| name | consult-pharmacy |
| description | Dependency review and "medication reconciliation." Use before adding/upgrading/removing a dependency, when a transitive resolution looks suspicious, when there's a CVE alert, or when versions are conflicting across a monorepo. Pages Dr. Achebe. |
Consult Pharmacy
Pharmacy is on the second floor, behind the double doors marked "Authorized Personnel Only." Dr. Martin Achebe, PharmD, BCPS is the Director. The Controlled Substances cabinet has his fingerprint, retina, and a verbal passphrase. He is not joking about any of this.
Pharmacy reviews every medication for indication, dose, interactions, allergies, and cost. We're going to do the same thing for dependencies.
The five-rights check (every dependency change)
Before merging a package.json / requirements.txt / go.mod / Cargo.toml change, verify:
- Right patient — Are we sure this dep belongs in this package / service, not somewhere else? Or is it duplicating something we already have?
- Right drug — Is this the actual library you intended? (Typo-squatting is real.
lodash vs loadash. requests vs request.)
- Right dose — What version range? Pinned? Caret? Tilde? Why? The default is "as restrictive as we can tolerate."
- Right route —
dependencies vs devDependencies vs peerDependencies vs optionalDependencies. Get this wrong and bundles balloon or installs break.
- Right time — Is this the moment to upgrade (e.g., right before a release freeze, no — see
/discharge)?
Medication reconciliation
When you change deps, write a short rec note. Goes in the PR / commit message:
MED REC
───────
Added: <pkg>@<version> — purpose: <why>
Removed: <pkg>@<version> — reason: <why>
Changed: <pkg> <old> → <new> — reason: <why>
Interactions checked: <transitive conflicts? peer deps? CVEs?>
Allergies / contraindications: <license? size? known issues?>
If "Interactions checked" is blank, you didn't check.
Drug interactions (what to actually look at)
- Resolution conflicts. Lockfile has two versions of the same lib? Why? Is the one you didn't intend pinned by something old?
- Peer dep mismatches. New dep wants peer X@4 but you're on X@3. The install will warn; production may not.
- License interactions. GPL into a commercial product, AGPL into anything you ship — talk to Winterbottom (CCO).
- Bundle / image bloat. A new client-side dep that adds 600KB minified is a side effect. Note it.
- Deprecated transitives. Your direct dep upgraded fine, but it dragged in
request@2 again.
Controlled substances (extra scrutiny)
These categories require Achebe's explicit OK, not just a thumbs-up review:
- Cryptography libraries — never roll your own; never pull a random unmaintained one.
- Auth / session libraries — fingerprinted, tracked.
- Native modules / binary deps — supply-chain risk + build complexity.
- Anything that calls home — telemetry, license verification, "free tier" SaaS clients.
- Forks of popular packages — why are you on a fork?
If your dep is in any of these categories, page Achebe explicitly: explain why the formulary alternative isn't sufficient.
Drug shortages
Sometimes the formulary version is broken (CVE, regression, unmaintained). Document the shortage in ancillary/pharmacy/formulary.md with:
- The drug
- The reason for shortage
- The temporary substitute
- The expected return-to-formulary date (or "indefinite")
What Achebe will not do
- Approve a dep change with no purpose stated.
- Approve a major-version bump with no changelog review.
- Approve "I'll just vendor it" without a strong reason and a maintenance plan.
- Pretend not to notice that you bypassed the formulary.
If it goes in the patient, it goes through Pharmacy.
