Dependency Introduction¶

Authoritative source: skill/policies/dependency-introduction.md

Template metadata¶

Rendered preview¶

Dependency Introduction¶

Applies when¶

A change adds a runtime, build, test, toolchain, service, or package dependency.

Required action¶

1. Identify the capability and why existing project code, the standard library, or an approved dependency is insufficient.
2. Compare at least the direct implementation and the proposed dependency when both are realistic.
3. Review licence, maintenance activity, security and supply-chain exposure, runtime and packaging cost, supported platforms, and removal strategy.
4. Add only the required surface area and pin or constrain it according to project policy.
5. Test clean installation, failure behaviour, and packaging impact.

Required evidence¶

Record the selected option, rejected alternative, version constraint, licence/security review, and install/build/test commands.

Exceptions¶

A project-mandated dependency needs no alternative-selection analysis, but still requires compatibility, security, and packaging evidence.

Complete source¶

---
id: policy.dependency-introduction
version: 1.0.0
status: stable
---
# Dependency Introduction

## Applies when
A change adds a runtime, build, test, toolchain, service, or package dependency.

## Required action
1. Identify the capability and why existing project code, the standard library, or an
   approved dependency is insufficient.
2. Compare at least the direct implementation and the proposed dependency when both are
   realistic.
3. Review licence, maintenance activity, security and supply-chain exposure, runtime and
   packaging cost, supported platforms, and removal strategy.
4. Add only the required surface area and pin or constrain it according to project policy.
5. Test clean installation, failure behaviour, and packaging impact.

## Required evidence
Record the selected option, rejected alternative, version constraint, licence/security
review, and install/build/test commands.

## Exceptions
A project-mandated dependency needs no alternative-selection analysis, but still requires
compatibility, security, and packaging evidence.