01
Per-file cryptographic permissions
Protected paths are encrypted at snapshot and readable only by recipients holding a wrapped key — access decided by cryptography, not a server ACL.
Features
Built for agents, secrets, and scale.
One version control system with first-class AI agents, per-file cryptographic permissions, a change model that survives rewriting, distributed sync with a commercial Forge, and a semantic layer that reads your code — under a single versioned specification.
# simulated repository session projection
$ tovio agent list
◆ claude · task T-1421 · branches agent/claude/** · 6h left · clearance=false
◆ cursor · task T-1430 · branches agent/cursor/** · 8h left · clearance=false
◆ sweeper · task T-1402 · branches agent/sweeper/** · expired
$ tovio log --entity claude --task-id T-1421
chg:9fk2m1 · api: paginate /repos · provenance signed
$
Why TOVIO
Six differentiators Git can’t retrofit.
Each one is load-bearing in the design, not a plugin bolted on afterward. Every section below goes deeper on where the guarantee holds — and where it stops.
02
First-class agent authority
Agents act through scoped, expiring capability tokens and carry signed provenance on the work they author.
03
Change-centric identity
A stable chg: id survives amend, rebase, absorb, and split — history you can rewrite without losing the thread.
04
First-class conflicts
Conflicts are typed, addressed objects you can store and sync — not an error state that halts the repository.
05
Binary parity
FastCDC chunking gives large binaries the same verified object and sync path as source — no LFS side channel.
06
Behavioral versioning
Behavioral snapshots and diffs track how AI systems change over time, with risk assessment and a rollback path.
AI-agent control plane
Agents are first-class — with bounded authority.
Register an agent session and give it a capability token scoped to a path. The TOVIO read surface rejects an out-of-scope request before any decryption is attempted. This governs TOVIO-mediated operations; it does not sandbox unrelated tools or plaintext deliberately exposed outside TOVIO.
- Path-, operation-, and lane-scoped tokens with a hard expiry and a denied-op list.
secret_clearance: false⇒ never wrapped a DEK for a cleared object.- Monotonically-narrower sub-token delegation for multi-agent orchestration.
- Dedicated
agent/<name>/**lanes with intent, promote, and abandon. - Signed provenance on agent-authored commits — model, task, tool-manifest binding, and authorizing context.
- A token-validated MCP server, with advisory coordination across a fleet on one repo.
$ tovio agent new cursor \
--model claude --task "web ui" --expires-in 8
✓ cap_1004c16a · excludes 1 protected path · no clearance ◆
# the agent tries to read outside scope — via MCP
$ tovio cat config/prod.env
✗ TVO-TOKEN-001 — path outside agent scope
$
Cryptographic permissions
Protected-content reads require cryptographic keys.
Policy paths are matched and encrypted at snapshot, before plaintext can enter a tracked tree, while the policy manifest stays clear-readable — any reader learns which paths are protected and by what policy. A protected object’s content key is wrapped to authorized recipient keys, so a store, peer, or unauthorized clone holding only the object cannot decrypt it: grant adds a wrap, revoke rotates the key. Tier-1 still trusts the Key Authority to compile policy into the correct recipient set; public content, metadata, endpoints, and disclosed plaintext remain separate trust boundaries.
age
Ephemeral X25519 + ChaCha20-Poly1305 rooted in the repository owner's key, without the cryptographic attribute-policy ceremony used by the gated Enterprise profile.
Hybrid envelope
A random per-object DEK encrypts content under AES-256-GCM; the DEK is wrapped once per recipient. Grant = add a wrap. Revoke = rotate the DEK.
CP-ABE
The enterprise KA implementation has passed its CP-ABE conformance and internal-review gate, but remains private, default-off at the public client boundary, and not currently available. Threshold/KMS authority, hosted parity, and remaining release evidence stay open.
The change model
History you can rewrite without fear.
chg
Change IDs
Random 128-bit chg: ids, distinct from commit hashes, stable across amend, rebase, absorb, and split.
snap
No staging area
The working copy auto-snapshots into the current change; you shape granularity with explicit split, absorb, and amend instead of an index.
!
Conflict objects
Typed, stored, syncable. A repo with open conflicts is a valid, operational state — commits and syncs keep working.
log
Operation log
tovio undo reverses supported local mutations recorded in the op-log, including commits, rebases, and lane deletions. It cannot recall remote side effects or reverse explicit irreversible operations such as obliteration.
obl
Obliteration
Intentional, audited payload removal leaves a typed authenticated tombstone; reads return typed absence, and it propagates through native and hosted sync.
0x
FastCDC chunking
Content-defined chunking + cross-file dedup gives large binaries the same verified object path as source; a localized edit re-stores only changed chunks.
ref
Divergence reconciles on the lane
Concurrent offline work never strands: it reconciles on the lane into a two-parent commit — a clean merge when the changes compose, a first-class conflict object when they don’t. Nothing is orphaned off-lane, and the immutable DAG keeps every side.Mechanism: lane pointers propagate as LWW registers over a hybrid logical clock; that layer only decides which pointer moves, never what the history keeps.
aud
Tamper-evident audit
Per-actor hash-chained, signed audit entries. tovio audit verify validates offline; a tampered entry is detected.
Sync & collaboration
Networked when you want it. Offline when you don’t.
The engine is local-first; the network is an explicit profile, not a precondition. Collaboration runs through a Forge you can run on-premise under a commercial agreement, while hosted TOVIO Cloud stays gated until its evidence is complete.
tls
Clone · push · pull · serve
Native tovio:// and HTTPS-framed sync over TLS 1.3, with a channel-bound identity proof on connect.
spr
Sparse & lazy profiles
Full, sparse, shallow, partial, and lazy fetch-on-read profiles; path and filter scope is retained on pull.
crdt
Concurrent work always reconciles
“The remote has work you don’t” is never an error. Pull reconciles the divergence on your lane — merge when it composes, a resolvable conflict object when it doesn’t — so you land on an in-history two-parent commit instead of a detached head.Mechanism: the pointer-propagation layer converges via CRDT lane refs; the reconciliation itself is an ordinary commit in the immutable DAG.
sync
Consent-gated auto-sync
Opportunistic, throttled, single-flight background sync that never materializes over a dirty copy; push is off, shared, or all — your choice.
Forge collaboration server
Durable proposals, reviews, checks, events, and audit over an authenticated REST and native surface, with connection ACLs and token issuance.
edge
Edge-native hosted Forge
TOVIO Cloud runs the same verified engine you run locally, distributed across Cloudflare's global network — so collaboration scales out across 330+ cities rather than up a single origin, with locks, refs, and proposal transitions strongly consistent throughout, once its hosting gates clear. One engine, no fork: the hosted and on-premise surfaces share the same domain logic and cannot drift apart.
gate
Path-scoped change control
Repo-authoritative reviewer requirements per path glob, enforced fail-closed at the Forge as well as the client.
lock
File & asset locking
The Forge arbitrates exclusive lock grants on policy-declared lockable paths — one holder at a time, with a required TTL and an admin break. Landing refuses a lockable binary edited divergently on both sides rather than losing a write; a holder-based refusal at push or land is still a deferred decision.
meta
Cross-Forge meta-land
Authenticated multi-repo changes land atomically through durable reservations and signed prepare / commit / release.
Semantic & behavioral
The graph understands your code — and your models.
An L6 symbol graph is built by default and stays inside the crypto boundary, so TOVIO can reason about structure and behavior without exposing protected content.
sym
Symbol graph
Rust, TS/JS, Python, and Go are indexed by default into a symbol graph with call and test edges.
diff
Semantic diff
See functions added, removed, and modified — and which interface changes are breaking — not just changed lines.
land
Semantic-aware landing
Landing gates can weigh advisory semantic conflicts alongside textual ones before a change goes in.
seal
Sealed symbol shards
Protected symbols live in sealed shards, so the semantic layer never leaks what the crypto layer protects.
bvr
Behavioral Version Registry
Snapshot and diff the behavior of an AI system over time, with risk assessment and a rollback path.
plug
Sandboxed plugins
Lifecycle plugins — pre/post snapshot and land, resolver, secret-scan — run sandboxed; secret scanning ships in the box.
Command line
A small surface that tells the truth.
The everyday CLI stays at seventeen commands, governed by add-one-remove-one, with three output modes and a coded error catalog — so scripts and humans get the same honest, machine-readable answers.
- Default,
--quiet, and--jsonoutput on every command. - Coded errors (
TVO-<AREA>-<NNN>) that carry a remediation, not a stack trace. .tovioignorewith policy-over-ignore precedence.- Signed change rationale, surfaced by
log --why. - Shell completions, a prompt segment, and git-compat aliases.
- A VS Code surface for status, diff, lanes, conflicts, and agent tokens.
$ tovio status --json
{ "result": { "branch":"main", "change":"chg:9fk2m1",
"clean":false, "changes":["~ src/api/client.ts"], "conflicts":[] } }
$ tovio commit -m "api: paginate"
✓ committed chg:9fk2m1 blake3:c0485381c6…
# errors are coded, with a remediation line
✗ TVO-TOKEN-001 — path outside agent scope
$
Coming from Git
Adopt gradually — keep your Git muscle memory.
TOVIO interoperates with Git through explicit, namespaced bridges rather than pretending to be Git on the wire. Import a repository, or run both sides in parallel.See the migration guide →
imp
One-way import
Import history with gitoxide; every change gets a fresh Change ID while the original Git hash is preserved.
exp
One-shot export
Export to Git with policy objects excluded, or emitted as ciphertext with a warning.
brg
Bidirectional bridge
A namespaced git bridge to GitHub, GitLab, and Gitea for gradual, two-way migration.
api
GitHub-compatible facade
Pull reads, reviews, and merge, plus check and status reads and writes over a compatibility surface.
http
Real git clone
Smart-HTTP protocol-v2 with policy-filtered ls-refs: a stock Git client clones a materialized view while protected content stays ciphertext.
cred
Credential helper
git-credential-tovio presents TOVIO identity to existing Git tooling.
What changes
From a conventional Git workflow to TOVIO.
$architecture requirementsimplemented profiles
| Requirement | Conventional Git workflow | TOVIO implemented profile |
|---|---|---|
| Agent authorization | External credentials and integration policy | Signed, expiring capability chains with path, operation, delegation, and clearance bounds |
| Protected paths | Repository/server access rules plus separately chosen secret tooling | Encrypt-on-snapshot protected payloads with recipient-wrapped data keys |
| Identity through rewriting | Commit object identity changes when history is rewritten | Stable Change IDs remain distinct from commit addresses |
| Conflict representation | Merge state is commonly materialized in an index or working tree | Typed, addressed conflict objects can be inspected and resolved explicitly |
| Semantic awareness | Line-based diff; structure inferred by external tools | Built-in L6 symbol graph and semantic diff across supported languages |
| Change provenance | Author and an optional signature on each commit | Signed provenance on agent-authored commits, plus optional signed rationale |
| Binary storage | Blob objects; teams may add a separate large-file service | Chunked binary objects use the same verified storage and sync model |
| Offline work | Local history and commits after required objects are fetched | Local core plus explicit full, sparse, partial, shallow, and lazy profiles |
| Format contract | Published Git formats and protocols | Versioned TOVIO storage, wire, policy, token, and conformance specifications |
See it in the browser surface.
For policy-protected content, merely hosting the ciphertext does not supply a recipient private key or unwrapped data key. Authorized endpoints, public content, metadata, recovery roles, and explicit disclosures have separate boundaries.