AI lifecycle · rule ai-dependency-unpinned
Unpinned AI and ML library versions
A Metacenta review checks this under the rule AI libraries are pinned to one version. Everything below applies whether or not you ever commission one.
What this rule checks
For recognised AI and ML libraries, such as model SDKs and training frameworks, this rule flags each one declared without an exact version. ==1.2.3 passes; >=, ~=, ^ and no constraint do not.
Why it matters
Two installs of the project can run different code. A prompt can behave differently on a colleague's machine than in production, and the same training script can produce a different model.
How to fix it
Pin every model and training library to one version. Pin each library to one version, such as openai==1.51.0. Then let a lockfile or a dependency bot move it on purpose, rather than a rebuild moving it by accident.
Before:
# requirements.txt
openai>=1.0
scikit-learn
After:
# requirements.txt
openai==1.51.0
scikit-learn==1.5.2
When it is fine to leave
A library resolved through a committed lockfile is pinned in practice. We read the manifest, not the lockfile, so we still report it; tell us, and it comes out of your report.
What we need to check it
The dependency manifests in your repository: requirements.txt, pyproject.toml or package.json. We recognise a fixed list of libraries, so an unlisted one is not judged.