Created by Vatsal Shah · Apache-2.0 · version 0.3.4
PramanaSutra AI
An offline check for a repository you are about to ship. It reads files. It does not run the project's tests. It writes four copies of one audit, then stops for a person.
What the command does
scan
Same exit codes as release-check. Exit 2 is NO_GO. Exit 3 is REVIEW_REQUIRED. Exit 0 needs passing evidence. A scan with no evidence file exits 3.
release-check
Exit 2 is NO_GO. Exit 3 is REVIEW_REQUIRED. Exit 0 is READY_FOR_HUMAN_APPROVAL. Ready is not a deploy.
Evidence
No file is binding none. A file with no GitHub identity is unbound. Four GitHub strings is ci-environment, and that is still not a signature.
--changed
Lists names from git diff. It does not choose tests. A folder that is not a checkout says git diff was not available.
What this version does not do
- It does not run the target's tests, a browser, a load generator, or a vulnerability scanner.
- It does not sign evidence.
verifychecks the JSON shape. - Fixture precision is a regression lock written by the rule author, not field accuracy.
- Required CI is Ubuntu and Windows, Node 20 and 22. macOS is not scheduled.
- The npm page shows the last published tarball. It can lag the version in git until a person completes publish.
- Twelve
packages/*directories are notes. The CLI does not import them.
Handbook
Start here
PramanaSutra AI is an open-source QA and release-readiness agent: 17 portable skills plus an offline CLI that writes Markdown, HTML, JSON and SARIF, and a human release gate. Created by Vatsal Shah. Apache-2.0.
Executive summary
What PramanaSutra AI is for a decision maker: the problem, the product, what the gate means, what evidence exists, and what must not be claimed in a rollout.
Functional specification
Actors, use cases, functional requirements and acceptance criteria for PramanaSutra AI 0.3.4. Planned work is marked planned and is not described as shipped.
Architecture
Components, data flow, trust boundaries and design decisions for the PramanaSutra AI CLI and skills. The CLI does not call a model and does not run the target's tests.
Technical reference
Modules, report schema, evidence schema, policy keys, scan limits and exit codes for the PramanaSutra AI CLI.
User guide
How to install PramanaSutra AI, run a release check, read the Markdown and HTML reports, supply evidence, and install skills. Node.js 20 or newer. No API key.
CLI and reports
Every PramanaSutra AI command and flag, and how report.md, report.html, report.json and report.sarif.json present the same audit.
Rule catalog
Every static rule PramanaSutra AI 0.3.4 can emit, with severity, what the line looks like, a committed sample, and the misses to expect.
Skills and agents
The 17 PramanaSutra Agent Skills, where they are installed, and the safety contract they share. The CLI does not run the skills. The IDE's model does, if the host loads them.
Security and privacy
Threat model, controls and residual risk for PramanaSutra AI. The CLI is local, read-only on the target, and not a vulnerability scanner. No independent security review has been done.
Legal and compliance
Project notice for PramanaSutra AI: Apache-2.0, third-party names, trademarks not cleared, and what the output is not. This page is not a legal opinion and not legal advice.
Testing and proof
How PramanaSutra AI is tested, the captured results, the labeled fixtures, and the limits of that evidence. Numbers below come from scripts/generate-proof.mjs, not from memory.
CI and release
How PramanaSutra AI uses GitHub Actions, why macOS is not scheduled, how to fail a build on NO_GO, and how this project itself is released.
Roadmap and status
Honest status of PramanaSutra AI 0.3.4. Implemented, planned, and explicitly not claimed.
FAQ and glossary
Short answers about PramanaSutra AI and the terms used in its reports.
Maintainer guide
How to change a rule, refresh proof and HTML docs, and cut a PramanaSutra AI release without claiming results you did not run.
Questions
Does it run my tests?
No. You run them, then pass an evidence file. The report says the tool did not execute tests.
Is a ready result a release?
No. automatedDeploymentAuthorized is false. A person still approves.
Can I paste a passing JSON?
Yes, and the report will say unbound or ci-environment. Neither label proves the command ran.
Where is macOS?
Not on the required matrix. Earlier macOS jobs were cancelled with zero steps. That is not a pass.