PramanaSutra AI
Check release readiness, then hand the decision to a person.
QA and release-readiness check. It reads files, does not run the project tests, writes four copies of one audit, then stops for a person.
- No test run
- 5 rules
- 17 skills
- npm latest
- [email protected]
- GitHub version
- 0.3.4
- Licence
- Apache-2.0
- Language
- CLI plus HTML docs
- Weekly downloads
- 481
- GitHub stars
- 0
Live npm weekly downloads and the latest npm version, plus GitHub stars and the package.json version, fetched 2026-11-07 20:26 UTC. Cached 10 minutes. Weekly downloads cover 2026-10-31 to 2026-11-06, not a lifetime total.
Use it when
- 1
You want a static check for focused tests, skipped tests, missing tests, missing CI, and missing license.
- 2
You want one audit written as four report files.
- 3
You want an exit code a pipeline can read, with a human still approving.
What it does, and what it does not
Read this before the guide. A limit here is a limit of the tool.
Does
- 5 static rules: focused test, skipped test, no tests, no CI, no license.
- 17 skills. The project page says they are instructions and do not execute tests.
- Four report files: Markdown, HTML, JSON, and SARIF 2.1.0. SARIF is not uploaded.
- Exit 2 is NO_GO. Exit 3 is REVIEW_REQUIRED. Exit 0 is READY_FOR_HUMAN_APPROVAL. Ready is not a deploy.
- 0 runtime dependencies. The CLI makes no network call.
- Required CI on the project page is Ubuntu and Windows, Node 20 and 22.
Does not
- It does not run the target tests, a browser, a load generator, or a vulnerability scanner.
- It does not sign evidence. verify checks the JSON shape.
- A pasted passing JSON is labelled unbound or ci-environment. Neither label proves the command ran.
- macOS is not on the required matrix. Cancelled macOS jobs are not a pass.
- The npm page can lag the git version until a person completes publish.
- automatedDeploymentAuthorized is false. A person still approves.
Claims above are from the project pages and are attributed as stated there. They are not independently verified here.
How a run moves
From the PramanaSutra docs home, version 0.3.4. It reads files, does not run the project tests, writes four copies of one audit, then stops for a person.
-
1. Input
Files, not a test run
You run the tests if you want them run. This CLI does not run them, a browser, a load generator, or a vulnerability scanner.
-
2. Check
5 static rules
Focused test, skipped test, no tests, no CI, no license. 17 skills are instructions and do not execute tests.
-
3. Report
Four copies
Markdown, HTML, JSON, and SARIF 2.1.0. SARIF is not uploaded. verify checks the JSON shape. It does not sign evidence.
-
4. Decision
A person approves
Exit 2 is NO_GO. Exit 3 is REVIEW_REQUIRED. Exit 0 is READY_FOR_HUMAN_APPROVAL. Ready is not a deploy.
How to read the result
Wording is from the project page or README and is attributed as stated there. It is not independently verified here.
Commands and notes
- npm package name is pramanasutra. Repository name is pramanasutra-ai.
- scan and release-check share the exit codes above. A scan with no evidence file exits 3.
- --changed lists names from git diff. It does not choose tests.
Guide
How to use the result. GitHub is the source repository. npm is the install.
What the command does
PramanaSutra AI 0.3.4. The docs home says it reads files, does not run the project tests, writes four copies of one audit, then stops for a person.
- scan uses the same exit codes as release-check. A scan with no evidence file exits 3.
- Exit 2 is NO_GO. Exit 3 is REVIEW_REQUIRED. Exit 0 is READY_FOR_HUMAN_APPROVAL. Ready is not a deploy.
- No evidence file is binding none. A file with no GitHub identity is unbound. Four GitHub strings is ci-environment, and that is still not a signature.
- --changed lists names from git diff. It does not choose tests.
- 5 static rules: focused test, skipped test, no tests, no CI, no license.
- 17 skills. The page says they are instructions and do not execute tests. The IDE model does, if the host loads them.
What this version does not do
- It does not run the target tests, a browser, a load generator, or a vulnerability scanner.
- It does not sign evidence. verify checks the JSON shape.
- A pasted passing JSON is labelled unbound or ci-environment. Neither label proves the command ran.
- Required CI is Ubuntu and Windows, Node 20 and 22. macOS is not on the required matrix. Cancelled macOS jobs are not a pass.
- The npm page can lag the git version until a person completes publish.
- automatedDeploymentAuthorized is false. A person still approves.
- The page says no independent security review has been done, and the page is not a legal opinion.
Questions
Does PramanaSutra run my tests?
No. The project page says you run them, then pass an evidence file. The report says the tool did not execute tests.
Is a ready result a release?
No. Exit 0 means READY_FOR_HUMAN_APPROVAL. The page says automatedDeploymentAuthorized is false and a person still approves.