Dependency and Tooling Standard¶
This standard applies to tooling maintained within this repository (scripts/, tests/, and related repository automation) — it is about how this repository builds and validates itself, not a mandate on the technology stack of any venture's actual products (see docs/architecture/company-venture-product-model.md on ventures not being required to share a technology stack).
Prefer standard library, minimal dependencies¶
Repository tooling under scripts/ prefers Python's standard library, targeting Python 3.11+, over adding third-party dependencies. A third-party dependency should only be added when the standard library genuinely cannot do the job reasonably (not merely "would take a few more lines"), and the dependency is well-maintained, widely used, and appropriately licensed for a private/proprietary repository.
Justify new dependencies¶
Any new dependency added to repository tooling must be justified in one of:
- An ADR under
docs/decisions/, if the dependency represents a material or hard-to-reverse tooling choice (e.g., adopting a testing framework, a schema-validation library). - A work log entry under
work/, if the dependency is minor and easily reversible, with a short note on why it was needed.
An unjustified, silently-added dependency should be treated as a defect in the change that introduced it.
Products are not required to follow this rule¶
This standard governs repository tooling, not the technology choices of Shelfery, Digital Products, or future ventures' actual products — those choices are venture- and product-level decisions, documented in the relevant venture's own standards.
Avoid unnecessary macros and external services in products¶
Within products themselves (not repository tooling), avoid adding macros, scripts, or external service dependencies without justification recorded in the product's specification or an ADR. This matters especially for Digital Products' workbook-based products, where macros can introduce security warnings, compatibility issues, and support burden disproportionate to the value they add — a workbook that can achieve its goal with native formulas should generally do so.
Relationship to AI agent behavior¶
Additional, more specific constraints on what an AI agent may or may not install, execute, or introduce as a dependency are defined in docs/ai/prohibited-behaviors.md. This standard sets the human-facing rule; that document sets the corresponding operating constraint for AI agents working in this repository.