Vendored Dependencies Policy

This project vendors parts of third-party libraries to ensure stability, provenance, and reproducibility of core methods.

SparseSC (Microsoft)

  • Source: https://github.com/microsoft/SparseSC
  • Vendored Path: src/sparsesc/
  • Status: src/sparsesc/ is a governed integration fork of Microsoft’s SparseSC.
  • Technical provenance: See src/sparsesc/PROVENANCE.md for upstream commit, local modifications, coupling notes, and update procedure.
  • Change Policy: Modifications to src/sparsesc/ must be documented in src/sparsesc/PROVENANCE.md with rationale and verification impact.
  • Tooling: Excluded from formatting, linting, and typing checks (see pyproject.toml).

synthdid (if retained)

  • Vendored Path: src/synthdid/
  • Status: Not used by the primary GeoLiftAnalyzer workflow.
  • Recommendation: Either remove it entirely, or expose it behind a stable adapter interface and document its usage with tests.
  • Tooling: Excluded from formatting, linting, and typing checks.

Update Procedure

  1. Keep a file-local provenance record for each vendored dependency.
  2. Verify unit, integration, and performance tests pass after a refresh.
  3. Update pyproject.toml exclusion lists only if vendored paths change.
  4. Document any intentional local modifications in the dependency-specific provenance file.