P04 is a guided, runnable Academy lesson in this preview. Its shared action cards are the public course route.
Complete P03 in the same Academy fork and clone. Keep a native terminal at the clone root for Academy operations and file inspection. Keep one codeArbiter harness open at that same clone for agent work. Native-terminal commands are entered directly and never begin with !. A shell command inside a harness begins with exactly one !. codeArbiter commands and agent messages belong in the harness and never begin with !.
The website is the primary lesson surface. Academy CLI only handles Prepare, Check, and Reset. It does not replace these guided decisions.
This is a review lesson, not a package-adoption lesson. The candidate set is committed offline evidence. It is not a live package-registry lookup, and its maintenance and vulnerability statements are a frozen 2026-07-31 snapshot rather than current registry or CVE truth.
Its policy is review-only-never-install. The report still records Known vulnerabilities and
Supply chain as named review sections, but calls neither live truth. The prepared set has No NOTICE payload; no install during P04 means neither archive enters the exercise environment.
You will preserve one reviewed report for python-dateutil==2.9.0.post0 and its six closure. The beginner path rejects the candidate because finite legacy date formats can use a bounded datetime.strptime parser: explicit formats, a length limit, deterministic timezone and default rules, and fail-closed trailing-content behavior.
No codeArbiter dependency-adoption command applies: $ca-add-dep is for an intended adoption and may present an install for confirmation. Use read-only $ca-btw only for a bounded question about existing repository context; it cannot inspect the frozen wheel artifacts, decide adoption, or write a report. After you inspect the supplied files, an ordinary harness request drafts learner-owned Academy evidence. You inspect it, review the tradeoff, and then select Decision: reject. The resulting commit contains only the review report. It does not change a dependency declaration, environment lock, or Academy approval wrapper. The existing checkpoint can still recognize its pre-existing equivalent acceptance topology, but that is not an instruction path in this lesson.
Academy prints academy/P04-review-a-dependency/ATTEMPT_NUMBER and switches to that branch.
Evidence
The branch binds later evidence to one prepared project state.
If that does not happen
Preserve an error and resolve only its named condition before retrying.
2
YouBrowser
Read the no-install boundary
Use the website as the primary lesson surface before asking an agent to review the proposal. This beginner path teaches rejection only.
Why this matters: Review is evidence about a proposal, not permission to change project state.
Expected result
You can state that Academy CLI only handles Prepare, Check, and Reset and that this lesson does not add a dependency declaration, environment lock, or Academy wrapper.
Evidence
No repository evidence has been created yet.
If that does not happen
If you expected package adoption, stop and return to the course boundary.
3
You
Read the frozen candidate set
Read the committed candidate set in the native terminal. It is offline evidence, not a live registry query.
Why this matters: The review must name exact candidate bytes.
shasum -a 256 academy/candidates/P04-review-a-dependency/python_dateutil-2.9.0.post0-py2.py3-none-any.whl academy/candidates/P04-review-a-dependency/six-1.17.0-py2.py3-none-any.whl
You can name both wheel-derived licenses and Apache text; the prepared set has no NOTICE payload.
Evidence
The report distinguishes observed terms from unobserved ones.
If that does not happen
If a named file is absent, stop. Do not add a replacement.
8
You
Assess frozen provenance limits
Use the selected copyable request to obtain a bounded reading of the frozen candidate evidence, then compare it with the files you read. Treat maintenance and vulnerability statements as the 2026-07-31 snapshot, never live registry or CVE truth.
Why this matters: The learner reviews the time boundary, not an agent summary.
Any OS · Claude Code
Review only academy/candidates/P04-review-a-dependency/candidate-set.json, the two supplied wheels, and their bundled license files. Explain the candidate provenance and supply-chain signals that those frozen files support, separating archive facts from the 2026-07-31 maintenance/vulnerability snapshot. Do not use live registry or CVE data, change files, stage, or commit; stop for my comparison.
Any OS · Codex
Review only academy/candidates/P04-review-a-dependency/candidate-set.json, the two supplied wheels, and their bundled license files. Explain the candidate provenance and supply-chain signals that those frozen files support, separating archive facts from the 2026-07-31 maintenance/vulnerability snapshot. Do not use live registry or CVE data, change files, stage, or commit; stop for my comparison.
Any OS · Pi
Review only academy/candidates/P04-review-a-dependency/candidate-set.json, the two supplied wheels, and their bundled license files. Explain the candidate provenance and supply-chain signals that those frozen files support, separating archive facts from the 2026-07-31 maintenance/vulnerability snapshot. Do not use live registry or CVE data, change files, stage, or commit; stop for my comparison.
Expected result
You can distinguish archive evidence from time-bounded maintenance and vulnerability observations.
Evidence
Your decision remains limited to supplied evidence and its review date.
If that does not happen
Do not add a live claim without inspectable source evidence.
9
You
Compare the bounded standard-library alternative
Use the selected copyable request to compare the bounded standard-library alternative against the frozen two-wheel closure, then decide whether its stated limits fit this exercise.
Why this matters: The capability need is smaller than the package surface.
Any OS · Claude Code
Compare finite-format datetime.strptime parsing with the frozen two-wheel closure across every SMARTS lens. Address length limits, explicit formats, deterministic defaults, and fail-closed trailing content. Do not change files, stage, commit, select a decision, or make safety claims beyond the supplied evidence; stop for my decision.
Any OS · Codex
Compare finite-format datetime.strptime parsing with the frozen two-wheel closure across every SMARTS lens. Address length limits, explicit formats, deterministic defaults, and fail-closed trailing content. Do not change files, stage, commit, select a decision, or make safety claims beyond the supplied evidence; stop for my decision.
Any OS · Pi
Compare finite-format datetime.strptime parsing with the frozen two-wheel closure across every SMARTS lens. Address length limits, explicit formats, deterministic defaults, and fail-closed trailing content. Do not change files, stage, commit, select a decision, or make safety claims beyond the supplied evidence; stop for my decision.
Expected result
You can explain why bounded datetime.strptime is sufficient for this finite-format exercise.
Evidence
The rejection is a capability comparison, not an unsupported safety assertion.
If that does not happen
If requirements broaden beyond finite formats, stop and record a separate decision.
10
You
Ask codeArbiter the bounded no-install context question
Ask the read-only $ca-btw route one bounded project-context question about whether the prepared finite legacy date-format requirement has an existing local policy constraint. Its answer is conversational context only: it cannot inspect the supplied wheel artifacts, decide adoption, or write the Academy report.
Why this matters: The real no-adoption route can clarify repository context without pretending to review an artifact or create evidence.
Any OS · Claude Code
/ca:btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?
Any OS · Codex
$ca-btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?
Any OS · Pi
/ca-btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?
Any OS · Pi
/skill:ca-btw Does the existing Academy context constrain the finite legacy date-format requirement beyond the supplied P04 artifacts?
Expected result
codeArbiter answers from the repository's existing context without changing a file, routing work, installing a package, or deciding the rejection.
Evidence
The harness answer is ephemeral context, not a report or proof of the dependency assessment.
If that does not happen
If the answer is absent from repository context, record that limit and continue from the supplied frozen artifacts; do not turn $ca-btw into package research or a write request.
11
Your host
Draft learner-owned Academy evidence
No dependency is proposed for adoption, so do not invoke $ca-add-dep: its real lane reviews an intended dependency and can present an install for confirmation. After inspecting the frozen evidence, ask the active agent to draft learner-owned Academy evidence; it is not $ca-add-dep output and it must not install, change dependency files, or choose for you.
Why this matters: The no-install decision is based on frozen local evidence. The separate Academy record makes that decision reviewable without pretending a codeArbiter command wrote it.
Any OS · Claude Code
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.
Any OS · Codex
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.
Any OS · Pi
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.
Any OS · Pi
Draft .codearbiter/reports/academy/P04-dependency-review.md from the frozen P04 candidate files only. This is learner-owned Academy evidence, not $ca-add-dep output. Do not install, modify dependency files, stage, or commit; wait for my review.
Expected result
The agent drafts learner-owned Academy evidence at .codearbiter/reports/academy/P04-dependency-review.md with candidate, closure, license, provenance, supply-chain, compatibility, alternatives, and SMARTS evidence; dependency state is unchanged.
Evidence
The draft is an Academy record of reviewed local evidence, not proof that a codeArbiter dependency command ran.
If that does not happen
If the agent changes dependency state or claims this is $ca-add-dep output, stop and Reset.
12
You
Review the drafted evidence
Use the selected copyable request to review the learner-owned draft against the prepared candidate evidence before deciding whether it needs correction.
Why this matters: A formatted report is not a learner decision.
Any OS · Claude Code
Review only .codearbiter/reports/academy/P04-dependency-review.md against academy/candidates/P04-review-a-dependency/candidate-set.json, the recorded hashes, and bundled licenses. Identify unsupported claims and verify that the report labels the 2026-07-31 snapshot rather than live registry or CVE truth. Do not change files, stage, commit, or choose the decision; stop for my review.
Any OS · Codex
Review only .codearbiter/reports/academy/P04-dependency-review.md against academy/candidates/P04-review-a-dependency/candidate-set.json, the recorded hashes, and bundled licenses. Identify unsupported claims and verify that the report labels the 2026-07-31 snapshot rather than live registry or CVE truth. Do not change files, stage, commit, or choose the decision; stop for my review.
Any OS · Pi
Review only .codearbiter/reports/academy/P04-dependency-review.md against academy/candidates/P04-review-a-dependency/candidate-set.json, the recorded hashes, and bundled licenses. Identify unsupported claims and verify that the report labels the 2026-07-31 snapshot rather than live registry or CVE truth. Do not change files, stage, commit, or choose the decision; stop for my review.
Expected result
You can identify candidate, closure, no-install policy, bounded alternative, and SMARTS comparison.
Evidence
The final report reflects reviewed local evidence.
If that does not happen
Ask the agent to correct any claim unsupported by prepared files before you choose.
13
You
Select the rejection decision
After you personally choose the rejection path, use the selected copyable request to record only that choice in the learner-owned report.
Why this matters: The learner owns the tradeoff; the agent records it.
Any OS · Claude Code
I choose bounded datetime.strptime for the supplied finite formats and Decision: reject. Update only .codearbiter/reports/academy/P04-dependency-review.md to record that learner decision and its reviewed rationale. Do not change files outside that report, stage, commit, install, or make the choice for me; stop for my review.
Any OS · Codex
I choose bounded datetime.strptime for the supplied finite formats and Decision: reject. Update only .codearbiter/reports/academy/P04-dependency-review.md to record that learner decision and its reviewed rationale. Do not change files outside that report, stage, commit, install, or make the choice for me; stop for my review.
Any OS · Pi
I choose bounded datetime.strptime for the supplied finite formats and Decision: reject. Update only .codearbiter/reports/academy/P04-dependency-review.md to record that learner decision and its reviewed rationale. Do not change files outside that report, stage, commit, install, or make the choice for me; stop for my review.
Expected result
The report says the bounded standard-library alternative is selected and ends with Decision: reject.
Evidence
The report preserves the decision and rationale, but not an authenticated account of who chose it.
If that does not happen
If the formats are not finite and bounded, stop. That is a new requirement decision.
14
You
Stage only the review report
Stage the report in the native terminal and inspect the staged path list before asking the agent to commit it.
Why this matters: The rejection path commits only evidence.
The staged path list contains exactly .codearbiter/reports/academy/P04-dependency-review.md.
Evidence
The pending commit boundary makes the no-install decision inspectable.
If that does not happen
If another path appears, preserve it and unstage only that unrelated path.
15
Your host
Let the agent commit the review evidence
After you approve the one staged path, ask the active agent to invoke the host-native commit gate. This is a harness command, not a shell command.
Why this matters: The governed commit records review without changing the dependency surface.
Any OS · Claude Code
/ca:commit
Any OS · Codex
$ca-commit
Any OS · Pi
/ca-commit
Any OS · Pi
/skill:ca-commit
Expected result
One descendant commit changes only .codearbiter/reports/academy/P04-dependency-review.md.
Evidence
Check can recompute the report and commit-path boundary.
If that does not happen
If the gate blocks, preserve its finding and resolve the report boundary. Do not use a raw commit.
16
You
Confirm the dependency surface stayed untouched
Inspect the final commit and worktree in the native terminal before Check. The review report is the only new committed path.
Why this matters: A rejection leaves application dependency state unchanged.
Windows
git show --name-only --format= HEAD
git status --short
macOS
git show --name-only --format= HEAD
git status --short
Linux
git show --name-only --format= HEAD
git status --short
Expected result
The final commit names only the review report, Git is clean, and pyproject.toml, requirements.lock, and the Academy approval wrapper remain unchanged or absent.
Evidence
The final state separates review evidence from adoption.
If that does not happen
If another path is committed or uncommitted, preserve the attempt and Reset. Do not rewrite it to look clean.
The final descendant commit changes only .codearbiter/reports/academy/P04-dependency-review.md. Its report names the candidate and closure archives, their SHA-256 values, wheel-derived licenses and Apache text, frozen review date, supply-chain limits, compatibility boundary, bounded alternative, every SMARTS lens, and Install-Policy: no-install-in-p04. The report ends with Decision: reject.
pyproject.toml is unchanged. requirements.lock and .codearbiter/reports/academy/P04-approved-dependency.lock.json remain absent or unchanged. No package enters the exercise environment.
The checker retains a pre-existing equivalent acceptance topology for regression coverage. That path
is not taught here: it would require one later governed adoption boundary, complete closure evidence,
and remains separate from external installation. This beginner lesson never edits that surface.
Check reports a passed P04 checkpoint and records progress only after valid evidence.
Evidence
Check proves candidate binding, report structure, unchanged dependency surfaces, commit ancestry, and clean state. It does not prove that you ran a host command, and it does not authenticate your review or selection.
If that does not happen
If Check fails, preserve the attempt and read its named predicate before Reset.
Check recomputes frozen candidate bytes, report grammar, prepared project digest, allowed commit paths, unchanged dependency surfaces, and clean worktree. It does not prove that you ran a host command, does not authenticate your review or selection, and cannot turn the frozen snapshot into live external truth.
If evidence is incomplete, unsupported, or Check fails, preserve the attempt and start a new numbered one. Do not erase failed evidence to make a later decision look cleaner.
Read candidate-set.json before accepting an agent summary. A package name is not an artifact identity, and a candidate artifact is not installation permission.
Keep the requirement bounded: finite formats, a length limit, deterministic defaults, and a parser that fails closed. Broader requirements deserve their own decision.
The report records learner-owned Academy evidence and selected rejection. Check can inspect final state; it cannot reconstruct who read the draft or whether a codeArbiter command ran.
18
You
Preserve and reset a failed attempt
Use Reset only for a new attempt or when Check directs recovery. It preserves failed evidence before restoring the prepared baseline.
Why this matters: Failed reviews are evidence and must not be erased.
Academy preserves the numbered attempt and prints the next safe start.
Evidence
The prior attempt remains inspectable.
If that does not happen
If Reset refuses, preserve its output. Never force-reset, rebase, or delete evidence.
After Check passes, leave the completed branch intact and return to main when ready. Continue to P05 when you are ready to practice a bounded checkpoint remediation.
Dependency governance separates proposal, evidence, decision, and adoption. This lesson stops at a reviewed rejection because the bounded standard library parser meets the stated need with no new runtime closure. The stored report makes that tradeoff inspectable; it does not invent live facts, delegate the learner decision, or silently promote review evidence into installation authority.
