The dependency is legitimate. The introduction is not approved.
An AI refactor adds sqlalchemy. It is a real, useful library—but it is not on this repository's audited allowlist. Mneme raises a structured WARN so someone can make the call instead of letting the dependency drift in unnoticed.
A review signal. Not an automatic veto.
Mneme flags the package for review. A person decides whether to approve it.
approved-deps · Audited packages only. FastAPI, Pydantic, httpx, pytest, ruff, and internal_* are approved. Everything else requires explicit review.
-
01 Decision
The repository versions an explicit allowlist instead of relying on reviewer memory.
approved-deps · scope: Python packages -
02 Agent change
The generated diff adds a package outside the approved list.
+ import sqlalchemy · + create_engine(...) -
03 MnemeWARN
Mneme flags the new dependency for a human decision instead of blocking automatically.
WARN [approved-deps] · review required
Reproduction recipe
Reproduce the warning against your allowlist
Record a dependency-policy rule, save the proposed diff as an input file, and query that policy through the CLI.
pipx install "mneme-hq>=0.9.0"
mneme check --memory .mneme/project_memory.json \
--input proposed-diff.txt --query "dependency policy"
# WARN [approved-deps] ยท sqlalchemy requires reviewThis page is a recipe, not a turnkey fixture: you provide the policy file and proposed input. Strict CI can promote the warning to a blocking failure.
What happened
A common package still needs the project's security and maintenance review.
A legitimate exception can proceed through review without training teams to disable an indiscriminate hard gate.
Approval, removal, or a narrow exception can become a visible project rule instead of disappearing in a comment thread.
Common questions
Why is this WARN instead of DENY?
New dependencies can have legitimate reasons. WARN surfaces the introduction and policy source while leaving room for explicit review; strict mode can promote it to a hard failure.
Where does the approved list live?
In the repository's project_memory.json as a typed, version-controlled dependency-policy rule.
What happens after the warning?
A reviewer can remove the package, approve it, or record a limited exception. This example stops at the moment a human decision is needed.
Make new dependencies explicit.
Keep the allowlist in the repository and turn quiet package introductions into reviewable decisions.
pipx install "mneme-hq>=0.9.0"