MARS Security And Governance Guide

Source of truth: this page summarizes existing MARS security and governance docs. Use Safety, trust, and quality, Guardrails reference, Authentication and credentials, Files and state, and Observability for the canonical public references. Use the documentation map for harness-consumed records.

What Stays Local

The default MARS path runs the delivery system on your machine. Local-first is not the same as "nothing can ever leave the machine": optional telemetry, GitHub, cloud model routes, and integrations are explicit configured surfaces.

Surface	Default boundary	Where to verify
Target repo docs and harness files	Written to the target git checkout so owners can review, commit, revert, or eject.	Files and state
Runtime databases	Per-repo SQLite databases live under local MARS state paths unless `--db` overrides them.	Databases
Models and binaries	Downloaded and cached locally for the default local inference path.	Local state
Logs and traces	Stored locally for audit and troubleshooting.	Observability
Telemetry	Raw events are local by default. Opt-in aggregate reporting is previewable, but the collector and network path can observe transport metadata; the transport is not anonymous.	Telemetry
Cloud model routes	Disabled unless configured. When enabled, selected assembled context, model messages, tool schemas, arguments, and results go to the provider under its terms.	Models
Hosted providers and integrations	Disabled unless configured with explicit credentials or endpoints. GitHub, JIRA, remote MCP, update, and model-download requests transmit the identifiers or content required for the request.	Configuration

Credential And Secret Boundaries

Repo config should name environment variables, providers, endpoints, or policy. Raw secret values belong in environment variables, owner-only local config, or ignored local files.

Source of truth

Credential docs

Read the authentication reference for token resolution order, private release auth, and what not to commit.

Open authentication reference

Guardrail

Secret scanning

MARS has a secret scan command and optional pre-commit hook. Treat a real finding as blocking until the secret is removed and rotated.

Open secret scanning

Boundary

No token values in docs

Docs, tickets, traces, release notes, and chat summaries should name env vars or config keys, not token values.

Open system record rules

Guardrails And Role Allowlists

Guardrails are repo-owned policy plus built-in runtime checks. YAML hard rules are syntactic checks: file paths, regex matches, or existence checks. They are useful controls, not a replacement for semantic security review.

Control	What it does	Limit to remember	Source
Role tool allowlists	Restrict which roles can use which tool categories.	A role prompt still needs review for correct intent.	Roles guide
Hard guardrails	Block matching unsafe content or operations.	Current YAML rules are syntactic.	Guardrails reference
Advisory guardrails	Shape agent behavior and review expectations.	Advisory rules inform, not block.	Guardrail schema
Blast-radius checks	Reduce irreversible or broad unsafe changes.	No control makes damage impossible.	Safety guide
Shell and subprocess controls	Apply policy, working-directory, process-group, and resource controls.	Commands retain the current operating-system user's full authority; these controls are not a security sandbox.	Tools guide
Secret scan	Finds likely secrets and redacts output.	Rotate confirmed secrets outside MARS.	Secret scanning

Trust Levels And Autonomy Progression

MARS uses progressive autonomy. A role should earn more freedom through evidence, not because a prompt sounds confident.

Trust level	Typical use	Evidence to review	Source
Observer	Inspect, read, and report without mutating trusted surfaces.	Dry-run output, context assembly, findings.	Trust levels
Contributor	Make bounded changes that still need checks, evidence, and review.	Diffs, tests, tickets, DocSync, traces.	Trust levels
Autonomous	Operate within approved policies after enough evidence has accumulated.	Role scores, quality score, release evidence, human overrides.	Trust levels

Ownership Of Generated Work

A deployed harness belongs to the target repository. MARS writes files that can be reviewed, committed, changed, or removed by the repo owner.

Target-owned files

.harness/, target AGENTS.md, docs, tickets, feature contracts, quality score, release files, and generated guidance belong to the target checkout.

Open target files

Local machine state

Models, binaries, databases, logs, traces, and auth setup live under local MARS paths unless configured otherwise.

Open local state

Foundation-owned doctrine

Rules in this source repo can mirror into generated targets. Source-only exceptions must be labelled.

Open canonical records

Evidence Chain From Idea To Release

MARS promises auditability, not deterministic LLM output. Inspect the chain of evidence before accepting important work.

Evidence	What it proves	Where to inspect
Goal and active plan	Why the work exists and what scenario is next.	Planning guide
BDD feature contract	What done means and which behavior is in scope.	Feature contracts
Ticket	Bounded slice, affected files, acceptance criteria, and evidence links.	Ticket lifecycle
Checks and tests	What commands passed or failed.	Checks evidence
Trace, logs, dashboard state	What an agent did, when, and with what outcome.	Observability
Release notes and quality score	What shipped and how the repo health changed.	Release guide

Pause, Stop, Eject, Roll Back

Recovery controls are part of the product, not a last resort.

Need	Use	Boundary	Source
Pause claiming new work	Interactive `p` or dashboard pause.	Running jobs finish; new claims stop.	Operations controls
Stop the runtime	Interactive `q`, Ctrl+C, or dashboard stop.	Graceful stop of the local process.	Operations controls
Remove MARS from a target	`mars eject --repo /path/to/repo`	Dry-run by default; apply needs explicit confirmation.	Eject
Recover from a bad change	Use git review, revert, or normal target repo recovery.	MARS does not rewrite git history for you.	Recovery

DocSync And Source Of Truth

MarsDocSync metadata links changed files to durable docs that must be reviewed. The audit checks metadata shape and doc paths. It does not prove that prose is semantically complete.

Used by agents: read Documentation sync and the DocSync architecture when changing public docs, source files, generated doctrine, or operating rules.

Govern MARS before trusting autonomy.