Toolchain — the env is the lockfile, everywhere

The failure this stops: it works on this Mac, fails in CI, and fails differently in the container, because three environments were built three ways. One lockfile per project, committed, and every environment — local, CI, image, GPU cluster — is built from it.

Adding a dependency at all is the last rung: stdlib → platform feature → something already installed → only then a new package, and the commit message says why.

Python — uv, always

• A bare uv sync uninstalls pytest in these repos — dev deps here are an extra, not a dependency-group, so --group dev is also wrong. uv sync --locked --extra dev is what CI runs.
• uv.lock is committed and must agree with pyproject.toml; uv lock --check fails when it drifted. Never edit a lockfile by hand.
• Never pip install into the system interpreter, never sudo pip, never pip install --user, never conda activate in a repo that has a uv.lock. .venv/ is gitignored, never committed.
• Repos with GPU weights pull gigabytes on sync — for a check that needs no GPU, run the single smoke test rather than syncing everything.

JavaScript — the repo's lockfile names the manager

Detect, do not choose: pnpm-lock.yaml → pnpm · package-lock.json → npm · yarn.lock → yarn. One lockfile per repo; two lockfiles means two machines resolve two different trees, so delete the stray one rather than letting both live.

Lockfile is committed with the change that caused it. node_modules/ is never committed. No global installs (npm i -g) for anything a project needs — that is an undeclared dependency.

Keep the installable surface small

A library used by many callers should default to few, light dependencies. Push anything heavy or niche (a specific embedding backend, an optional storage driver) behind an extra so installing the core does not pull it in. A script meant to run out-of-process (a git hook, a background job) that duplicates logic from the main package should stay stdlib-only and never import the package back -- and carry one test asserting the duplicated function still matches the original, so the two cannot silently drift apart.

Container and GPU cluster — the container is the env, the lock still rules

• Base image pinned by digest (python:3.12-slim@sha256:…), not a moving tag, and never :latest.
• Inside the image: copy pyproject.toml + uv.lock, then uv sync --locked. No loose pip install X lines in a Dockerfile — that is a dependency nobody can reproduce.
• SkyPilot / SLURM tasks install the same way in setup:; a task that pip installs a list of packages inline is how "runs on the cluster, broken locally" happens. See the cluster-job skill, if installed.
• The image tag that ran a job goes in that run's README.md (skill layout), so the run can be rebuilt.

Repos that predate this rule

Some legacy repos in your org still carry requirements.txt or an environment.yml from before this convention. Do not convert them as a side effect of an unrelated change. Record the debt once — ./ops problem where the repo has it, otherwise a line in docs/problems/ — and migrate to pyproject.toml + uv.lock the next time work lands in that repo on purpose.

Check that closes a toolchain change