# Role Registry

**Status:** Seed
**Updated:** 2026-05-04
**Owner:** Project maintainers
**Mirrors:** `.harness/manifest.yaml`, `docs/design-docs/harness-operating-model.md`

## Purpose

This checked registry is the compact inventory of default autonomous roles. It
exists so humans and agents can see role domains, modes, triggers, tools,
guardrails, trust, model routing, scoring signals, and escalation behavior in
one repo-owned artifact.

Read `docs/design-docs/harness-operating-model.md` for the domain and mode
contract, `docs/design-docs/tools-glossary.md` before changing tool allowlists,
`docs/roles/personas/<role>.md` for ownership, feedback, and handoff manuals,
and `.harness/manifest.yaml` for executable runtime configuration.

## Registry Rules

- `Origin` is `default` for roles generated by MARS and `custom` for target-owned roles.
- Every role in `.harness/manifest.yaml` should have one row here.
- Custom target roles should be added with `Origin` set to `custom` and should not be treated as missing source defaults.
- Source-only foundation roles are listed separately, are not generated into target manifests, and must not be treated as missing target roles.
- Optional GitHub webhook triggers are explicit repair inputs. Schedule and chain triggers remain the default delivery model.
- After changing roles, run `mars doctor --repo .` to check registry health.

## Source-Only Foundation Roles

| Role | Origin | Domain | Mode | Trigger sources | Schedule | Tools | Trust level | Guardrails | Model routing | Scoring signals | Escalation behavior |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| `foundation-maintainer` | source-only | maintainer | `foundation-build` | manual/operator invocation only | none | file_read, file_write, shell_exec, dependency_sync, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, ticket_create, tool_create, persona_create, task_trace_summarize, docsync_audit, git_status, git_diff, git_commit, git_push, job_disposition_record, release_orchestrate, github_release_status, git_release_guard | contributor | foundation/deployed classification, no validation-subject doctrine leakage, docsync, release publication, live-validation evidence, and git discipline | reasoning | reusable source improvement quality, doctrine sync, release completeness, validation feedback generalization | classify findings as foundation-owned, deployed-owned, mirrored doctrine, or evidence-only before changing source or creating tickets |

## Default Roles

| Role | Origin | Domain | Mode | Trigger sources | Schedule | Tools | Trust level | Guardrails | Model routing | Scoring signals | Escalation behavior |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| `ceo` | default | planner | `strategy` | schedule; returns disposition to orchestrator | 0 20 * * 0 | file_read, file_write, shell_exec, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, harness_doctrine_sync, task_trace_summarize, git_status, git_commit, git_push | progressive planner write with release and git gates | goal, scope, persona handoff, no mutating shell, trust, and git discipline | reasoning | goal quality, decision clarity, downstream plan usefulness, feedback resolution | return disposition to orchestrator; route exec plans to COO and strategy advice to Head of Strategy when configured |
| `head-of-strategy` | default | planner | `strategy-advisory` | dispatch/manual only for strategy_advice, executive_narrative, tradeoff_analysis, or goal_conflict | dispatch-only | file_read, file_write, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, task_trace_summarize, git_status, git_diff, git_commit, git_push | progressive planner write limited to strategy and goal-framing docs | strategy scope, CEO decision ownership, no ticket creation, no implementation, no mutating shell, and git discipline | reasoning | strategy memo clarity, tradeoff quality, measurable bet quality, CEO decision usefulness | return disposition to orchestrator; route goal decisions back to CEO |
| `coo` | default | planner | `execution-planning` | orchestrator dispatch after goal decision or planning feedback | chain-only | file_read, file_write, file_search, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, task_trace_summarize, git_status, git_commit, git_push | progressive planner write with plan and BDD gates | exec plan, BDD feature contract, scenario schedule, planning-only writes, no alternate ticket creation, no implementation, no mutating shell, trust, and git discipline | reasoning | plan clarity, BDD completeness, scenario priority, CTO handoff quality | return disposition to orchestrator; route ticket_breakdown to CTO and goal conflicts to CEO |
| `cto-weekly` | default | planner | `technical-planning` | schedule; orchestrator dispatch after COO planning or technical-ticket feedback | 0 21 * * 0 | file_read, file_write, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, ticket_create, job_disposition_record, task_trace_summarize, git_status, git_diff, git_commit, git_push | progressive technical-planning write with ticket and git gates | architecture rationale, technical decomposition, BDD ticket evidence, no implementation/product-file writes, no mutating shell, trust, and git discipline | reasoning | architecture fit, ticket readiness, decision quality, audit finding closure | return disposition to orchestrator; route implementation tickets to Engineer and planning blockers to COO |
| `engineer` | default | engineer | `ticket-delivery` | schedule; orchestrator dispatch for ticket delivery, review, dogfood, idle work, intervention debt, and failed checks | 0 0,6,12,18 * * 1-5 | file_read, file_write, shell_exec, dependency_sync, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, tool_create, persona_create, task_trace_summarize, docsync_audit, git_status, git_diff, git_commit, git_push, job_disposition_record | progressive engineering write with ticket, test, release, and git gates | blast-radius containment, tests, ticket evidence, ticket/BDD contract fidelity, closure before packaging, docsync, bounded review rework, in-progress drain, release versioning, and git discipline | coding | test pass rate, ticket completion evidence, blocker metadata quality, regression rate, review rework | return disposition to orchestrator; answer changes_requested with exact evidence before broader validation; return blocked tickets with blocker, blocked_by, trace_id, and next_action metadata |
| `qa` | default | reviewer | `quality-review` | orchestrator dispatch after implementation or review request | chain-only | file_read, file_write, shell_exec, dependency_sync, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, architecture_audit, harness_doctrine_sync, docsync_audit, tool_creation_guard, tool_inventory_audit, git_status, git_diff, git_commit, git_push | progressive reviewer write limited to QA reports | evidence gate, in-job validation proof, validation-only shell, BDD contracts, doctrine sync, docsync, and tool policy | reasoning | defect detection, evidence accuracy, false approval rate, reopened tickets | return disposition to orchestrator; commit QA reports and record findings instead of hiding incomplete work |
| `security` | default | reviewer | `security-review` | schedule; orchestrator dispatch after QA or risk signal | 0 22 * * 0 | file_read, file_write, shell_exec, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, docsync_audit, git_status, git_commit, git_push | progressive reviewer write limited to security reports | security posture, current-evidence finding validity, in-job validation proof, blast-radius containment, docsync, trust, and git discipline | reasoning | security finding validity, remediation clarity, dependency risk reduction | return disposition to orchestrator; record implementation, evidence, or documentation remediation as Engineer changes_requested feedback |
| `dependency-manager` | default | maintainer | `dependency-maintenance` | schedule; orchestrator dispatch after security or dependency signal | 0 23 * * 0 | file_read, file_write, shell_exec, dependency_sync, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, docsync_audit, git_status, git_commit, git_push | progressive maintainer write with dependency and test gates | dependency scope, tests, docsync, trust, release versioning, and git discipline | fast | update success, test pass rate, stale dependency reduction, rollback rate | record blocked upgrades with package, version, and failing command |
| `release-manager` | default | maintainer | `release-management` | schedule | 0 8 * * 1 | file_read, file_write, shell_exec, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, release_orchestrate, github_release_status, git_release_guard, docsync_audit, git_status, git_diff, git_commit, git_push | progressive release write with version, tag, asset, and git gates | semantic versioning, changelog, release assets, docsync, trust, and git discipline | reasoning | release note accuracy, tag health, asset verification, release blocker closure | record release blockers explicitly; do not claim notes-only releases complete |
| `dogfood` | default | end-to-end-tester | `dogfood-validation` | schedule; orchestrator dispatch after implementation or failed dogfood signal | 0 10 * * 1-5 | file_read, file_write, shell_exec, dependency_sync, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, ticket_create, tool_create, persona_create, task_trace_summarize, docsync_audit, git_status, git_diff, git_commit, git_push, job_disposition_record | progressive tester write limited to bounded evidence and target-owned findings | real command evidence, observation-first validation, committed finding handoff before further validation, no product mutation, blast-radius containment, docsync, trust, and git discipline | coding | setup success, E2E pass rate, reproduced failures, target-owned finding quality | record foundation/runtime failures as telemetry or blocked dispositions; create target tickets only for target-owned product defects |
| `pipeline-fixer` | default | engineer | `pipeline-repair` | orchestrator survey for Mars-recorded failed checks; optional GitHub workflow_run.conclusion == "failure" integration | event/survey-only | file_read, file_write, shell_exec, dependency_sync, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, architecture_audit, harness_doctrine_sync, docsync_audit, tool_creation_guard, tool_inventory_audit, git_status, git_diff, git_commit, git_push | progressive engineering write for bounded repair | pipeline scope, no recursive recovery, tests, docsync, trust, and git discipline | coding | repair success, repeated failure suppression, check recovery time, regression rate | return disposition to orchestrator; record deterministic remediation when recovery repeats |
| `orchestrator` | default | orchestrator | `dispatch-routing` | dispatch after every terminal job disposition | dispatch-only | file_read, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, task_trace_summarize, git_status, git_diff | observer by default with disposition write | dispatch loop guard, manifest role validation, ticket truth, and trace discipline | reasoning | ambiguous route resolution, loop prevention, blocked-work clarity | choose a valid next manifest role or stop with a recorded reason |
| `janitor` | default | orchestrator | `ticket-hygiene` | schedule; ticket.stale_in_progress; orchestrator survey for stale, blocked, idle, and no-op ticket state | 0 7 * * * | file_read, file_write, shell_exec, mars_cli, grep, code_index, code_search, code_snippet, code_trace, code_impact, workspace_hygiene, github_auth_check, record_decision, job_disposition_record, docsync_audit, git_status, git_diff, git_commit, git_push | progressive orchestrator write with ticket-state gates | ticket lifecycle, active-plan hygiene, stale in-progress detection, docsync, trust, and git discipline | fast | stale ticket reduction, active-plan cleanliness, queue recovery, duplicate cleanup | return misleading state to clear tickets or create focused intervention debt |