Use default log location
mars start --repo /path/to/repo
mars run engineer --repo /path/to/repo
Filesystem contract
MARS keeps the target repo as the durable system of record and
keeps runtime state outside the repo by default. This reference
maps the important files, directories, databases, logs, model
artifacts, secrets, release assets, generated evidence, upgrade
behavior, and cleanup paths users need to understand before
trusting autonomous work.
For the command-by-command lifecycle from init through eject,
open the Target Lifecycle Reference.
For setup-time machine state under ~/.mars/, open
the Install And Setup Reference.
MARS separates durable repo truth from local runtime machinery. If a file describes product intent, agent doctrine, tickets, evidence, release state, or target-specific policy, it belongs in git. If it is a queue, local model, process log, cache, secret value, or machine-specific setting, it belongs outside git or in an ignored local file.
| Class | Where it lives | Who owns it | Commit? |
|---|---|---|---|
| Target operating model | AGENTS.md, docs/, .harness/ | Target repo owner and agents. | Yes. |
| Role and tool configuration | .harness/manifest.yaml, role prompts, guardrails, knowledge routes, skills. | Target repo owner. | Yes, except local secrets. |
| Runtime queue and telemetry | ~/.mars/db/... | Local MARS runtime. | No. |
| Models and managed binaries | ~/.mars/models/, ~/.mars/bin/ | User machine. | No. |
| Logs and traces | ~/.mars/traces/ | User machine. | No, unless manually copied into a validation report. |
| Release working output | dist/ and a future approved GitHub Release. | Repository-owned release process. | No for generated archives, SBOMs, checksums, or working metadata; yes for VERSION and CHANGELOG.md. |
| Secret values | Environment variables or ignored .harness/.env.local. | Operator. | Never. |
mars init, mars register, and
mars scan ensure a target harness exists.
mars start and mars run do so only in
acknowledged-host mode; default observer rejects a missing target
before writes apart from the explicit no-init dry-run preview. The
first scaffold is committed as a generated harness baseline when possible.
.
|-- AGENTS.md
|-- VERSION
|-- CHANGELOG.md
|-- .gitignore
|-- .harness/
|-- docs/
|-- goals/
|-- exec-plans/
|-- features/
|-- tickets/
|-- design-docs/
|-- references/
|-- reports/
+-- QUALITY_SCORE.md
| Artifact | Purpose | Default behavior |
|---|---|---|
AGENTS.md | Compact first-read map for humans and agents. | Created at init; preserved by upgrade. |
VERSION | Current semantic version for source or target repo. | Created at init; updated by release notes. |
CHANGELOG.md | Generated patch notes with Impact, Why, and What Changed. | Created at init; updated by release notes. |
.gitignore | Workspace hygiene for generated dependencies, build output, and ignored secrets. | MARS appends missing hygiene entries without removing user entries. |
docs/QUALITY_SCORE.md | Repo-visible quality record generated from scores, telemetry, tickets, and checks. | Created at init; refreshed by mars scores export. |
docs/generated/ | Generated reference outputs such as saved model evaluation reports when enabled. | Generated by specific commands; review before committing. |
.harness/ is executable agent configuration. It is
repo-owned, reviewable, and intentionally editable. Existing user
content is preserved by ordinary init/upgrade paths; --force
refreshes missing scaffold and rewrites only selected generated
defaults while preserving user-owned content such as custom prompts
and tickets.
| Path | Purpose | User rule |
|---|---|---|
.harness/manifest.yaml | Role registry, model tiers, tools, triggers, guardrails, and knowledge routes. | Edit deliberately; this is the executable harness entrypoint. |
.harness/metadata.yaml | Generator and generated harness version drift signal. | Generated metadata; use for update drift, not product policy. |
.harness/roles/*.md | Role prompts and role-specific operating instructions. | User-owned after init; preserve local tuning. |
.harness/skills/*/SKILL.md | Reusable workflow procedures for recurring agent work. | Keep compact and task-oriented. |
.harness/guardrails/*.yaml | Hard or advisory safety rules. | Use for policy that must shape agent execution. |
.harness/knowledge/*.yaml | Context routes from situations to repo docs. | Route to durable docs instead of stuffing long context into prompts. |
.harness/integrations.example.yaml | Example integration profile. | Generated reference only; copy deliberately before opt-in. |
.harness/integrations.yaml | Real local integration profile when opted in. | User-created. Do not assume it exists. |
.harness/model-overrides.yaml | Repo default, tier, or role model routing overrides. | Commit when model routing policy should travel with the repo. |
.harness/.env.example | Credential environment variable names without values. | Commit names only; never secret values. |
.harness/.env.local | Ignored local credential values. | Owner-only local file; never commit. |
MARS uses repo docs as live operating state. These artifacts are not background notes. Agents read and update them as part of delivery, review, validation, and release.
| Path | What it records | Why users care |
|---|---|---|
docs/goals/ | Active, observed, superseded, invalidated, merged, or split goals. | Prevents agents from optimizing for stale chat context. |
docs/exec-plans/active/current-operating-plan.md | The active plan, scenario schedule, current failing scenario, and walking skeleton slice. | Keeps delivery order explicit. |
docs/features/F-NNN-*.md | BDD feature contracts, business logic, scenarios, and evidence. | Defines done before feature claims. |
docs/tickets/backlog/ | Waiting work. | Feeds bounded future slices. |
docs/tickets/in-progress/ | Claimed active work. | Shows what an agent is currently responsible for. |
docs/tickets/in-review/ | Work awaiting review or requested changes. | Separates implementation from approval. |
docs/tickets/done/ | Completed ticket files with evidence metadata. | Supports release notes and audit. |
docs/design-docs/ | Architecture decisions and durable design rationale. | Preserves why behavior changed. |
docs/references/ | Research, external inputs, or durable reference material. | Keeps discoveries out of chat-only memory. |
docs/reports/qa, security, dependencies, dogfood, strategy | Role-specific review and validation reports. | Turns runtime findings into durable evidence. |
The user machine state under ~/.mars/ is not part of a
target repo. It stores configuration, downloaded models, managed
binaries, SQLite state, traces, logs, and auth setup needed for
local operation.
| Path | Purpose | Commit? |
|---|---|---|
~/.mars/config.yaml | Local ports, model paths, install paths, performance profile, and machine settings. | No. |
~/.mars/models/ | Downloaded GGUF model files and model cache. | No. |
~/.mars/bin/ | Managed runtime binaries such as llama-server artifacts. | No. |
~/.mars/db/ | SQLite databases for queue, telemetry, trust, scoring, traces, code intelligence, and registry state. | No. |
~/.mars/traces/ | Role traces and command logs. | No. |
mars doctor --json
mars doctor --repo /path/to/repo --json
SQLite state is isolated by default for repo-scoped operation. Use
explicit --db paths only when you understand the
lifecycle and cleanup implications.
| Path | Used by | Contains | Cleanup behavior |
|---|---|---|---|
~/.mars/db/{repo-name}/mars.db | start, register, repo-scoped flows. | Queue, telemetry, repo registry, trust, scoring, trace summaries. | eject removes this DB and -shm/-wal files unless --keep-db. |
~/.mars-harness/db/mars.db | Legacy shared serve default. | Multi-repo registry and runtime state. | eject unregisters the repo but keeps the shared DB unless --delete-shared-db. |
Custom --db | Any command with explicit override. | Whatever runtime state that command writes. | Keep outside source and target repos; remove intentionally. |
run, start, and serve write
durable command logs under ~/.mars/traces/logs/ unless
--log-file is supplied. Role traces and summaries are
local runtime evidence. Copy only the relevant finding into repo
reports or tickets when the evidence needs to become durable.
mars start --repo /path/to/repo
mars run engineer --repo /path/to/repo
mars start --repo /path/to/repo \
--log-file ~/.mars/traces/logs/my-project-start.log
Do not put logs inside the target repo. MARS validates lifecycle log paths so process output does not become accidental source churn.
Model files, provider keys, and local routing choices have different persistence rules. Keep large model artifacts and secret values out of git. Commit only reusable routing policy and empty example keys. Use the Authentication And Credentials Reference for command-by-command credential setup and verification.
| Artifact | Where | Rule |
|---|---|---|
| Local model files | ~/.mars/models/ | Downloaded by setup; never commit. |
| llama-server or managed runtime binaries | ~/.mars/bin/ | Installed by setup/update; never commit. |
| Default, tier, or role routing policy | .harness/model-overrides.yaml | Commit when the repo should use that route. |
| Credential env var names | .harness/.env.example | Commit names with empty values. |
| Credential values | Process environment or .harness/.env.local | Never commit; file is ignored and written owner-only. |
mars models override --repo /path/to/repo --role engineer --provider openai --model gpt-4.1 --api-key-env OPENAI_API_KEY
export OPENAI_API_KEY=...
mars models credentials write-local-env --repo /path/to/repo --api-key-env OPENAI_API_KEY --yes
Release notes are repo-owned. Binary release assets are generated output. MARS source uses AD-315's no-publish conventional Go/Syft rehearsal; target repositories choose and document their own producer and artifact contract.
| Artifact | Where | Rule |
|---|---|---|
VERSION | Repo root. | Commit after mars release notes. |
CHANGELOG.md | Repo root. | Commit after generated notes and any required prose polish. |
internal/buildinfo/version.go | MARS source repo only. | Commit with source release notes. |
dist/ | Local source repo workspace. | Generated archives, SBOMs, checksums, and working metadata; verify the exact publishable set and do not treat it as source documentation. |
| GitHub Release assets | Future approved publication surface. | Publication remains blocked until the F-017/F-018 cutover gates authorize it. |
mars release notes --repo . --bump auto
Run the no-publish production and verification steps authorized by
AD-315. T-080 activates .github/workflows/release.yml
only for an exact repository tag after the approved public gates. That is the MARS source workflow,
not generated target doctrine and not publication authority. The
standalone verifier and audit are retired; signed consumer and
remote-convergence proof remain F-018 gates.
Different commands touch different surfaces. This table is the user-level map for expected filesystem changes.
| Command | Writes or reads | User expectation |
|---|---|---|
mars setup | ~/.mars/config.yaml, ~/.mars/models/, ~/.mars/bin/. | Machine setup outside target repos. |
mars init --repo | Target harness, operating docs, release files, hygiene .gitignore. | Creates baseline and commits it when possible. |
mars start --repo --execution-profile host --acknowledge-host-execution | Ensures harness, registers repo, writes per-repo DB, logs, traces, and tickets as agents work. | Scoped autonomous lifecycle with current-user host authority; not containment. |
mars register --repo | Ensures harness and writes registry entry to DB. | Prepares target for serve. |
mars scan --repo --tickets | Reads repo, writes backlog tickets for findings. | Scanner output becomes repo-owned work items. |
mars run <role> --repo | Observer reads harness/docs and writes only owner-local runtime records; acknowledged host may write role outputs, tickets, docs, source, logs, and traces. | Execution profile is an independent ceiling over manifest, trust, tools, and prompt. |
mars upgrade --repo | Writes missing generated defaults only. | Preserves existing manifest, prompts, knowledge routes, guardrails, tickets, plans, design docs, references, and AGENTS.md. |
mars eject --repo | Dry-run plan unless --apply --confirm. | Preview before destructive cleanup. |
mars eject is the repo-level kill switch. It previews
first. Destructive cleanup requires --apply and a
--confirm value equal to the target repo directory name.
It removes the deployed MARS surface and associated DB artifacts
without rewriting git history or deleting unrelated app files.
| Removed by apply | Preserved | Database rule |
|---|---|---|
.harness/, AGENTS.md, VERSION, CHANGELOG.md. | Application source files and unrelated project docs. | Per-repo DB and -shm/-wal files removed unless --keep-db. |
docs/QUALITY_SCORE.md, docs/tickets, docs/exec-plans, docs/features, docs/goals. | Non-MARS docs such as docs/app.md. | Shared DB is kept by default; repo registration is removed on apply. |
docs/roles, docs/references, docs/reports/*, docs/design-docs. | Git history and remote releases. | Pass --delete-shared-db only when intentionally deleting the shared DB. |
mars eject --repo /path/to/repo
mars eject --repo /path/to/repo --apply --confirm repo
mars eject --repo /path/to/repo --apply --confirm repo --keep-db
mars eject --repo /path/to/repo
mars doctor --repo /path/to/repo --json
git -C /path/to/repo status --short --branch
ls ~/.mars/traces/logs
mars run engineer --repo /path/to/repo --log-file ~/.mars/traces/logs/engineer.log
mars models override --repo /path/to/repo \
--tier coding \
--provider openai \
--model gpt-4.1 \
--api-key-env OPENAI_API_KEY
export OPENAI_API_KEY=...
mars models credentials write-local-env --repo /path/to/repo --api-key-env OPENAI_API_KEY --yes
Run the no-publish Go/Syft production and verification rehearsal authorized by AD-315. The dist/ directory is generated work; only the exact publishable allowlist is candidate release evidence.
| Symptom | Likely cause | Recovery |
|---|---|---|
| Git status shows runtime DB or log files. | A manual --db or --log-file path was pointed inside the repo. | Move runtime paths under ~/.mars/ and remove accidental files from the index. |
.harness/.env.local appears in git status. | The ignore policy is missing or was edited. | Add .harness/.env.local to .gitignore; never commit the file. |
| Upgrade did not rewrite a customized role prompt. | Existing prompts are user-owned and preserved. | Compare against a fresh temporary init if you want new defaults. |
mars eject did not remove files. | Default mode is dry-run. | Rerun with --apply --confirm repo-name only after reviewing the preview. |
| Shared DB remains after eject. | The legacy shared DB is protected by default. | Use --delete-shared-db only if deleting shared runtime state is intentional. |
| Release assets are missing or stale. | The repository-approved producer did not create a complete artifact set. | Rerun that repository's producer and artifact-contract checks. For MARS source, follow the publication-disabled F-018 snapshot workflow; do not publish while cutover remains blocked. |