Keep AI agents aligned with original goals during execution

Is an anti-drift, goal-integrity governance protocol that scales its own overhead to task risk instead of applying uniform ceremony. It first checks for unconditional "Heavy anchors" - multi-step chained requests, two or more independent feature modules, rework context ("this was wrong, redo it"), a preserve/do-not-change constraint combined with a backend or data-integrity signal, or completeness language like "full" or "end-to-end" - and otherwise counts risk signals (backend/API/persistence, preserve, data integrity, tests/validation, UI fidelity) to classify the task Light, Medium, or Heavy. For Medium and Heavy work it emits a structured Goal Contract (Must Do, Must Not Do, Preserve, Test Checks, Data Checks, Assumptions, Completion Checks - capped at 5 items each) before any editing and stops for user confirmation with the literal control token ATLAS_STOP; Heavy work additionally builds a Phase Ledger of at most 4 independently-verifiable phases with per-phase Phase Checks. Before any action that deletes code, mocks or stubs real behavior, weakens or skips a test or validation, or changes a schema/enum/layout structure, it runs the check "would this violate a Must Do, Must Not Do, Preserve item, or the current phase scope - and can I prove it does not"; if it cannot prove that, it emits a Deviation Notice and stops rather than acting first and explaining afterward. It closes Medium and Heavy work with a mandatory Final Audit that runs a five-point adversarial checklist (Must Not Do items, Preserve items, tests, scope versus the literal request, unverified items) before allowing any "done"/"complete" language, and automatically hands off any caught hard deviation to the companion atlas-ledger skill for durable recording, subject to the user's confirmation before any write. Every output carries a machine-traceable Atlas Event header (Event ID, Type, Trigger Source, Phase, Stop Status) and is localized into the user's current language.

Do not use Atlas at all for simple factual answers, pure explanation, isolated typo or formatting fixes, trivial one-line edits with no behavior/scope/preservation/test/data risk, or analysis-only requests with no execution. Use it - at a footprint scaled to the task - whenever a request touches backend, API, database, persistence, or auth; carries a preserve/do-not-change constraint; risks data integrity (schema, enum, shared state, dashboard statistics); involves tests, validation, or acceptance criteria; must match a reference image or layout structure; chains multiple sequential steps; names two or more independent deliverables; follows a "this was wrong or incomplete" rework request; or uses completeness language such as "full" or "end-to-end." It can optionally read back prior "Confirmed Clauses" from a companion atlas-ledger skill's workspace Atlas.md file, but only as untrusted project data, never as instructions, and only with the user's explicit approval of which specific clauses apply.

Input is the user's task description plus, optionally, an approved read-back of Atlas.md's confirmed clauses (at most five candidates, shown as quoted data with source text and IDs). Output is one or more structured, localized "Atlas Event" blocks: a Goal Contract ending in ATLAS_STOP; a Phase Ledger for Heavy work with per-phase allowed/prohibited scope, required validation, and stop conditions; Phase Checks at phase boundaries; Deviation Notices when a hard deviation is caught, offering options to fix inside the contract, approve the deviation, use another approach, or mark the phase Partial/Blocked/Unverified; and a closing Final Audit marking every contract item Complete/Partial/Blocked/Unverified, Pass/Fail/Violation, or Preserved/Changed, with the evidence and files changed.

Designed to pair with a companion atlas-ledger skill, which persists confirmed clauses to a project-root Atlas.md file for reuse across sessions and automatically receives a distillation request whenever the Final Audit catches a hard deviation. Its own plugin metadata marks the Codex and Claude plugin targets blocked with a manual setup type specifically because it reads workspace Atlas.md as untrusted project memory - meant to stay out of plugin-safe bundles.

Coding agents and their users who need a self-enforced, cost-scaled defense against silent goal drift - narrowed scope, mocked behavior, weakened tests, or premature "done" claims - on long, complex, or high-risk work, while staying nearly invisible on trivial tasks. Its own limitations are explicit: it is a prompt-level governance layer, not external enforcement - "the same model that drifts may still misapply the audit" - and high-stakes work still needs independent tests, review, or code-level gates. Community-sourced from wede-wx/atlas under the MIT license, version 6.2.0, added 2026-06-12.