `h5py`, `zstandard`, `safetensors`
- **Standard library**: All modules permitted
- **Rationale**: These libraries support linear algebra operations and deep learning demonstrations while avoiding high-level abstractions that would defeat the "from scratch" learning objective

### TypeScript

The TypeScript/JavaScript track permits modern web framework utilities with strict runtime constraints:

- **Allowed packages**: `hono`, `zod`, `ws` (WebSocket only when needed), `@hono/node-server`
- **Runtime**: Node.js 20+ standard library
- **Rationale**: Focuses on lightweight, edge-compatible frameworks rather than monolithic server libraries

### Rust

The Rust track enforces the most restrictive policy:

- **Allowed packages**: **Standard library only**
- **Compilation**: Single-file `rustc --edition 2021` targets
- **Rationale**: Forces manual implementation of algorithms without external crate dependencies

### Julia

The Julia track permits specific standard library modules:

- **Allowed packages**: `Random`, `Statistics`, `LinearAlgebra`, `Printf` (all from stdlib)
- **External packages**: None permitted
- **Rationale**: Maintains focus on mathematical foundations using only built-in linear algebra and statistical capabilities

## CI Enforcement and Automated Auditing

The repository enforces these allowlists through **[`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py)**, which runs as part of the continuous integration workflow. This script parses each lesson's `code/` directory files and validates import statements against the [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) table.

When the audit detects a dependency violation—such as an import of `pandas` in Python or `express` in TypeScript—the CI pipeline fails and rejects the submission. This automated enforcement ensures that all lesson implementations remain aligned with the curriculum's foundational teaching philosophy.

## Valid Import Patterns by Language

The following examples demonstrate compliant import patterns that pass the CI audit. Attempting to use any package not listed in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) will result in immediate rejection.

**Python (allowed imports):**

```python
import numpy as np          # ✅ allowed

import torch               # ✅ allowed

# import pandas as pd      # ❌ NOT allowed – will be rejected by CI

```

**TypeScript (allowed imports):**

```typescript
import { Hono } from 'hono'          // ✅ allowed
import { z } from 'zod'              // ✅ allowed
// import express from 'express'    // ❌ NOT allowed – not on the allowlist

```

**Rust (allowed imports):**

```rust
use std::collections::HashMap; // ✅ allowed
// use serde_json::json;         // ❌ NOT allowed – external crate not permitted

```

**Julia (allowed imports):**

```julia
using LinearAlgebra   # ✅ allowed

using Statistics     # ✅ allowed

# using DataFrames    # ❌ NOT allowed – external package not on the allowlist

```

## Summary

- The **[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md)** file contains the definitive dependency allowlist table in its "Dependencies" section.
- **Python** permits `numpy`, `torch`, `h5py`, `zstandard`, and `safetensors` alongside the standard library.
- **TypeScript** allows `hono`, `zod`, `ws`, and `@hono/node-server` for Node.js 20+ environments.
- **Rust** and **Julia** enforce standard-library-only policies to maximize algorithmic implementation from first principles.
- The **[`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py)** CI script automatically validates all lesson code against these allowlists.

## Frequently Asked Questions

### What happens if I import a package not on the allowlist?

The CI pipeline will fail during the automated audit step. The [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) script scans all lesson `code/` files and flags any import statements referencing packages outside the [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) table, preventing the submission from being accepted until the violation is resolved.

### Why does the Rust track only allow the standard library?

According to the curriculum philosophy implemented in `rohitg00/ai-engineering-from-scratch`, Rust lessons must compile as single-file `rustc --edition 2021` targets without external crates. This restriction ensures students implement data structures and algorithms manually rather than relying on ecosystem crates like `serde` or `rand`.

### Where can I find the CI audit script that checks dependencies?

The dependency validation logic resides in **[`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py)**. This script executes during the CI workflow to verify that all import statements in lesson implementations comply with the allowlist defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md).

### Are there any exceptions to the allowlist for specific lessons?

No. The [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) table represents the universal source of truth for all lessons in the curriculum. The "stdlib-first" approach is applied consistently across all modules, with no provisions for importing additional packages beyond those explicitly listed for each language.