# Dependency Policy

## Simple Summary

Scooling Lab does not install training libraries until their licenses and source paths are reviewed.

The current T0/T2 package uses only the Python standard library. Unsloth is recorded as candidate
evidence only and is not installed, imported, or locked.

## Technical Policy

- Allowed licenses for Scooling Lab dependencies are `Apache-2.0`, `MIT`, `BSD-2-Clause`,
  `BSD-3-Clause`, `ISC`, and `PSF-2.0`.
- AGPL and GPL-family licenses are blocked unless a later legal review explicitly changes the
  repository distribution model.
- Source paths named `studio/` and `unsloth_cli/` are blocked because Unsloth's public license notice
  identifies those optional paths as AGPL-3.0.
- Every dependency must appear in `requirements.lock` with version, license, source path, and evidence
  metadata before it can enter runtime use.
- `DEPENDENCIES.md` is generated from the BOM tool and must stay committed.

## Current State

- Runtime dependencies: none.
- Lockfile: `requirements.lock`, comment-only until the first real runtime dependency lands.
- BOM command: `PYTHONPATH=src python -m scooling_lab.bom --check --output DEPENDENCIES.md`.
- Unsloth status: pinned candidate evidence only; no package install and no import path.

## No-Go List

- No private Scooling code.
- No Knowtation vault data.
- No secrets, API keys, or local environment files.
- No model artifacts, weights, or training outputs.
- No copied Unsloth Studio UI, generated bundles, routes, handlers, or assets.
- No `unsloth_cli/` code, commands, wrappers, or shell install scripts.
- No browser-supplied worker URL, callback URL, shell command, file path, or model path accepted by
  the API contract.