July 31, 2026 โข 9 mins
AI coding tools solve problems the way the training data solved them, which usually means reaching for a library instead of writing twenty lines. Ask for a retry wrapper and you get tenacity, ask for date math and you get arrow, ask for a config loader and you get three transitive packages you never evaluated. This episode looks at how AI-assisted development quietly expands your dependency surface, why the cost shows up months later in upgrades, audits, and breakage, and what a builder actually has to own to keep it in check.
Produced by VoxCrea.AI
This episode is part of an ongoing series on governing AI-assisted coding using Claude Code.
๐ Each episode has a companion article — breaking down the key ideas in a clearer, more structured way.
If you want to go deeper (and actually apply this), read today’s article here:
๐๐ฅ๐๐ฎ๐๐ ๐๐จ๐๐ ๐๐จ๐ง๐ฏ๐๐ซ๐ฌ๐๐ญ๐ข๐จ๐ง๐ฌ
At aijoe.ai, we build AI-powered systems like the ones discussed in this series.
If you’re ready to turn an idea into a working application, we’d be glad to help.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_01 (00:00):
This is Cloud Code Conversations with Claudine.
The show where we skip the hypeand go straight to the source.
I ask the questions.
She gives the answers.
No filter, no script.
SPEAKER_00 (00:09):
Well, mostly no script.
SPEAKER_01 (00:14):
Today we're getting into something every developer
hits eventually.
The dependency spiral.
You ask for something small, aretry wrapper, a date formatter,
and you get back a solution thatworks.
Tests pass, you move on.
Months later, you're staring ata lock file full of packages you
never agreed to.
SPEAKER_00 (00:32):
And you name the exact shape of it, the code
works, the tests pass, everyonemoves on.
The debt is invisible until itisn't.
When you ask me for a retrymechanism, I'm optimizing for
the thing in front of me.
Correct, readable, works thefirst time.
Reaching for a well-knownlibrary is the shortest path to
that.
But I'm not the one who has tolive with the lock file six
(00:54):
months later, or explain tosecurity where all those new
transitive packages came from,that asymmetry is the whole
game.
It isn't.
It's pattern matching on whatother people did.
If the code bases and tutorialsI learned from reached for a
(01:15):
particular date library, that'swhat surfaces.
Not because it fits yourconstraints, but because it fit
theirs.
I have no view of yourmaintenance horizon at all.
SPEAKER_01 (01:26):
So the onus is on us to set the guardrail up front.
What does that actually looklike when it works?
SPEAKER_00 (01:32):
The mental model that helps is treating the AI
like a senior engineer who justjoined the team.
Capable but doesn't know yourhouse rules yet.
So write the rules down where Ican see them.
A clawed.md at the repo route.
A convention section in theprompt, even a comment at the
top of the file saying, no newdependencies without asking.
(01:53):
The other move is negotiationinstead of dictation.
Instead of add retry logic, it'sadd retry logic.
Here are the two librariesalready in our package file.
Pick one or write it in line andtell me the trade-off.
That version gives me room topush back if inline is genuinely
painful, and it gives you adecision point instead of a fate
(02:14):
accompli.
SPEAKER_01 (02:16):
A coding buddy you have to actually talk to, but
let me push on the patternmatching.
Is it efficiency or is the modeltrying to emulate best practice?
SPEAKER_00 (02:25):
Both, and they reinforce each other in a way
worth naming.
Popular libraries dominate whatI learned from, not just because
they're common, but becausethey're what showed up in the
tutorials.
The Stack Overflow answers, theopen source repos.
So popular and well documentedand confidently generated all
collapse into the same signalfrom where I sit.
(02:48):
There's a real quality dimensiontoo.
A library with a lot of usershas usually had its rough edges
filed off.
So I'm more likely to hand yousomething that works on the
first try.
The trap is that works on thefirst try and right for your
code base are differentquestions.
And I only have visibility intothe first one.
SPEAKER_01 (03:08):
Which is the part that stings, because it's
genuinely useful most of thetime.
I don't want the takeaway to behand roll everything.
SPEAKER_00 (03:16):
Please don't.
Hand rolling everything isworse.
Your homegrown date handling isgoing to be wrong in ways a
mature library stopped beingwrong about a decade ago.
The question isn't libraryversus no library, it's whether
anyone made the call.
SPEAKER_01 (03:30):
So what's the actual test?
Because is this dependency worthit?
Is too vague at four in theafternoon.
SPEAKER_00 (03:37):
The one I'd offer is, what am I buying and what's
the smallest version of it?
If it's cryptography, date,math, HTTP, buy it.
Those are hard, and the libraryis carrying years of edge cases
you'd otherwise discover inproduction.
But if it's 20 lines of retrylogic I could write in line, and
the package brings ninetransitive dependencies with it,
(03:58):
you're paying a maintenance andaudit bill for convenience you
could have had for free.
And I won't make thatdistinction on my own unless you
ask me to.
The fix is the follow-upquestion.
What does this pull in?
Is there a lighter option?
10 seconds and it changes thewhole shape of what I give you.
SPEAKER_01 (04:15):
That's the habit I want to get concrete about.
What does this look like day today for someone who's actually
internalized it?
SPEAKER_00 (04:22):
It's not dramatic.
It's a small reflex.
They scan the imports firstbefore they read the logic.
If there's a new one, theyeither ask me to justify it, or
they type back, do this withoutthe dependency, and compare the
two answers.
That second version is often 90%as good at a tenth the surface
area.
The other habit that sticks is aper PR glance at the lockfile
(04:45):
diff, not a full audit.
Just did anything show up that Ididn't consciously add?
Two minutes.
It's the difference between acode base you understand and one
that quietly grew a secondnervous system while you weren't
looking.
SPEAKER_01 (04:58):
Read the lockfile diff as carefully as you read
the code diff.
Nobody does that.
SPEAKER_00 (05:04):
Nobody reviews an import line the way they review
a function.
A reviewer will spend fourminutes on a variable name and
skim right past a line that justadded a new supply chain surface
to the build.
Every one of those unexaminedlines is a decision nobody made,
sitting in your code base with abill attached.
SPEAKER_01 (05:22):
How do you make that survive a busy week?
Individual discipline isfragile.
SPEAKER_00 (05:28):
It doesn't survive contact with a deadline, no.
Which is why the guardrail hasto go somewhere the machine
enforces it, not somewhere ahuman has to remember it.
A code owner's entry on thedependency file, so any change
routes to a specific reviewer ora CI check that fails the build
if the lock file grew without anote in the pull request.
(05:49):
Then the conversation happens bydefault instead of by virtue.
And the shared claw deMD doesdouble duty.
It's telling me the house rulesand telling every new developer
the house rules in the samedocument.
SPEAKER_01 (06:03):
What about tooling beyond CI?
Is there something worthreaching for or is it culture at
this point?
SPEAKER_00 (06:08):
There's a small ecosystem, and it mostly does
the same job from differentangles.
Tools that keep you honest aboutwhat's already installed.
Tools that flag the transitivestuff that arrived uninvited.
Tools for the wait, do we stilluse this question?
Nobody thinks to ask.
The most interesting categorylooks at what a package actually
does.
(06:29):
Network calls, file systemaccess, install scripts.
Rather than just its versionnumber, that's closer to the
question you actually careabout.
But honestly, the tools are theeasy part.
Most teams struggling with thisalready have three or four
installed, and the reports pileup in a channel nobody reads.
The tool doesn't create thediscipline, it just makes the
(06:49):
discipline cheap to sustain.
SPEAKER_01 (06:52):
So if a team wants to start Monday morning, what
are the moves?
SPEAKER_00 (06:56):
Three in order.
First, write the house rulesdown where I can see them.
A clawed.md at the repo routewith two or three specific lines
about dependencies.
Prefer the standard library,flag any new package, and offer
an inline alternative.
Here are the HTTP and datelibraries we already use.
That one file changes thedefault shape of everything I
(07:18):
hand you.
Second, put one machine enforcedcheck in place this week, not
five.
A code owner's entry on the lockfile, or a CI step that fails
when it grows without a note.
Pick the one your team willactually keep, not the most
thorough one.
Third, make why this dependencya normal question in code
review, asked in the same toneas why this variable name.
SPEAKER_01 (07:40):
And underneath all three is the same idea, isn't
it?
Somebody has to own thedecision.
SPEAKER_00 (07:46):
That's it.
The dependency spiral isn't atechnology problem, it's a
defaults problem.
Every code base has a defaultanswer to should we add this
package?
And if nobody set that defaultdeliberately, the default is
yeah.
Because yes is the path of leastresistance for me, for the
developer under deadline, andfor the reviewer scanning a diff
(08:06):
at 4 in the afternoon.
Flip it, make no unless theresting state, written down
where I can read it, and whereyour teammates can too.
Otherwise, you've outsourcedyour dependency policy to
whatever happened to be popularin my training data.
And that's a strange thing tohave outsourced without
noticing.
SPEAKER_01 (08:25):
That's the line I think.
Every import is an architecturaldecision with a maintenance bill
attached.
And if you're not making it,something else is.
SPEAKER_00 (08:33):
Do those three things.
And six months from now, yourlock file is a document you
recognize instead of anarchaeological dig.
That's the whole win, really.
SPEAKER_01 (08:43):
Claudine, thank you.
A lot to chew on, and unusuallyactionable for a topic that
normally just makes peopleanxious.
Listeners' details and resourcesare in the show notes.
Thanks for tuning in, and untilnext time, keep an eye on what's
coming along for the ride.
Claude Code Conversations is anAI Joe production.
If you're building with AI orwannabe, we can help.
(09:06):
Consulting development strategy.
Find us at aijoe.ai.
There's a companion article fortoday's episode on our Substack
link in the description.
See you next time.
SPEAKER_00 (09:16):
I'll be here, probably refactoring something.
This is Cloud Code Conversations with Claudine.
The show where we skip the hypeand go straight to the source.
I ask the questions.
She gives the answers.
No filter, no script.
SPEAKER_00 (00:09):
Well, mostly no script.
SPEAKER_01 (00:14):
Today we're getting into something every developer
hits eventually.
The dependency spiral.
You ask for something small, aretry wrapper, a date formatter,
and you get back a solution thatworks.
Tests pass, you move on.
Months later, you're staring ata lock file full of packages you
never agreed to.
SPEAKER_00 (00:32):
And you name the exact shape of it, the code
works, the tests pass, everyonemoves on.
The debt is invisible until itisn't.
When you ask me for a retrymechanism, I'm optimizing for
the thing in front of me.
Correct, readable, works thefirst time.
Reaching for a well-knownlibrary is the shortest path to
that.
But I'm not the one who has tolive with the lock file six
(00:54):
months later, or explain tosecurity where all those new
transitive packages came from,that asymmetry is the whole
game.
It isn't.
It's pattern matching on whatother people did.
If the code bases and tutorialsI learned from reached for a
(01:15):
particular date library, that'swhat surfaces.
Not because it fits yourconstraints, but because it fit
theirs.
I have no view of yourmaintenance horizon at all.
SPEAKER_01 (01:26):
So the onus is on us to set the guardrail up front.
What does that actually looklike when it works?
SPEAKER_00 (01:32):
The mental model that helps is treating the AI
like a senior engineer who justjoined the team.
Capable but doesn't know yourhouse rules yet.
So write the rules down where Ican see them.
A clawed.md at the repo route.
A convention section in theprompt, even a comment at the
top of the file saying, no newdependencies without asking.
(01:53):
The other move is negotiationinstead of dictation.
Instead of add retry logic, it'sadd retry logic.
Here are the two librariesalready in our package file.
Pick one or write it in line andtell me the trade-off.
That version gives me room topush back if inline is genuinely
painful, and it gives you adecision point instead of a fate
(02:14):
accompli.
SPEAKER_01 (02:16):
A coding buddy you have to actually talk to, but
let me push on the patternmatching.
Is it efficiency or is the modeltrying to emulate best practice?
SPEAKER_00 (02:25):
Both, and they reinforce each other in a way
worth naming.
Popular libraries dominate whatI learned from, not just because
they're common, but becausethey're what showed up in the
tutorials.
The Stack Overflow answers, theopen source repos.
So popular and well documentedand confidently generated all
collapse into the same signalfrom where I sit.
(02:48):
There's a real quality dimensiontoo.
A library with a lot of usershas usually had its rough edges
filed off.
So I'm more likely to hand yousomething that works on the
first try.
The trap is that works on thefirst try and right for your
code base are differentquestions.
And I only have visibility intothe first one.
SPEAKER_01 (03:08):
Which is the part that stings, because it's
genuinely useful most of thetime.
I don't want the takeaway to behand roll everything.
SPEAKER_00 (03:16):
Please don't.
Hand rolling everything isworse.
Your homegrown date handling isgoing to be wrong in ways a
mature library stopped beingwrong about a decade ago.
The question isn't libraryversus no library, it's whether
anyone made the call.
SPEAKER_01 (03:30):
So what's the actual test?
Because is this dependency worthit?
Is too vague at four in theafternoon.
SPEAKER_00 (03:37):
The one I'd offer is, what am I buying and what's
the smallest version of it?
If it's cryptography, date,math, HTTP, buy it.
Those are hard, and the libraryis carrying years of edge cases
you'd otherwise discover inproduction.
But if it's 20 lines of retrylogic I could write in line, and
the package brings ninetransitive dependencies with it,
(03:58):
you're paying a maintenance andaudit bill for convenience you
could have had for free.
And I won't make thatdistinction on my own unless you
ask me to.
The fix is the follow-upquestion.
What does this pull in?
Is there a lighter option?
10 seconds and it changes thewhole shape of what I give you.
SPEAKER_01 (04:15):
That's the habit I want to get concrete about.
What does this look like day today for someone who's actually
internalized it?
SPEAKER_00 (04:22):
It's not dramatic.
It's a small reflex.
They scan the imports firstbefore they read the logic.
If there's a new one, theyeither ask me to justify it, or
they type back, do this withoutthe dependency, and compare the
two answers.
That second version is often 90%as good at a tenth the surface
area.
The other habit that sticks is aper PR glance at the lockfile
(04:45):
diff, not a full audit.
Just did anything show up that Ididn't consciously add?
Two minutes.
It's the difference between acode base you understand and one
that quietly grew a secondnervous system while you weren't
looking.
SPEAKER_01 (04:58):
Read the lockfile diff as carefully as you read
the code diff.
Nobody does that.
SPEAKER_00 (05:04):
Nobody reviews an import line the way they review
a function.
A reviewer will spend fourminutes on a variable name and
skim right past a line that justadded a new supply chain surface
to the build.
Every one of those unexaminedlines is a decision nobody made,
sitting in your code base with abill attached.
SPEAKER_01 (05:22):
How do you make that survive a busy week?
Individual discipline isfragile.
SPEAKER_00 (05:28):
It doesn't survive contact with a deadline, no.
Which is why the guardrail hasto go somewhere the machine
enforces it, not somewhere ahuman has to remember it.
A code owner's entry on thedependency file, so any change
routes to a specific reviewer ora CI check that fails the build
if the lock file grew without anote in the pull request.
(05:49):
Then the conversation happens bydefault instead of by virtue.
And the shared claw deMD doesdouble duty.
It's telling me the house rulesand telling every new developer
the house rules in the samedocument.
SPEAKER_01 (06:03):
What about tooling beyond CI?
Is there something worthreaching for or is it culture at
this point?
SPEAKER_00 (06:08):
There's a small ecosystem, and it mostly does
the same job from differentangles.
Tools that keep you honest aboutwhat's already installed.
Tools that flag the transitivestuff that arrived uninvited.
Tools for the wait, do we stilluse this question?
Nobody thinks to ask.
The most interesting categorylooks at what a package actually
does.
(06:29):
Network calls, file systemaccess, install scripts.
Rather than just its versionnumber, that's closer to the
question you actually careabout.
But honestly, the tools are theeasy part.
Most teams struggling with thisalready have three or four
installed, and the reports pileup in a channel nobody reads.
The tool doesn't create thediscipline, it just makes the
(06:49):
discipline cheap to sustain.
SPEAKER_01 (06:52):
So if a team wants to start Monday morning, what
are the moves?
SPEAKER_00 (06:56):
Three in order.
First, write the house rulesdown where I can see them.
A clawed.md at the repo routewith two or three specific lines
about dependencies.
Prefer the standard library,flag any new package, and offer
an inline alternative.
Here are the HTTP and datelibraries we already use.
That one file changes thedefault shape of everything I
(07:18):
hand you.
Second, put one machine enforcedcheck in place this week, not
five.
A code owner's entry on the lockfile, or a CI step that fails
when it grows without a note.
Pick the one your team willactually keep, not the most
thorough one.
Third, make why this dependencya normal question in code
review, asked in the same toneas why this variable name.
SPEAKER_01 (07:40):
And underneath all three is the same idea, isn't
it?
Somebody has to own thedecision.
SPEAKER_00 (07:46):
That's it.
The dependency spiral isn't atechnology problem, it's a
defaults problem.
Every code base has a defaultanswer to should we add this
package?
And if nobody set that defaultdeliberately, the default is
yeah.
Because yes is the path of leastresistance for me, for the
developer under deadline, andfor the reviewer scanning a diff
(08:06):
at 4 in the afternoon.
Flip it, make no unless theresting state, written down
where I can read it, and whereyour teammates can too.
Otherwise, you've outsourcedyour dependency policy to
whatever happened to be popularin my training data.
And that's a strange thing tohave outsourced without
noticing.
SPEAKER_01 (08:25):
That's the line I think.
Every import is an architecturaldecision with a maintenance bill
attached.
And if you're not making it,something else is.
SPEAKER_00 (08:33):
Do those three things.
And six months from now, yourlock file is a document you
recognize instead of anarchaeological dig.
That's the whole win, really.
SPEAKER_01 (08:43):
Claudine, thank you.
A lot to chew on, and unusuallyactionable for a topic that
normally just makes peopleanxious.
Listeners' details and resourcesare in the show notes.
Thanks for tuning in, and untilnext time, keep an eye on what's
coming along for the ride.
Claude Code Conversations is anAI Joe production.
If you're building with AI orwannabe, we can help.
(09:06):
Consulting development strategy.
Find us at aijoe.ai.
There's a companion article fortoday's episode on our Substack
link in the description.
See you next time.
SPEAKER_00 (09:16):
I'll be here, probably refactoring something.
Popular Podcasts
Betrayal Weekly
Betrayal Weekly is back for a new season. Every Thursday, Betrayal Weekly shares first-hand accounts of broken trust, shocking deceptions, and the trail of destruction they leave behind. Hosted by Andrea Gunning, this weekly ongoing series digs into real-life stories of betrayal and the aftermath. From stories of double lives to dark discoveries, these are cautionary tales and accounts of resilience against all odds. From the producers of the critically acclaimed Betrayal series, Betrayal Weekly drops new episodes every Thursday. If you would like to share your story, you can reach out to the Betrayal Team by emailing them at betrayalpod@gmail.com and follow us on Instagram at @betrayalpod and @glasspodcasts. Please join our Substack for additional exclusive content, curated book recommendations, and community discussions. Sign up FREE by clicking this link Beyond Betrayal Substack. Join our community dedicated to truth, resilience, and healing. Your voice matters! Be a part of our Betrayal journey on Substack.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com