@fractal-code/runner

The customer-facing CLI for Fractal Code. Drops the canonical pipeline source into your repo, boots a local API + dashboard, and wires AI agents (Cursor / Claude Code) through the constitutional governance layer.

npm install -g @fractal-code/runner

cd /path/to/your/repo
fractal-runner init       # drops .fractal/, FRACTAL.md, scope.json,
                          # .claude/settings.json, .cursor/rules/
fractal-runner serve      # boots local API + dashboard, opens browser

Then wire MCP into Cursor or Claude Code per the repo's README.

Subcommands

| Command | What it does | |---|---| | init | Drops the canonical pipeline source into ./.fractal/. | | upgrade | Refresh template artifacts after a runner upgrade. | | serve | Local API + dashboard. | | run <task> | Run the canonical pipeline against the current project. | | mcp | Start the MCP server on stdio for Cursor / Claude Code. | | doctor | Pre-flight environment + scope + key checks. | | channel-status | Lists installed channels and pending channel requests. | | regulated [on\|off\|status] | Toggle regulated mode (compliance ratchet for HIPAA / PCI-DSS / GDPR / EU AI Act / NAIC / NYDFS). |

Regulated Mode

Regulated mode is a one-way ratchet on top of the v4 always-strict baseline. When on, the system:

• Requires API keys to come from a trusted external injector (Vault Agent / AWS Secrets Manager / Doppler) and audits every env-resolution.
• Requires LLM channels to declare a responseSchema for validator-checked provider responses.
• Activates Redis-backed distributed rate limiting.
• Mandates HMAC-SHA-256 (with a tenant key) for the redactor's strategy:"hash".
• Fires HITL approvals on every destructive workspace op (writes, renames, git pushes).
• Persists every LLM call to an AES-256-GCM-encrypted transaction ledger for regulator replay.

Required for HIPAA / PCI-DSS 4.0 / GDPR / EU AI Act Title III / NAIC / NYDFS deploys.

See the Fractal Code repo for the constitutional model and full architecture.

License

See LICENSE.