Legal
License
| Component | License |
|---|---|
tovio-core, tovio-cli, tovio-proto, tovio-node-bindings | Apache-2.0 |
Edge SDKs & tooling — tovio-node-sdk, tovio-mcp-server, tovio-vscode-ext | Apache-2.0 |
The specification & conformance corpus (docs/specs/**) | Apache-2.0 |
The runner-neutral CI job contract (tovio-ci-core) | Apache-2.0 |
The tovio-forge crate family and tovio-web-ui | Commercial |
The hosted CI platform — tovio-ci-orchestrator, tovio-ci-runner — and tovio-webauthn | Commercial |
| TOVIO Cloud composition, Cloudflare service adapter, enterprise connectors, and enterprise modules — including the Tier-2 CP-ABE engine and the enterprise Key Authority | Commercial |
The Forge is our product. It is proprietary: only TOVIO operates it as a service, and only TOVIO distributes the binary. Elastic-2.0 was assigned to the Forge and then retired — it restricted reselling the Forge as a service but not using it, which gave the product away to the customers most able to pay for it.
The free tier is tovio serve. It ships in the Apache-2.0 CLI and is a real bidirectional server: clone, fetch, push, with your per-file permission policy enforced on every push. What it does not carry is the collaboration platform — no proposals, review, checks, merge queue, locks, events, webhooks, audit chain, or multi-repo. A capability boundary, not a licence asterisk.
The specification stays open, always. The wire protocol, storage format, crypto envelope, policy/token contract, and conformance corpus are Apache-2.0 and publicly versioned — independent implementations are first-class. That, not the Forge's license, is the real anti-lock-in guarantee.
Trademark. “TOVIO” is a trademark; no license here grants trademark rights.
LICENSE-APACHE in the accepted source publicationLICENSE