An opinionated engineering harness that turns one Claude Code session into a disciplined software team.
Architect · Coder · Reviewer · Tester · Ops Gate · Reflect — six roles, strict contracts, one loop that closes itself.
"The model is commoditized. Structured enforcement of process is the moat."
Atlas is how a solo founder ships like a team. It wraps Claude Code in six specialist roles, each a thin contract over a Skill, that hand work to each other through files on disk — never chat. The boundaries are the point: a Coder that can't make architecture decisions, a Tester that's mechanically forbidden from guessing before it reads the real error, an Ops Gate where "deployed, should work" is not a finish line.
It was built at Oxycell — a $1M/month hyperbaric-chamber company run by 1 founder + 1 employee + a fleet of AI agents — and is published by ScaleX, which productizes that operating model. It has already earned its keep (see Proof).
flowchart TD
direction TB
subgraph ARCH["🏛️ ARCHITECT — produce the WHAT (in-session)"]
W[/atlas-warroom<br/>explore + clarify/] --> M[/atlas-memo<br/>★ operator seals scope/]
M --> R[/atlas-researcher<br/>prior art + codebase/]
R --> CEO[/atlas-plan-ceo-review<br/>10-section CC-simulated/]
CEO --> ENG[/atlas-plan-eng-review<br/>diagrams · test matrix · /ultraplan/]
end
ENG --> GATE{Execution mode?}
GATE -->|A · manual cascade| MANUAL[Fire each stage yourself]
GATE -->|B · autonomous| GOAL[[/atlas-goal<br/>drives all 5 stages]]
GATE -->|D · revise| M
GOAL --> CODER
MANUAL --> CODER
subgraph BUILD["⚒️ BUILD → SHIP"]
CODER[👷 CODER<br/>isolated git worktree<br/>+ atlas-memo-check every commit] --> REV
REV[🔍 REVIEWER — parallel<br/>independent 2nd model + atlas-cso security] --> TEST
TEST[🧪 TESTER<br/>probe → investigate → browse → qa<br/>SERVER-PROBE FIRST, mechanical] --> OPS
OPS[🚀 OPS GATE<br/>ship → deploy → canary → verify<br/>auto-rollback on FAIL]
end
OPS --> REFLECT[🔄 REFLECT · /atlas-learn<br/>lessons → notes + harness-improvement proposals]
REFLECT -.->|self-improves next sprint| W
REV -.->|BLOCKER| CODER
TEST -.->|FAIL ×2| ENG
OPS -.->|verify FAIL → auto-rollback| ENG
CODER -.->|scope drift| M
classDef seal fill:#1e40af,stroke:#60a5fa,color:#fff
class M seal
Read it as: scope goes in the top (sealed by a human, once), and shipped-and-verified code comes out the bottom — with every failure looping back to exactly the right role, and a Reflect step that proposes how to make the harness better next time.
Each role is a strict contract with mechanical forbidden-actions — that's what prevents the dominant single-agent failure mode (context bleed between unrelated concerns).
| Role | Owns | Mechanically forbidden from |
|---|---|---|
| 🏛️ Architect | The WHAT. Explore → seal a one-page scope memo (human signs) → research → CEO review → engineering plan. | Writing code. Pre-splitting the /ultraplan question. >5 in-scope bullets without sign-off. |
| 👷 Coder | The HOW. Execute the eng-plan in an isolated git worktree; commit incrementally. | Changing the plan unilaterally. Touching prod directly. Committing outside the sealed scope (enforced at every commit by atlas-memo-check). |
| 🔍 Reviewer | Independent second-opinion. An independent second model + a security review run in parallel — both must pass. | Modifying the Coder's code. Merging past an open BLOCKER. |
| 🧪 Tester | The merge gate. Server-probe first — read the actual backend error before any client-side hypothesis. | Chasing UI hypotheses before the server is verified. Round-tripping the operator for manual tests. "Looks fine" verdicts. |
| 🚀 Ops Gate | Deploy + verify against the live deployment. Auto-rollback on regression. | "Deployed, should work" as a finish line. Bypassing the Tester/Reviewer gates. Shipping without a revert path. |
| 🔄 Reflect | Closes the meta-loop: extract lessons → notes + a memo-vs-actual drift report + concrete harness-improvement proposals. | Marking a sprint done without it. Glossing the human-touchpoint count. |
The operator is an approval point, not an orchestrator — typically one touch (seal the memo), plus alerts on any non-PASS gate. Everything else runs on its own.
After the Architect seals the plan, you choose how to execute:
- A — Manual cascade. You fire each stage yourself. Maximum checkpoints. For paradigm-class or irreversible work.
- B —
/atlas-goal(fire-and-forget). One command drives Coder → Reviewer → Tester → Ops Gate → Reflect to shipped, pausing only on a non-PASS gate. For well-scoped work.
Sub-work runs via Claude Code's Agent tool with worktree isolation — sub-agents get their own branch, open a PR, and return a summary to the parent, so the loop never breaks. (We learned this the hard way: fire-and-forget background sessions that don't report back fragment the loop. The Agent tool keeps it closed.)
Two dozen composable skills, organized by role. Stage-conductors sequence the leaf skills.
| Role | Conductor | Leaf skills |
|---|---|---|
| Architect | atlas-autoplan |
atlas-warroom · atlas-memo · atlas-researcher · atlas-plan-ceo-review · atlas-plan-eng-review |
| Coder | (standard CC dispatch) | atlas-memo-check |
| Reviewer | atlas-review-all |
(independent 2nd model) · atlas-cso |
| Tester | atlas-qa-all |
atlas-probe · atlas-investigate · atlas-browse · atlas-browser-cookies · atlas-qa |
| Ops Gate | atlas-ship-verify |
atlas-ship · atlas-deploy · atlas-canary · atlas-verify |
| Reflect | atlas-retro |
atlas-learn |
| Autonomous | atlas-goal |
(drives all of the above) |
Reference implementation. The Ops Gate + Tester skills (
atlas-deploy,atlas-probe,atlas-investigate,atlas-verify,atlas-canary,atlas-browse,atlas-browser-cookies) ship with worked examples written for a Convex + Vercel + Clerk stack. The discipline is universal; the commands are a template — swap in your own deployment name, function names, auth provider, and paths. Each such skill carries a banner saying so.
Roles don't chat — they hand off through numbered files in docs/briefs/<sprint-id>/. Each is a git-tracked, reviewable, auditable contract.
| # | File | Author | Human touch? |
|---|---|---|---|
00 |
memo.md — WHAT / WHY / IN-SCOPE / OUT-OF-SCOPE / SUCCESS-CRITERIA |
Architect | ✋ seal |
01 |
research.md |
Architect | — |
02 |
plan-ceo-review.md |
Architect (simulated) | — |
03 |
plan-eng-review.md — the executable plan |
Architect | — |
04 |
review-codex.md + review-cso.md |
Reviewer | — |
05 |
verify-<probe>.md |
Tester | — |
06 |
verify-report.md |
Ops Gate | alert if FAIL |
07 |
learn-report.md |
Reflect | for amendments |
Sprint state lives in .atlas-state.json; role transitions emit to an audit bus.
When a stage fails, Atlas knows exactly where to send it:
| Trigger | → goes to | Escalation |
|---|---|---|
| Tester FAIL | Coder | after 2 bounces → Architect (replan) |
| Reviewer BLOCKER | Coder | after 2 → Architect |
| Security BLOCKER | Coder | after 1 → Architect (security = replan, not retry) |
| Verify FAIL in prod | auto-rollback + Architect | immediate operator alert |
| Scope drift | halt + operator | always — it's the highest-stakes signal |
Atlas was born from a 6-hour, 6-pull-request spiral. A feature was failing silently — the modal closed, nothing happened. The team chased client-side React hydration hypotheses across eight PRs before someone finally called the backend function directly and saw the real error in ten minutes: a validator rejecting a missing field.
The lesson became Atlas's Tester contract, mechanically: server-probe first; never chase a client-side hypothesis before you've read the actual server error. The harness exists so that class of spiral can't happen again — not by hoping the engineer remembers, but by making the discipline a contract a role can't skip.
Atlas's first end-to-end sprint stood up a complete staging environment (isolated backend + pre-production hosting + auto-deploy CI + gated promote-to-prod path) — and in doing so the harness caught three real CI bugs and one production-safety incident that would otherwise have shipped silently:
- A deploy command that couldn't resolve in a no-workspace repo.
- A CI job that ran a deploy without installing dependencies first.
- A workflow that dropped a critical typecheck flag by hand-rolling a command instead of using the canonical script.
- A shared environment variable that nearly pointed production at the empty staging database — caught at the gate, before any deploy.
Production was never touched. Each bug was read at the source, root-caused once, fixed. That's the loop working — and every lesson fed back into the harness via Reflect.
Atlas stands on three ideas:
- gstack (Garry Tan) — separated sessions, artifact-chain handoffs, role specialization. Atlas adopts the backbone and adds a human-sealed scope memo as the one mechanical drift-anchor.
- The "March of Nines" (Andrej Karpathy) — reliability is earned one nine at a time, and each nine costs comparable engineering effort. Atlas's per-stage gates are how you earn them.
- Harness engineering — deterministic flow with gated LLM steps beats a generalist agent at sustained output.
The pattern transfers; the implementation is ours.
# 1. Drop the skills into your repo
./install.sh /path/to/your-repo
# (or, manually:)
# cp -r .claude/skills/atlas-* /path/to/your-repo/.claude/skills/
# 2. Start a sprint — the Architect walks you to a sealed scope memo
/atlas-autoplan
# 3. Seal the memo when prompted, then choose:
# A) fire each stage yourself, or
# B) /atlas-goal → autonomous to shippedThat's it. No infrastructure, no services — Markdown skill contracts and your existing Claude Code.
See examples/ for a worked sprint showing the full artifact chain.
Status: Production-proven; opinionated; offered as-is. PRs reviewed best-effort — Atlas is our internal engineering discipline, published as a community asset.
License: MIT. Atlas is the engineering discipline — free to take, fork, and make yours.
Fork it. Improve it. Ship like a team of twenty.