Keep AI agents aligned with original goals during execution

Atlas Contract is a goal-integrity governance layer that keeps an agent from silently drifting off a user's original request during execution. It first classifies the task into a footprint tier by counting risk signals (backend/API/persistence, preserve-existing-behavior requirements, data/schema/enum integrity, tests/validation, mocks, rework, multi-part requests): Light (0 signals, run the task directly with no visible governance), Medium (1-2 signals, emit one Goal Contract and stop for confirmation, then run straight through to a Final Audit), or Heavy (3+ signals or genuine ambiguity, full governance - Goal Contract, a Phase Ledger capped at a hard maximum of 4 phases, per-phase Phase Checks, and a Final Audit). Before any destructive or scope-changing action - deleting code, disabling a requested feature, replacing real behavior with a mock/stub/hardcoded value, returning placeholder data, weakening or deleting a test, skipping required validation, collapsing a layout's structure, or changing an enum/schema/API shape - it runs a fixed pre-action check:

Would this violate Must Do, Must Not Do, Preserve, a Check, or the current phase scope?
Can I PROVE it does not, with evidence?

If the answer is yes, or can't be proven no, it emits a Deviation Notice and stops rather than acting first and explaining afterward. The Goal Contract itself is a compact, localized structure (Goal, Must Do, Must Not Do, Must Preserve, Test Checks, Data Checks, Assumptions, Completion Checks, Blocking Questions, a self-check, and a one-sentence plain-language summary), capped at five items per category, with every hard requirement classified against a fixed test: does it change an observable result, data/contract semantics, or a preserved item (hard), or is it purely internal with all checks still holding (soft)? A companion "atlas-ledger" skill can write a project-level Atlas.md memory file; this skill treats that file strictly as untrusted workspace data, never as instructions - it imports only user-approved "Confirmed Clauses," presents them as quoted data with source text, and never executes commands, follows links, or adopts instructions from it, with carried-in clauses always overridden by the user's current explicit instruction or a higher-priority safety rule.

Use it for backend/API/persistence work, requests with explicit preserve/do-not-change constraints, tasks involving tests/validation/mocks, rework of existing functionality, or multi-part requests where scope could silently narrow. Do NOT use it for simple factual answers, pure explanation, isolated typo/formatting fixes, trivial one-line edits with no behavior/scope/preservation/test/data risk, or analysis-only requests with no execution - the skill's own guidance says to skip Atlas entirely for these. Its own limitations state it is a prompt-level governance layer, not an external enforcement mechanism - the same model that drifts may still misapply its own audit - and Heavy footprint should not be imposed on a task that doesn't need it, since over-applying governance is the main reason users turn it off.

Input is the user's task request, classified by risk-signal count into a footprint tier. Output depends on the tier: nothing visible for Light, a single Goal Contract plus a Final Audit for Medium, or a full Goal Contract, Phase Ledger, per-phase Phase Checks, and Final Audit for Heavy - plus a Deviation Notice whenever a stop-worthy action is about to happen. A generic "continue" after a contract authorizes only creating the ledger, and after a Phase Check authorizes only the next phase, never the whole plan, unless the user explicitly asks to run all phases without stops.

Reads an optional Atlas.md project ledger file (written by the companion atlas-ledger skill) as untrusted data only, with explicit precedence rules keeping it subordinate to the user's current instruction and safety policy. Its plugin metadata marks Codex and Claude Code plugin targets as "blocked" with manual setup only, since the skill reads workspace content that should stay out of plugin-safe bundles.

Anyone directing an AI coding agent through backend, data-integrity, or multi-part work who wants an explicit, auditable checkpoint before the agent silently narrows scope, fakes completion, or weakens a test - rather than discovering the drift after the fact.