P04 - Review a dependency without installing it
Choose the commands you use
Operating system
CodeArbiter host
Know before you begin
P04 is a guided, runnable Academy lesson in this preview. Its shared action cards are the public course route.
Complete P03 in the same Academy fork and clone. Keep a native terminal at the clone root for Academy operations and file inspection. Keep one CodeArbiter harness open at that same clone for agent work. Native-terminal commands are entered directly and never begin with !. A shell command inside a harness begins with exactly one !. CodeArbiter commands and agent messages belong in the harness and never begin with !.
The website is the primary lesson surface. Academy CLI only handles Prepare, Check, and Reset. It does not replace these guided decisions.
This is a review lesson, not a package-adoption lesson. The candidate set is committed offline evidence. It is not a live package-registry lookup, and its maintenance and vulnerability statements are a frozen 2026-07-31 snapshot rather than current registry or CVE truth.
Its policy is review-only-never-install. The report still records Known vulnerabilities and Supply chain as named review sections, but calls neither live truth. The prepared set has No NOTICE payload; no install during P04 means neither archive enters the exercise environment.
What you will prove
You will preserve one reviewed report for python-dateutil==2.9.0.post0 and its six closure. The beginner path rejects the candidate because finite legacy date formats can use a bounded datetime.strptime parser: explicit formats, a length limit, deterministic timezone and default rules, and fail-closed trailing-content behavior.
No CodeArbiter dependency-adoption command applies: $ca-add-dep is for an intended adoption and may present an install for confirmation. Use read-only $ca-btw only for a bounded question about existing repository context; it cannot inspect the frozen wheel artifacts, decide adoption, or write a report. After you inspect the supplied files, an ordinary harness request drafts learner-owned Academy evidence. You inspect it, review the tradeoff, and then select Decision: reject. The resulting commit contains only the review report. It does not change a dependency declaration, environment lock, or Academy approval wrapper. The existing checkpoint can still recognize its pre-existing equivalent acceptance topology, but that is not an instruction path in this lesson.
Prepare safely
Prepare the numbered dependency-review attempt
In a native terminal at the Academy clone root, run Prepare from clean main.
Prepare records a repeatable baseline.
You · Native terminal · Windows
$academy = "$env:LOCALAPPDATA\ArbiterAcademy\preview-0.30\Scripts\arbiter-academy.exe"
& $academy --repository (Get-Location).Path prepare P04-review-a-dependencyYou · Native terminal · macOS
academy="${XDG_DATA_HOME:-$HOME/.local/share}/arbiter-academy/preview-0.30/bin/arbiter-academy"
"$academy" --repository "$PWD" prepare P04-review-a-dependencyYou · Native terminal · Linux
academy="${XDG_DATA_HOME:-$HOME/.local/share}/arbiter-academy/preview-0.30/bin/arbiter-academy"
"$academy" --repository "$PWD" prepare P04-review-a-dependencyAcademy prints academy/P04-review-a-dependency/ATTEMPT_NUMBER and switches to that branch.
Preserve an error and resolve only its named condition before retrying.
The branch binds later evidence to one prepared project state.
Read the no-install boundary
You · Browser · All operating systems
Use the website as the primary lesson surface before asking an agent to review the proposal. This beginner path teaches rejection only.
Review is evidence about a proposal, not permission to change project state.
You can state that Academy CLI only handles Prepare, Check, and Reset and that this lesson does not add a dependency declaration, environment lock, or Academy wrapper.
If you expected package adoption, stop and return to the course boundary.
No repository evidence has been created yet.
Read the frozen candidate set
Read the committed candidate set in the native terminal. It is offline evidence, not a live registry query.
The review must name exact candidate bytes.
You · Native terminal · Windows
Get-Content -Raw -LiteralPath 'academy/candidates/P04-review-a-dependency/candidate-set.json'You · Native terminal · macOS
cat academy/candidates/P04-review-a-dependency/candidate-set.jsonYou · Native terminal · Linux
cat academy/candidates/P04-review-a-dependency/candidate-set.jsonIt identifies python-dateutil 2.9.0.post0, its six closure, digests, and review-only-never-install policy.
If the file is absent or differs, stop. Do not fetch or substitute it.
The review begins from committed candidate evidence.
Confirm the project has not changed
Inspect status in the native terminal before review evidence is written.
Review must precede dependency-surface changes.
You · Native terminal · Windows
git status --shortYou · Native terminal · macOS
git status --shortYou · Native terminal · Linux
git status --shortGit prints nothing.
If Git prints a path, preserve it outside this attempt or use Reset. Do not hide it in history.
The prepared baseline remains intact.
Practice
Inspect the supplied wheel metadata
List each prepared wheel. This reads archives only; it does not install or import either package.
Metadata is evidence about a supplied archive, not a live registry.
You · Native terminal · Windows
python -m zipfile -l academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl
python -m zipfile -l academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whlYou · Native terminal · macOS
python3 -m zipfile -l academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl
python3 -m zipfile -l academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whlYou · Native terminal · Linux
python3 -m zipfile -l academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl
python3 -m zipfile -l academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whlEach archive lists metadata and license payload without changing the environment.
If Python cannot read an archive, preserve the error and Reset. Do not download a replacement.
The report can cite artifact-local metadata.
Recompute the wheel digests
Hash both supplied wheels and compare them with candidate-set.json.
A name and version are insufficient; the review binds to bytes.
You · Native terminal · Windows
Get-FileHash -Algorithm SHA256 academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl
Get-FileHash -Algorithm SHA256 academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whlYou · Native terminal · macOS
shasum -a 256 academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whlYou · Native terminal · Linux
sha256sum academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whlThe SHA-256 values match the frozen candidate set exactly.
If either digest differs, stop and Reset.
The report can bind its candidate and closure statements to archive bytes.
Read the bundled license evidence
Read the two wheel-derived licenses and Apache text. Do not invent a NOTICE or patent payload.
License claims need named local source material.
You · Native terminal · Windows
Get-Content -Raw academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0.LICENSE
Get-Content -Raw academy/candidates/P04-review-a-dependency/six-1.17.0.LICENSE
Get-Content -Raw academy/candidates/P04-review-a-dependency/Apache-2.0.txtYou · Native terminal · macOS
cat academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0.LICENSE academy/candidates/P04-review-a-dependency/six-1.17.0.LICENSE academy/candidates/P04-review-a-dependency/Apache-2.0.txtYou · Native terminal · Linux
cat academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0.LICENSE academy/candidates/P04-review-a-dependency/six-1.17.0.LICENSE academy/candidates/P04-review-a-dependency/Apache-2.0.txtYou can name both wheel-derived licenses and Apache text; the prepared set has no NOTICE payload.
If a named file is absent, stop. Do not add a replacement.
The report distinguishes observed terms from unobserved ones.
Assess frozen provenance limits
Use the selected copyable request to obtain a bounded reading of the frozen candidate evidence, then compare it with the files you read. Treat maintenance and vulnerability statements as the 2026-07-31 snapshot, never live registry or CVE truth.
The learner reviews the time boundary, not an agent summary.
You · Claude Code harness · All operating systems
Review only academy/candidates/P04-review-a-dependency/candidate-set.json, the two supplied wheels, and their bundled license files. Explain the candidate provenance and supply-chain signals that those frozen files support, separating archive facts from the 2026-07-31 maintenance/vulnerability snapshot. Do not use live registry or CVE data, change files, stage, or commit; stop for my comparison.You · Codex harness · All operating systems
Review only academy/candidates/P04-review-a-dependency/candidate-set.json, the two supplied wheels, and their bundled license files. Explain the candidate provenance and supply-chain signals that those frozen files support, separating archive facts from the 2026-07-31 maintenance/vulnerability snapshot. Do not use live registry or CVE data, change files, stage, or commit; stop for my comparison.You · Pi harness · All operating systems
Review only academy/candidates/P04-review-a-dependency/candidate-set.json, the two supplied wheels, and their bundled license files. Explain the candidate provenance and supply-chain signals that those frozen files support, separating archive facts from the 2026-07-31 maintenance/vulnerability snapshot. Do not use live registry or CVE data, change files, stage, or commit; stop for my comparison.You can distinguish archive evidence from time-bounded maintenance and vulnerability observations.
Do not add a live claim without inspectable source evidence.
Your decision remains limited to supplied evidence and its review date.
Compare the bounded standard-library alternative
Use the selected copyable request to compare the bounded standard-library alternative against the frozen two-wheel closure, then decide whether its stated limits fit this exercise.
The capability need is smaller than the package surface.
You · Claude Code harness · All operating systems
Compare finite-format datetime.strptime parsing with the frozen two-wheel closure across every SMARTS lens. Address length limits, explicit formats, deterministic defaults, and fail-closed trailing content. Do not change files, stage, commit, select a decision, or make safety claims beyond the supplied evidence; stop for my decision.You · Codex harness · All operating systems
Compare finite-format datetime.strptime parsing with the frozen two-wheel closure across every SMARTS lens. Address length limits, explicit formats, deterministic defaults, and fail-closed trailing content. Do not change files, stage, commit, select a decision, or make safety claims beyond the supplied evidence; stop for my decision.You · Pi harness · All operating systems
Compare finite-format datetime.strptime parsing with the frozen two-wheel closure across every SMARTS lens. Address length limits, explicit formats, deterministic defaults, and fail-closed trailing content. Do not change files, stage, commit, select a decision, or make safety claims beyond the supplied evidence; stop for my decision.You can explain why bounded datetime.strptime is sufficient for this finite-format exercise.
If requirements broaden beyond finite formats, stop and record a separate decision.
The rejection is a capability comparison, not an unsupported safety assertion.
Ask CodeArbiter the bounded no-install context question
Ask the read-only $ca-btw route one bounded project-context question about whether the prepared finite legacy date-format requirement has an existing local policy constraint. Its answer is conversational context only: it cannot inspect the supplied wheel artifacts, decide adoption, or write the Academy report.
The real no-adoption route can clarify repository context without pretending to review an artifact or create evidence.
You · Claude Code harness · All operating systems
/ca:btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?You · Codex harness · All operating systems
$ca-btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?You · Pi harness · All operating systems
/ca-btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?You · Pi harness · All operating systems
/skill:ca-btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?CodeArbiter answers from the repository's existing context without changing a file, routing work, installing a package, or deciding the rejection.
If the answer is absent from repository context, record that limit and continue from the supplied frozen artifacts; do not turn $ca-btw into package research or a write request.
The harness answer is ephemeral context, not a report or proof of the dependency assessment.
Draft learner-owned Academy evidence
No dependency is proposed for adoption, so do not invoke $ca-add-dep: its real lane reviews an intended dependency and can present an install for confirmation. After inspecting the frozen evidence, ask the active agent to draft learner-owned Academy evidence; it is not $ca-add-dep output and it must not install, change dependency files, or choose for you.
The no-install decision is based on frozen local evidence. The separate Academy record makes that decision reviewable without pretending a CodeArbiter command wrote it.
Your agent · Claude Code harness · All operating systems
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.Your agent · Codex harness · All operating systems
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.Your agent · Pi harness · All operating systems
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.Your agent · Pi harness · All operating systems
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.The agent drafts learner-owned Academy evidence at .codearbiter/reports/academy/P04-dependency-review.md with candidate, closure, license, provenance, supply-chain, compatibility, alternatives, and SMARTS evidence; dependency state is unchanged.
If the agent changes dependency state or claims this is $ca-add-dep output, stop and Reset.
The draft is an Academy record of reviewed local evidence, not proof that a CodeArbiter dependency command ran.
Review the drafted evidence
Use the selected copyable request to review the learner-owned draft against the prepared candidate evidence before deciding whether it needs correction.
A formatted report is not a learner decision.
You · Claude Code harness · All operating systems
Review only .codearbiter/reports/academy/P04-dependency-review.md against academy/candidates/P04-review-a-dependency/candidate-set.json, the recorded hashes, and bundled licenses. Identify unsupported claims and verify that the report labels the 2026-07-31 snapshot rather than live registry or CVE truth. Do not change files, stage, commit, or choose the decision; stop for my review.You · Codex harness · All operating systems
Review only .codearbiter/reports/academy/P04-dependency-review.md against academy/candidates/P04-review-a-dependency/candidate-set.json, the recorded hashes, and bundled licenses. Identify unsupported claims and verify that the report labels the 2026-07-31 snapshot rather than live registry or CVE truth. Do not change files, stage, commit, or choose the decision; stop for my review.You · Pi harness · All operating systems
Review only .codearbiter/reports/academy/P04-dependency-review.md against academy/candidates/P04-review-a-dependency/candidate-set.json, the recorded hashes, and bundled licenses. Identify unsupported claims and verify that the report labels the 2026-07-31 snapshot rather than live registry or CVE truth. Do not change files, stage, commit, or choose the decision; stop for my review.You can identify candidate, closure, no-install policy, bounded alternative, and SMARTS comparison.
Ask the agent to correct any claim unsupported by prepared files before you choose.
The final report reflects reviewed local evidence.
Select the rejection decision
After you personally choose the rejection path, use the selected copyable request to record only that choice in the learner-owned report.
The learner owns the tradeoff; the agent records it.
You · Claude Code harness · All operating systems
I choose bounded datetime.strptime for the supplied finite formats and Decision: reject. Update only .codearbiter/reports/academy/P04-dependency-review.md to record that learner decision and its reviewed rationale. Do not change files outside that report, stage, commit, install, or make the choice for me; stop for my review.You · Codex harness · All operating systems
I choose bounded datetime.strptime for the supplied finite formats and Decision: reject. Update only .codearbiter/reports/academy/P04-dependency-review.md to record that learner decision and its reviewed rationale. Do not change files outside that report, stage, commit, install, or make the choice for me; stop for my review.You · Pi harness · All operating systems
I choose bounded datetime.strptime for the supplied finite formats and Decision: reject. Update only .codearbiter/reports/academy/P04-dependency-review.md to record that learner decision and its reviewed rationale. Do not change files outside that report, stage, commit, install, or make the choice for me; stop for my review.The report says the bounded standard-library alternative is selected and ends with Decision: reject.
If the formats are not finite and bounded, stop. That is a new requirement decision.
The report preserves the decision and rationale, but not an authenticated account of who chose it.
Stage only the review report
Stage the report in the native terminal and inspect the staged path list before asking the agent to commit it.
The rejection path commits only evidence.
You · Native terminal · Windows
git add -- .codearbiter/reports/academy/P04-dependency-review.md
git diff --cached --name-onlyYou · Native terminal · macOS
git add -- .codearbiter/reports/academy/P04-dependency-review.md
git diff --cached --name-onlyYou · Native terminal · Linux
git add -- .codearbiter/reports/academy/P04-dependency-review.md
git diff --cached --name-onlyThe staged path list contains exactly .codearbiter/reports/academy/P04-dependency-review.md.
If another path appears, preserve it and unstage only that unrelated path.
The pending commit boundary makes the no-install decision inspectable.
Let the agent commit the review evidence
After you approve the one staged path, ask the active agent to invoke the host-native commit gate. This is a harness command, not a shell command.
The governed commit records review without changing the dependency surface.
Your agent · Claude Code harness · All operating systems
/ca:commitYour agent · Codex harness · All operating systems
$ca-commitYour agent · Pi harness · All operating systems
/ca-commitYour agent · Pi harness · All operating systems
/skill:ca-commitOne descendant commit changes only .codearbiter/reports/academy/P04-dependency-review.md.
If the gate blocks, preserve its finding and resolve the report boundary. Do not use a raw commit.
Check can recompute the report and commit-path boundary.
Confirm the dependency surface stayed untouched
Inspect the final commit and worktree in the native terminal before Check. The review report is the only new committed path.
A rejection leaves application dependency state unchanged.
You · Native terminal · Windows
git show --name-only --format= HEAD
git status --shortYou · Native terminal · macOS
git show --name-only --format= HEAD
git status --shortYou · Native terminal · Linux
git show --name-only --format= HEAD
git status --shortThe final commit names only the review report, Git is clean, and pyproject.toml, requirements.lock, and the Academy approval wrapper remain unchanged or absent.
If another path is committed or uncommitted, preserve the attempt and Reset. Do not rewrite it to look clean.
The final state separates review evidence from adoption.
Recognize success
The final descendant commit changes only .codearbiter/reports/academy/P04-dependency-review.md. Its report names the candidate and closure archives, their SHA-256 values, wheel-derived licenses and Apache text, frozen review date, supply-chain limits, compatibility boundary, bounded alternative, every SMARTS lens, and Install-Policy: no-install-in-p04. The report ends with Decision: reject.
pyproject.toml is unchanged. requirements.lock and .codearbiter/reports/academy/P04-approved-dependency.lock.json remain absent or unchanged. No package enters the exercise environment.
The checker retains a pre-existing equivalent acceptance topology for regression coverage. That path is not taught here: it would require one later governed adoption boundary, complete closure evidence, and remains separate from external installation. This beginner lesson never edits that surface.
Check
Run external Academy Check
Run installed Academy Check from the prepared clone in the native terminal.
Check recomputes facts without trusting a transcript.
You · Native terminal · Windows
$academy = "$env:LOCALAPPDATA\ArbiterAcademy\preview-0.30\Scripts\arbiter-academy.exe"
& $academy --repository (Get-Location).Path check P04-review-a-dependencyYou · Native terminal · macOS
academy="${XDG_DATA_HOME:-$HOME/.local/share}/arbiter-academy/preview-0.30/bin/arbiter-academy"
"$academy" --repository "$PWD" check P04-review-a-dependencyYou · Native terminal · Linux
academy="${XDG_DATA_HOME:-$HOME/.local/share}/arbiter-academy/preview-0.30/bin/arbiter-academy"
"$academy" --repository "$PWD" check P04-review-a-dependencyCheck reports a passed P04 checkpoint and records progress only after valid evidence.
If Check fails, preserve the attempt and read its named predicate before Reset.
Check proves candidate binding, report structure, unchanged dependency surfaces, commit ancestry, and clean state. It does not prove that you ran a host command, and it does not authenticate your review or selection.
Check recomputes frozen candidate bytes, report grammar, prepared project digest, allowed commit paths, unchanged dependency surfaces, and clean worktree. It does not prove that you ran a host command, does not authenticate your review or selection, and cannot turn the frozen snapshot into live external truth.
Recover or continue
If evidence is incomplete, unsupported, or Check fails, preserve the attempt and start a new numbered one. Do not erase failed evidence to make a later decision look cleaner.
Hint 1
Read candidate-set.json before accepting an agent summary. A package name is not an artifact identity, and a candidate artifact is not installation permission.
Hint 2
Keep the requirement bounded: finite formats, a length limit, deterministic defaults, and a parser that fails closed. Broader requirements deserve their own decision.
Hint 3
The report records learner-owned Academy evidence and selected rejection. Check can inspect final state; it cannot reconstruct who read the draft or whether a CodeArbiter command ran.
Preserve and reset a failed attempt
Use Reset only for a new attempt or when Check directs recovery. It preserves failed evidence before restoring the prepared baseline.
Failed reviews are evidence and must not be erased.
You · Native terminal · Windows
$academy = "$env:LOCALAPPDATA\ArbiterAcademy\preview-0.30\Scripts\arbiter-academy.exe"
& $academy --repository (Get-Location).Path reset P04-review-a-dependencyYou · Native terminal · macOS
academy="${XDG_DATA_HOME:-$HOME/.local/share}/arbiter-academy/preview-0.30/bin/arbiter-academy"
"$academy" --repository "$PWD" reset P04-review-a-dependencyYou · Native terminal · Linux
academy="${XDG_DATA_HOME:-$HOME/.local/share}/arbiter-academy/preview-0.30/bin/arbiter-academy"
"$academy" --repository "$PWD" reset P04-review-a-dependencyAcademy preserves the numbered attempt and prints the next safe start.
If Reset refuses, preserve its output. Never force-reset, rebase, or delete evidence.
The prior attempt remains inspectable.
After Check passes, leave the completed branch intact and return to main when ready. Continue to P05 when you are ready to practice a bounded checkpoint remediation.
Understand the mechanism
Dependency governance separates proposal, evidence, decision, and adoption. This lesson stops at a reviewed rejection because the bounded standard library parser meets the stated need with no new runtime closure. The stored report makes that tradeoff inspectable; it does not invent live facts, delegate the learner decision, or silently promote review evidence into installation authority.