# Operating TOVIO as an agent

GENERATED by scripts/generate_llms_txt.py from docs/specs/cli.md and docs/specs/error-catalog.md in https://github.com/Tovio-VCS/tovio — do not edit by hand; the specs are the source of truth.
License: Apache-2.0 (this corpus is part of the open TOVIO specification surface).

TOVIO is a version control system with cryptographically-enforced per-file permissions, first-class AI-agent authorization (capability tokens + provenance), change identity that survives history rewriting, first-class conflict objects, and binary parity without LFS. There is NO staging area: the working copy auto-snapshots into the current change. Branches are called lanes. Changes have stable `chg:` IDs distinct from commit hashes.

## Machine contract

- Every command accepts `--json` (structured output, errors in the envelope below) and `--quiet`; the two must not be combined. `--json` is sugar for `--format json`. Errors never disappear under `--quiet`.
- JSON error envelope: `{"error": {"code": "TVO-<AREA>-<NNN>", "title", "cause", "remediation": [{"text", "command"}], "context": {...}, "exit_code"}}`. The `code` and per-code `context` keys are a stable compatibility surface.
- Every remediation `command` is runnable verbatim as printed. When a command fails, run the primary recovery command from the recovery index below (or from the error's own remediation list, which is more specific).

### Exit-code classes

- exit 0: Success (possibly with `⚠`/`✓` follow-ups; conflicts are success — §4)
- exit 1: Generic / uncategorized failure (areas: fallback plus operational WS failures)
- exit 2: CLI/configuration usage error (bad flags, unknown command, invalid Workspace definition/removal request) (areas: CLI, selected WS codes)
- exit 7: Storage / integrity (corruption, obliteration, I/O) (areas: STORE)
- exit 11: Crypto / key material (areas: KEY, CRYPTO)
- exit 13: Permission / policy / capability denial (areas: PERM, TOKEN, LOCK)
- exit 17: Sync / wire protocol (areas: SYNC)
- exit 19: Change / op-log (undo/redo/history) (areas: OP)
- exit 21: Migration / bridge (areas: MIG)

## The everyday surface

```
TOVIO — the version control system built for the AI era

  tovio status     Show current state (what change am I on, what's modified, conflicts)
  tovio commit     Save the current change and start the next
  tovio sync       Share and receive changes (push + pull in one)
  tovio lane       Create, list, and delete lanes
  tovio switch     Move to another lane or change
  tovio merge      Combine lanes (conflicts are stored, never blocking)
  tovio land       Land a lane onto another lane (auto-rebases the stack)
  tovio log        Browse history
  tovio diff       Compare versions
  tovio change     Manage work in progress (new, list, show, switch, health, pull, split, absorb)
  tovio conflicts  View and resolve open conflicts
  tovio undo       Undo any operation — any operation

  Get started:          tovio quickstart
  Team features:        tovio help --team       (access, agents, keys, identity, audit)
  Advanced config:      tovio help --advanced   (rebase, obliterate, behavioral, git)
  Everything:           tovio help --all
  Feedback:             https://tovio.dev/feedback   (ideas, bugs, friction)

Run "tovio help <command>" for details on any command.
```

## Full command tier map

- init: Everyday
- policy: Team
- quickstart: Everyday
- access: Team
- status: Everyday
- identity: Team
- commit: Everyday
- key: Team
- sync: Everyday
- agent: Team
- lane: Everyday
- audit: Team
- switch: Everyday
- remote: Team
- merge: Everyday
- amend: Advanced
- log: Everyday
- rebase: Advanced
- diff: Everyday
- squash: Advanced
- undo: Everyday
- reorder: Advanced
- conflicts: Everyday
- absorb: Advanced
- change: Everyday
- split: Advanced
- clone: Everyday
- redo: Advanced
- fetch: Team
- oplog: Advanced
- push: Team
- show: Advanced
- land: Everyday
- blame: Advanced
- review: Team
- obliterate: Advanced
- lock (acquire/list/release): Team
- behavioral: Advanced
- issue: Team
- semantic: Advanced
- release: Team
- device: Team
- git: Advanced
- restore: Advanced
- cherry-pick: Advanced
- revert: Advanced
- bisect: Advanced
- grep: Advanced
- completions / env: Advanced
- fsck / gc / info / version / build-check: Advanced
- mcp serve / relay serve: Advanced
- serve: Team

## Command synopses

### tovio init (Everyday)
```
tovio init [<path>] [--mode simple|team|agentic] [--bare] [--key-authority <endpoint>]
```
### tovio clone (Everyday)
```
tovio clone <url> [<path>]
            [--sparse <glob>]…            # which SUBTREE (repeatable) — §4.6 path scope
            [--depth <n>]                 # how much HISTORY (tip + last n commits)
            [--filter <spec>]…            # which OBJECT CLASS/SIZE — blob:none | blob:limit=<size> | tree:0
            [--blobless] [--treeless]     # ergonomic aliases for --filter blob:none / tree:0
            [--perm-scope]                # only content the local identity can decrypt
            [--no-attachments]            # defer the Phase-4 semantic/behavioral closure
```
### tovio status (Everyday)
```
tovio status [--json] [-q]
```
### tovio commit (Everyday)
```
tovio commit [-m <message>] [--intent <text>] [--amend]
```
### tovio log (Everyday)
```
tovio log [<path>] [--graph] [--no-graph] [--first-parent] [--all] [--limit <n>] [--oneline] [--why]
          [--no-pager] [--entity agent|human] [--agents] [--humans] [--agent-id <id>] [--task-id <id>]
          [--changes-only] [--format <fmt>] [--template <spec>] [--date relative|absolute]
          [--descendants <chg>] [--conflicted] [-S <string>] [-G <regex>]
```
### tovio diff (Everyday)
```
tovio diff
```
### tovio oplog (Advanced)
```
tovio oplog [--limit <n>] [--format <fmt>]
```
### tovio change (Everyday)
```
tovio change new [<name>] [--base <lane>] [--draft]  # new change (stacks on current; --base independent; --draft private)
tovio change list [--stack]                # list changes (alias: tovio cl); --stack shows the dependency tree
tovio change show <change-id>              # show a change: current commit + full lineage
tovio change switch <change-id>            # move the working copy to a change (alias of `tovio switch`)
tovio change health <change-id>            # conflicts? clean ancestor? landable? stale?
tovio change describe <change-id> <msg>    # set/replace a change's description
tovio change split [<change-id>] [--paths <globs>]   # divide a change (optionally by paths) — enables partial land
tovio change absorb                        # distribute fixups into the changes that introduced them
tovio change rebase <change-id|start..tip> [--onto <rev>] # re-parent a change/range (top-level alias rebases current stack)
tovio change propose <change-id> [--reviewers <ids>] [--sovereign] # send a change for review (PR equiv); --sovereign = Tier-2 contribution hosted in your own Forge
tovio change pull <change-id>              # pull a teammate's change as a read-only dependency
tovio change promote <change-id>           # promote a draft into a normal (shareable) change
tovio change abandon <change-id>           # set a change aside (history kept in your personal archive)
tovio change restore <change-id>           # recover an abandoned change
```
### tovio amend (Advanced)
```
tovio amend [-m <message>] [--intent <text>]
```
### tovio rebase (Advanced)
```
tovio rebase [--onto <base>]
tovio change rebase <change-id> [--onto <base>]
tovio change rebase <start-change>..<lane-tip-change> [--onto <base>]
```
### tovio cherry-pick (Advanced)
```
tovio cherry-pick <rev>… [--onto <lane>] [--keep-id | --fork]
tovio cherry-pick <start>..<tip> [--onto <lane>] [--keep-id | --fork]
```
### tovio revert (Advanced)
```
tovio revert <change>… [-m <message>]
```
### tovio squash (Advanced)
```
tovio squash <change-id> [--into <target-change-id>]
```
### tovio reorder (Advanced)
```
tovio reorder <change-id> --before <change-id>
```
### tovio blame (Advanced)
```
tovio blame <file> [--why]
```
### tovio bisect (Advanced)
```
tovio bisect start [--bad <rev>] [--good <rev>]… [--run <cmd…>] [--symbol <S> [--only]] [--no-checkout]
tovio bisect good | bad | skip [<rev>…]
tovio bisect run <cmd…>
tovio bisect status | reset [<rev>]
```
### tovio grep (Advanced)
```
tovio grep <pattern> [<rev>] [-F|--fixed-strings] [-i|--ignore-case] [--path <glob>]
```
### tovio sync (Everyday)
```
tovio sync [<remote>] [--push] [--pull] [--all] [--isolate] [--refetch <path-or-object>]
```
### tovio remote (Team)
```
tovio remote add <name> <url> <repo> [--cert <path>]
tovio remote list
tovio remote show <name>
tovio remote remove <name>          # alias: rm
```
### tovio lane (Everyday)
```
tovio lane create <name> [--from <change-id-or-lane>]
tovio lane list
tovio lane delete <name>
```
### tovio switch (Everyday)
```
tovio switch <name-or-change-id>
```
### tovio land (Everyday)
```
tovio land [<lane>…] [--into <target>] [--rebase]
```
### tovio merge (Everyday)
```
tovio merge <source> [--into <target>]
```
### tovio build-check (Advanced)
```
tovio build-check <lane-or-change>
```
### tovio policy (Team)
```
tovio policy set <path-pattern> --read <expr> [--write <expr>]
tovio policy list
tovio policy show <path>
tovio policy remove <path-pattern>
tovio policy test <path> --identity <identity>
tovio policy chunking [--min <bytes>] [--average <bytes>] [--max <bytes>] [--threshold <bytes>]
tovio policy chunking --reset
tovio policy signing [--require-commits[=<bool>]] [--require-protected-ref-updates[=<bool>]]
tovio policy signing --reset
tovio policy audit [--require-for <event>]... [--minimum-length <characters>]
tovio policy audit --reset
tovio policy protect <lane-pattern> [--require-review] [--min-approvals <n>] [--reviewers <expr>] [--reviewer <did>]... [--required-checks <name,...>]
tovio policy protect <lane-pattern> --remove
tovio policy change-control <path-pattern> [--min-approvals <n>] [--reviewers <expr>] [--reviewer <did>]... [--required-checks <name,...>]
tovio policy change-control <path-pattern> --remove
tovio policy workflow set <preset|path.toml> [--force]
tovio policy workflow show
tovio policy workflow check
tovio policy workflow clear
```
### tovio access (Team)
```
tovio access check <path> [--write]        # diagnose read/write access for your identity (DX-020)
tovio access request <path-pattern> [--write] [--attr <attr>] [--from <identity>]
tovio access grant <identity> [--role <r>] [--team <t>] [--paths <globs>]   # KA: authorize an identity
tovio access policy show <path>            # alias surface into `tovio policy show`
tovio access policy list
```
### tovio review (Team)
```
tovio review <proposal-id>                              # open a proposal's diff for review
tovio review <proposal-id> --approve | --request-changes [--comment <text>]
```
### tovio identity (Team)
```
tovio identity create [--name <name>] [--email <email>]
tovio identity list
tovio identity show [<identity>]
tovio identity attribute add <attribute> [--authorized-by <ka-endpoint>]
```
### tovio key (Team)
```
tovio key status                              # health: which attributes, expiry, source (DX-021)
tovio key renew [--from <ka-endpoint>]        # renew the attribute certificate
tovio key rotate                              # rotate local key material
tovio key import <path>                        # import an exported key (new device)
tovio key sync [--from <ka-endpoint>]          # refresh known identity public keys
```
### tovio device (Team)
```
tovio device enroll [--name <name>]                                  # on the NEW device: generate + keychain-seal a device key; print its pubkeys + SAS
tovio device approve --pubsig <hex> --pubkx <hex> [--name <name>] --code <SAS>   # on a TRUSTED device: SAS-gate + enroll under the owner + re-seal HEAD
tovio device list                                                    # devices: the ROOT/first device (the owner identity) + enrolled devices (name, device DID, principal, root?, this machine?)
tovio device revoke <device-did-or-name> [--yes]                     # drop a device + re-seal to the reduced set (fresh DEK)
```
### tovio agent (Team)
```
tovio agent new <name> --expires <duration> [--scope <globs>] [--clearance] [--config <file>]
tovio agent list
tovio agent show <token-id>
tovio agent revoke <token-id>
tovio agent delegate <parent-token-id> --scope <globs> --expires <duration>
tovio agent session export <token-id> <bundle> --passphrase-file <file> [--expires-in <hours>]
tovio agent intent declare --paths <globs> --ttl <duration>   # non-blocking coordination signal (enterprise)
tovio agent intent check --paths <globs>                      # see overlapping active intents (enterprise)
tovio agent token <token-id>                 # print the capability token (for the agent/MCP client)
```
### tovio audit (Team)
```
tovio audit log [--format <fmt>]
tovio audit export --format <json|csv|cef|syslog> [--output <file>]
                   [--tls <host:port> [--server-name <dns-name>] [--cert <collector.der>]]
tovio audit archive [--older-than <duration>] [--dry-run]   # default: 365d
tovio audit summary [--last <duration>]     # human-friendly view (DX-022)
tovio audit show [--object <hash>] [--token <token-id>]
tovio audit verify
```
### tovio behavioral (Advanced)
```
tovio behavioral snapshot [--model-id <id>] [--prompts <text|path>] [--tools <text|path>]
                          [--memory <text|path>] [--retrieval <text|path>]
                          [--policy-version <label>]
tovio behavioral list
tovio behavioral diff <v1> <v2>
tovio behavioral rollback <version>
```
### tovio semantic (Advanced)
```
tovio semantic find-def <moniker>
tovio semantic find-refs <moniker>
tovio semantic callers <moniker>
tovio semantic tested-by <moniker>
tovio semantic types <moniker>
tovio semantic search <query> [--limit <n>]
tovio semantic impact [<moniker>] [--depth <n>]
tovio semantic diff [<old>] [<new>]
```
### tovio obliterate (Advanced)
```
tovio obliterate <object-hash> --confirm "obliterate <object-hash>" [--reason <text>] [--authorize <key-proof>]
```
### tovio git (Advanced)
```
tovio git import <git-url-or-path> [--output <path>]
tovio git export <git-url> [--branch <branch>]
tovio git bridge <git-url-or-path> --bidirectional
```
### tovio mcp serve (Advanced)
```
tovio mcp serve [--transport <stdio|http>] [--port <port>] [--bind <host>] [--token <capability-token>]
```
### tovio relay serve (Advanced)
```
tovio relay serve [--port 7743] [--bind 0.0.0.0]
```
### tovio lock (Team)
```
tovio lock <path> [--exclusive|--advisory] --ttl <duration> [--reason <text>]   # acquire (bare form)
tovio lock acquire <path> [--exclusive|--advisory] --ttl <duration> [--reason <text>]
tovio lock list                                          # list active (non-expired) locks
tovio lock release <path>                                # release your lock
tovio forge lock break <path> --remote <addr>            # admin force-release (role=forge-admin) — Forge
```
### tovio meta (Advanced)
```
tovio meta create <name> [--atomic | --sequenced]   # create a meta-change (atomic is the default)
tovio meta attach <meta> <chg:…> [--repo <path>] [--forge <addr> --cert <der>] [--target <lane>]
tovio meta show <meta>                               # strategy + state + EACH member's per-member landability
tovio meta list                                      # the meta-changes recorded in this repo
tovio meta land <meta>                               # coordinated local/remote PREPARE + ordered COMMIT
tovio meta resume <meta>                             # re-attempt the members not yet landed (after partially_landed)
```
### tovio forge (Advanced)
```
# operator-oversight core (implemented; F-10, ADR-0037 §1) — one top-level `forge` verb:
tovio forge lock list --remote <addr> [--cert <der>]              # GET /locks (open read)
tovio forge lock break <path> --remote <addr> [--cert <der>]     # POST /locks/break (admin, signed)
tovio forge webhook list --remote <addr> [--cert <der>]          # GET /webhooks (open read)
tovio forge webhook delete <id> --remote <addr> [--cert <der>]   # DELETE /webhooks/:id (owner-or-admin, signed)
tovio forge proposal list --target <lane> --remote <addr> [--cert <der>]  # GET /proposals (open read)
tovio forge proposal ready <prop> --required <did>… --remote <addr>       # POST /proposals/:id/transition {mark-approved} (signed)
tovio forge proposal land <prop> --remote <addr> [--cert <der>]           # POST /proposals/:id/transition {land} (signed; the Forge advances the lane)

# management additions:
tovio forge user|policy <…>                                       # implemented user / policy administration
tovio forge repo create <name> --remote https://<forge> [--visibility private|public]  # POST /repos/:name/create (hosted, linked device)

# offline host-operator binary (implemented; never routed through the collaboration REST client):
tovio-forge backup <destination> [--root <data-root>] [--json]
tovio-forge restore <backup> [--root <cold-data-root>] [--json]
```
### tovio issue (Team)
```
tovio issue create <title> [--body <md> | --body-file <path>] [--label <l>…] [--assignee <did>…]
                           [--milestone <n>] [--link <chg:… | prop:… | blake3:…>…]
tovio issue list [--state open|closed|all] [--label <l>] [--assignee <did>] [--milestone <n>]
                 [--limit <n>] [--after <number>]
tovio issue view <number> [--comments]
tovio issue comment <number> [--body <md> | --body-file <path>]
tovio issue close <number> [--reason completed|not-planned]
tovio issue reopen <number>
tovio issue edit <number> [--title <t>] [--body <md> | --body-file <path>]
tovio issue label <number> [--add <l>…] [--remove <l>…]
tovio issue assign <number> [--add <did>…] [--remove <did>…]
tovio issue link <number> (--proposal <prop:…> | --change <chg:…> | --commit <blake3:…>) [--remove]
```
### tovio release (Team)
```
tovio release create <tag> [--name <n>] [--notes <md> | --notes-file <path>] [--draft] [--prerelease]
                           [--asset <PATH[#name]>…]
tovio release list [--limit <n>] [--after <cursor>] [--drafts]
tovio release show <release>
tovio release edit <release> [--name <n>] [--notes <md> | --notes-file <path>]
                             [--prerelease | --no-prerelease]
tovio release publish <release>
tovio release delete <release> --yes
tovio release asset add <release> <PATH[#name]>… [--media-type <type>]
tovio release asset list <release>
tovio release asset download <release> <name> [--out <path>]
tovio release asset delete <release> <name>
```

## Short aliases (stable; scripts may rely on them)

- tovio st = tovio status (Current state)
- tovio commit -m = tovio commit --message (Commit with message)
- tovio s = tovio sync (Sync with remote)
- tovio u = tovio undo (Undo last operation)
- tovio cl = tovio change list (List changes)
- tovio cx = tovio conflicts (List conflicts)
- tovio ln = tovio lane (Lane management)
- tovio sw = tovio switch (Switch lane/change)
- tovio d = tovio diff (Diff)
- tovio lg = tovio log (History)

## Git-compat aliases

For Git muscle memory: each does the right TOVIO thing and prints a one-line note to stderr naming the native equivalent (never polluting `--json` stdout).

- tovio push -> tovio sync --push
- tovio pull -> tovio sync --pull
- tovio add [<path>…] -> **no-op** (working copy is always tracked)
- tovio checkout <ref> -> tovio switch <ref> (disambiguated; if <ref> is a path, suggests tovio restore/tovio undo)
- tovio branch -> tovio lane (create/list/delete lanes)
- tovio clone <url> -> tovio clone <url> (native; no note needed)
- tovio stash -> suggests tovio change (work is never lost; no stash needed)
- tovio reset -> suggests tovio undo / tovio restore with disambiguation

## Error recovery index (302 catalogued codes)

Format: CODE — title :: primary recovery command (run verbatim). Full entries with causes, context keys, and complete remediation lists: docs/specs/error-catalog.md.

- TVO-WS-001 — Workspace manifest or device overlay is invalid
- TVO-WS-002 — Required Workspace capability is unavailable
- TVO-WS-003 — Workspace path is unsafe or collides
- TVO-WS-004 — Workspace is busy
- TVO-WS-005 — Workspace recovery is blocked
- TVO-WS-006 — Workspace removal would discard retained work
- TVO-WS-007 — Workspace environment is not ready
- TVO-WS-008 — Workspace agent session lifecycle is blocked
- TVO-WS-009 — Workspace execution admission is over budget
- TVO-WS-010 — Workspace execution reclaim is incomplete
- TVO-WS-011 — Workspace execution sandbox could not be isolated
- TVO-WS-012 — Workspace daemon request is malformed or conflicting
- TVO-WS-013 — Policy manifest is missing but the committed history declares policies
- TVO-CORE-000 — Engine error (generic fallback)
- TVO-CORE-001 — Bindings ABI mismatch
- TVO-CORE-002 — Operation runtime contract failed
- TVO-CLI-027 — Invalid operation request
- TVO-PERM-006 — Operation principal could not be verified
- TVO-SYNC-008 — The served policy manifest is not attested, or would roll policy backwards
- TVO-PERM-007 — Only the repository owner can change policy
- TVO-CRYPTO-018 — Secure randomness is unavailable
- TVO-PERM-001 — Policy-protected read denied :: tovio access check config/production/api-keys.env
- TVO-PERM-002 — Write-policy / ABS rejection :: tovio access check --write config/production/
- TVO-PERM-003 — Push loosens the org-policy baseline
- TVO-PERM-004 — Push carries a clear object at an org-protected path
- TVO-PERM-005 — Policy-required audit justification missing
- TVO-MCP-001 — MCP capability token required
- TVO-MCP-002 — MCP server process could not run
- TVO-COORD-001 — Intent soft-blocked by a peer's lease
- TVO-PROV-002 — Rationale refused: no common reader *(deliberation provenance, [ADR-0067](../adr/0067-signed-change-rationale-object.md) §3)*
- TVO-PROV-003 — Malformed or oversized session *(session provenance, [ADR-0209](../adr/0209-session-object-lineage-graph-and-provenance-export.md) §1)*
- TVO-PROV-004 — Session prompt does not match the commit *(session provenance, [ADR-0209](../adr/0209-session-object-lineage-graph-and-provenance-export.md) §5)*
- TVO-PROV-005 — Cannot export provenance under the current scope *(session provenance, [ADR-0209](../adr/0209-session-object-lineage-graph-and-provenance-export.md) §10.3)*
- TVO-PROV-006 — Session write refused: capture is off *(session provenance, [ADR-0209](../adr/0209-session-object-lineage-graph-and-provenance-export.md) §4.2)*
- TVO-PROV-007 — Session capture refused: secret detected *(capture screening, [ADR-0304](../adr/0304-observed-session-capture-tier.md) §4 / [ADR-0323](../adr/0323-session-capture-spill-and-budget.md) §6)*
- TVO-PROV-008 — Observed capture is disabled for this repository *(observed capture, [ADR-0304](../adr/0304-observed-session-capture-tier.md) §5)*
- TVO-PROV-009 — Transcript could not be read *(observed capture, [ADR-0304](../adr/0304-observed-session-capture-tier.md) §6)*
- TVO-PROV-010 — Observed session cannot be attested *(observed capture, [ADR-0304](../adr/0304-observed-session-capture-tier.md) §3)*
- TVO-PROV-011 — Commit carries more than one run record *(observed capture, [ADR-0304](../adr/0304-observed-session-capture-tier.md) §1)*
- TVO-PROV-012 — That change already has a run record *(historical backfill, [ADR-0316](../adr/0316-backfilled-sessions-as-a-link-asserted-tier.md) §6)*
- TVO-PROV-013 — Backfill needs a signing identity *(historical backfill, [ADR-0316](../adr/0316-backfilled-sessions-as-a-link-asserted-tier.md) §2)*
- TVO-PROV-014 — Backfill cannot attach a clear transcript to a protected change *(historical backfill, [ADR-0316](../adr/0316-backfilled-sessions-as-a-link-asserted-tier.md); [provenance-graph.md](provenance-graph.md) §14.9)*
- TVO-KEY-001 — Access certificate expired :: tovio key renew --from key-authority.bodybyteapp.com
- TVO-KEY-002 — Key material missing :: tovio key renew --from key-authority.bodybyteapp.com
- TVO-KEY-003 — Backup is for a different identity
- TVO-KEY-004 — Interrupted key rotation cannot resume
- TVO-KEY-005 — Rotation journal failed verification
- TVO-KEY-006 — Recovery material could not restore access
- TVO-KEY-007 — Sealed key does not match this repository's identity
- TVO-IDENT-001 — Device enrollment claim is invalid
- TVO-IDENT-002 — Device pairing code (SAS) does not match
- TVO-IDENT-003 — Device enrolled, but the HEAD re-seal is pending
- TVO-IDENT-004 — No enrolled device
- TVO-IDENT-005 — Device name is ambiguous
- TVO-IDENT-006 — Key-transparency split-view suspected
- TVO-IDENT-007 — Identity generation changed after preview
- TVO-IDENT-008 — A prior identity initialization was recovered
- TVO-CRYPTO-001 — Envelope decryption / AEAD failure :: tovio fsck
- TVO-CRYPTO-002 — Signature verification failed :: tovio show blake3:91be…07 --verify
- TVO-CRYPTO-003 — Cannot seal a protected path (no repository identity) :: tovio init --mode team
- TVO-CRYPTO-013 — The fetched audit chain did not verify
- TVO-CRYPTO-014 — Enterprise ABE payload or provider failure
- TVO-CRYPTO-015 — Repository signature policy was not satisfied
- TVO-CRYPTO-016 — Audit export or delivery failed
- TVO-CRYPTO-017 — Audit retention checkpoint failed
- TVO-CONFLICT-001 — Conflicts created after merge :: tovio conflicts
- TVO-CONFLICT-002 — Conflict resolution rejected :: tovio conflicts show cfl:9k2m
- TVO-CONFLICT-003 — Cannot land a conflicted change onto a protected lane :: tovio resolve
- TVO-CONFLICT-004 — Cannot pull a conflicted change as a dependency :: tovio sync --isolate
- TVO-CONFLICT-005 — Semantic conflict (advisory)
- TVO-CONFLICT-006 — Conflict re-derivation did not match
- TVO-CONFLICT-007 — Conflict resolution payload is malformed
- TVO-CONFLICT-008 — Cannot re-seal a conflicted path
- TVO-CONFLICT-009 — Sync refused: protected lane would adopt a conflicted commit
- TVO-CONFLICT-010 — Operation requires a conflict-free tree
- TVO-CONFLICT-011 — No AI resolver configured
- TVO-CONFLICT-012 — Interactive resolve needs a terminal
- TVO-CONFLICT-013 — `resolve --ai` will not disclose a protected side
- TVO-CONFLICT-014 — AI provider failed safely
- TVO-CONFLICT-015 — Working-tree resolve not valid for this conflict kind
- TVO-CONFLICT-016 — N-way land: content conflict cannot be auto-resolved
- TVO-CONFLICT-017 — Protected resolution requires current-authority reseal
- TVO-CONFLICT-018 — Line-op capture missed an eligible file
- TVO-CONFLICT-019 — Merge fell back to the byte level: a contributing commit has no captured line-ops
- TVO-OP-001 — Undo result :: tovio redo
- TVO-OP-002 — Nothing to undo / redo :: tovio oplog
- TVO-OP-018 — Agent working-change path refused
- TVO-OP-019 — Cross-Forge meta-land coordination failed
- TVO-OP-021 — Cannot cherry-pick a merge commit
- TVO-OP-022 — Nothing to cherry-pick
- TVO-OP-023 — A `good` commit is not an ancestor of `bad`
- TVO-OP-024 — No bisect in progress :: tovio bisect start --bad <rev> --good <rev>
- TVO-OP-025 — Bisect needs both a good and a bad commit
- TVO-OP-026 — The first bad change is undetermined
- TVO-OP-027 — Bisect run aborted by the test command
- TVO-OP-028 — Cannot revert a merge commit
- TVO-OP-029 — Nothing to revert
- TVO-OP-030 — Repository has an interrupted commit to recover :: tovio fsck --repair
- TVO-OP-031 — An interrupted commit blocks this write :: tovio fsck --repair
- TVO-OP-032 — Landed, but some descendant lanes were not re-stacked
- TVO-OP-035 — An interrupted lane change cannot be reconciled
- TVO-OP-036 — An interrupted lane change blocks this write :: tovio fsck --repair
- TVO-OP-039 — An interrupted repository change blocks this write
- TVO-TOKEN-001 — Path-scope violation for an agent :: tovio agent show cap_7r4qy9m2
- TVO-TOKEN-002 — Capability token expired :: tovio agent new cursor --expires 8h
- TVO-TOKEN-003 — Capability token revoked :: tovio audit show --token cap_7r4qy9m2
- TVO-TOKEN-004 — Operation not permitted by token :: tovio agent show cap_7r4qy9m2
- TVO-TOKEN-005 — Sub-token scope exceeds parent :: tovio agent delegate cap_7r4qy9m2 --scope "src/api/**" --expires 1h
- TVO-TOKEN-006 — Agent token not found
- TVO-TOKEN-007 — Token cannot be renewed :: tovio agent new <name> --model … --task …
- TVO-TOKEN-008 — Agent tokens need a repository identity :: tovio init --mode team
- TVO-TOKEN-009 — Token exceeds the issuer's authority
- TVO-TOKEN-010 — Agent token lacks clearance to seal a path
- TVO-TOKEN-011 — Agent session bundle is not usable
- TVO-LOCK-001 — Path is already locked
- TVO-LOCK-002 — Land refused: an exclusive-lockable path diverged
- TVO-LOCK-003 — Path is not lockable
- TVO-STORE-001 — Hash / corruption mismatch :: tovio fsck
- TVO-STORE-002 — Obliterated object read :: tovio show blake3:5d20…ab --tombstone
- TVO-STORE-004 — Integrity check failed
- TVO-STORE-005 — Unsupported store layout feature
- TVO-STORE-006 — Object-store compaction recovery stopped
- TVO-STORE-007 — Causal ref maintenance stopped
- TVO-STORE-008 — Resumable replication object ingest refused
- TVO-STORE-009 — Replication receive refused for disk space
- TVO-STORE-010 — Ref name aliased onto another register
- TVO-SYNC-001 — Peer / transport unreachable :: tovio sync
- TVO-SYNC-002 — Wire protocol version mismatch
- TVO-SYNC-004 — Relay identity changed since pinning
- TVO-SYNC-005 — Promised object unavailable from promisor
- TVO-SYNC-006 — Remote lane has diverged (push refused, fail-closed) *(the `--push` fast-forward guard of [ADR-0288](../adr/0288-on-lane-divergence-reconciliation-at-sync.md) U3)*
- TVO-SYNC-007 — Repository owner identity changed since pinning
- TVO-CRYPTO-019 — Protected content is bound to the wrong path
- TVO-CRYPTO-020 — Chunked protected content mixes policies
- TVO-CRYPTO-021 — Refused to write in the clear at a protected path
- TVO-TAG-001 — Tag is immutable
- TVO-TAG-002 — Invalid tag-target commit reference
- TVO-CLI-001 — Unknown command or path :: tovio help
- TVO-CLI-002 — Destructive confirmation required :: tovio obliterate blake3:5d20…ab --confirm "obliterate blake3:5d20…ab"
- TVO-MIG-001 — Lossless Git import conflict
- TVO-FLOW-001 — Lane transition not permitted by the workflow :: tovio policy workflow show
- TVO-FLOW-002 — Lane matches no role in the declared workflow :: tovio policy workflow show
- TVO-FLOW-003 — Forward-only promotion: the source has not passed the required stage :: tovio health
- TVO-FLOW-004 — Source lane unknown and the workflow refuses unknowable edges :: tovio change propose --target <lane> --remote <addr>
- TVO-FLOW-005 — The stage a forward-only promotion requires has no live lane :: tovio lane <name>
- TVO-FLOW-006 — Coordinated merge-back refused; nothing advanced :: tovio health
- TVO-FLOW-007 — An outstanding merge-back obligation remains :: tovio land --resume
- TVO-FORGE-001 — Collaboration write lost a compare-and-set race
- TVO-FORGE-002 — Forge collaboration backend failure
- TVO-FORGE-003 — Landing blocked: a required CI check is not yet passing
- TVO-FORGE-004 — Connection denied by the repository's connection ACL
- TVO-FORGE-005 — Exclusive lock is held by another principal
- TVO-FORGE-006 — Lock release refused: not the holder
- TVO-FORGE-007 — No active lock on the path
- TVO-FORGE-008 — Forge request is unauthenticated
- TVO-FORGE-009 — Authenticated principal is not authorized
- TVO-FORGE-010 — Connection-ACL config could not be read or written
- TVO-FORGE-011 — Landing blocked: a protected path has no approving reviewer cleared to read it
- TVO-FORGE-012 — Forge server config could not be loaded
- TVO-FORGE-013 — Landing blocked: the target lane advanced since review
- TVO-FORGE-014 — Forge could not load its serving identity (the Key Authority)
- TVO-FORGE-015 — Audit entry rejected: append-time decode/verify failed
- TVO-FORGE-016 — Web-edge mechanism not allowed by the repo's `web_auth` policy
- TVO-FORGE-017 — Handle already taken
- TVO-FORGE-018 — Invalid handle
- TVO-FORGE-019 — Account has not claimed a handle
- TVO-FORGE-020 — Device-link proof-of-possession did not verify
- TVO-FORGE-021 — Pairing code has expired
- TVO-FORGE-022 — Pairing code already redeemed
- TVO-FORGE-023 — Device addition requires existing-device or recovery authorization
- TVO-FORGE-024 — Rate limit exceeded
- TVO-FORGE-025 — Repository not visible
- TVO-FORGE-026 — Plan limit reached
- TVO-FORGE-027 — Request body too large
- TVO-FORGE-028 — HA writer lease unavailable
- TVO-FORGE-029 — LAN discovery unavailable
- TVO-FORGE-030 — Shard routing metadata rejected
- TVO-FORGE-031 — OIDC verification keys unavailable
- TVO-FORGE-032 — OIDC authorization-code flow failed
- TVO-FORGE-033 — Enterprise federation observation rejected
- TVO-FORGE-034 — Federation rotation worker configuration invalid
- TVO-FORGE-035 — Hosted usage idempotency conflict
- TVO-FORGE-036 — Billing outbox lease conflict
- TVO-FORGE-037 — Replication term fenced
- TVO-FORGE-038 — Replication record integrity failure
- TVO-FORGE-039 — Replication idempotency conflict
- TVO-FORGE-040 — Replication backpressure
- TVO-FORGE-041 — Referenced object lacks durability quorum
- TVO-FORGE-042 — Hosted accounting state rejected
- TVO-FORGE-043 — Hosted directory or role operation rejected
- TVO-FORGE-044 — Stripe meter delivery refused
- TVO-FORGE-045 — Independent replication runtime refused
- TVO-FORGE-046 — Hosted administration refused
- TVO-FORGE-047 — Hosted usage producer refused
- TVO-FORGE-048 — Billing outbox administration conflict
- TVO-FORGE-049 — Organization invitation refused
- TVO-FORGE-050 — Account lifecycle refused
- TVO-FORGE-051 — Billing scheduler wake unavailable
- TVO-FORGE-052 — OIDC runner enrollment refused
- TVO-FORGE-053 — Billing scheduler pause state limit reached
- TVO-FORGE-054 — Repository sync admission full
- TVO-FORGE-055 — Invalid repository sync admission limit
- TVO-FORGE-056 — Replication peer control request refused
- TVO-FORGE-057 — Replication peer receiver capacity full
- TVO-FORGE-058 — Replication object request refused
- TVO-FORGE-059 — Hosted state admission full
- TVO-FORGE-060 — Directory assertion reduction refused
- TVO-FORGE-061 — Rotation lease refused
- TVO-FORGE-062 — Federation mapping change refused
- TVO-FORGE-063 — Provider credential operation refused
- TVO-FORGE-064 — Connector-driven suspension refused
- TVO-FORGE-065 — Issuer or provisioning policy refused
- TVO-FORGE-066 — Invoice comparison refused
- TVO-FORGE-067 — Proven request not routable
- TVO-FORGE-068 — Provider webhook refused
- TVO-FORGE-069 — Webhook delivery target is a forbidden egress address
- TVO-FORGE-070 — Cannot enqueue: proposal is not approved
- TVO-FORGE-071 — Merge-queue candidate bounced *(async scheduler outcome; not an HTTP status)* — **reserved**
- TVO-FORGE-072 — Illegal stack base *(stacked-proposal propose-time; fail-closed `422`)* — **reserved**
- TVO-FORGE-073 — Stack cycle *(stacked-proposal propose-time; fail-closed `422`)* — **reserved**
- TVO-FORGE-074 — Cannot enqueue: proposal is still stacked *(merge-queue admission; fail-closed `422`)* — **reserved**
- TVO-FORGE-075 — WorkOS webhook refused
- TVO-FORGE-076 — Contribution not permitted by repository policy
- TVO-FORGE-077 — Sovereign contribution reference unresolvable
- TVO-FORGE-078 — Restricted-proposal visibility not permitted
- TVO-FORGE-079 — Invalid proposal visibility request
- TVO-FORGE-080 — Change-controlled path requires a proposal
- TVO-FORGE-081 — Change-control approvals insufficient
- TVO-FORGE-082 — Reviewer not eligible for a controlled path
- TVO-FORGE-083 — Policy declarations exceed the plan allowance
- TVO-FORGE-084 — Hosted governance and commerce state disagree
- TVO-FORGE-085 — Membership observations were evicted before commerce consumed them
- TVO-FORGE-086 — Backup blob refused: the halves do not reconcile
- TVO-FORGE-087 — Blob already exists: a published name is never replaced
- TVO-FORGE-088 — Blob digest or size mismatch: nothing was published
- TVO-FORGE-089 — Blob upload refused: malformed session or part
- TVO-FORGE-090 — Enterprise plan changes are sales-led
- TVO-FORGE-091 — The target plan cannot hold this organization's people
- TVO-FORGE-092 — A billing change is already pending
- TVO-FORGE-093 — Pause window invalid
- TVO-FORGE-094 — Subscription paused: writes wait for collection to resume
- TVO-FORGE-095 — Reactivation unavailable
- TVO-FORGE-096 — Plan change not offered as one step
- TVO-FORGE-097 — Billing portal unavailable
- TVO-FORGE-098 — Subscription is not on the deployed catalog version
- TVO-FORGE-099 — The Forge is not ready to serve
- TVO-FORGE-100 — No TLS material; refusing to bind
- TVO-FORGE-101 — The Forge cannot serve: a component could not be opened
- TVO-FORGE-102 — Telemetry is enabled but its `[telemetry]` table cannot be used
- TVO-FORGE-103 — Telemetry is enabled but its project key could not be resolved
- TVO-FORGE-110 — Invalid rate-limit configuration
- TVO-FORGE-111 — Storage reserve reached
- TVO-SEM-001 — No language indexer for a path *(advisory; degrade to text diff)* — **reserved**
- TVO-SEM-002 — Indexer backend-fingerprint mismatch *(cache miss; re-index)* — **reserved**
- TVO-SEM-003 — Malformed symbol object *(unversioned/unparseable; fail-closed)* — **reserved**
- TVO-SEM-004 — Semantic-check failed
- TVO-SEM-005 — Semantic-check required but unavailable in this build
- TVO-SEM-006 — No behavioral snapshot on the target commit
- TVO-PLUGIN-001 — Plugin manifest invalid
- TVO-PLUGIN-002 — Plugin not installed / unsupported source
- TVO-PLUGIN-003 — Plugin integrity check failed
- TVO-PLUGIN-004 — Plugin event unsupported
- TVO-PLUGIN-005 — Plugin capability denied
- TVO-PLUGIN-006 — Plugin sandbox failed
- TVO-PLUGIN-007 — Plugin timed out
- TVO-PLUGIN-008 — Plugin output schema invalid
- TVO-PLUGIN-011 — Protected plaintext denied
- TVO-PLUGIN-012 — Plugin network denied
- TVO-PLUGIN-009 — Required plugin failed
- TVO-PLUGIN-010 — Required plugin unavailable
- TVO-PLUGIN-013 — Protected plaintext grant refused
- TVO-PLUGIN-014 — Forge enforcing plugin binding refused by the org plugin policy
- TVO-PLUGIN-015 — Landing blocked: a required plugin has no attested passing result
- TVO-PLUGIN-016 — Server-side plugin registration refused
- TVO-SECRET-001 — Commit blocked: a secret was detected
- TVO-ADMIN-400 — Enterprise identity-provider request is invalid
- TVO-ADMIN-404 — Enterprise identity-provider record not found
- TVO-ADMIN-409 — Enterprise identity-provider state changed or remains active
- TVO-ADMIN-422 — A referenced provider resource is unavailable for this scope
- TVO-ADMIN-503 — Enterprise identity-provider administration unavailable
- TVO-CAPI-001 — No or invalid credential on `/v1`
- TVO-CAPI-002 — Credential valid, scope or role insufficient
- TVO-CAPI-003 — Step-up required and not satisfied
- TVO-CAPI-004 — Not found, or not visible
- TVO-CAPI-005 — Request failed validation
- TVO-CAPI-006 — Compare-and-set conflict
- TVO-CAPI-007 — Account close: second factor missing or stale
- TVO-CAPI-008 — Session lifetime spent
- TVO-CAPI-009 — The Forge is unreachable
- TVO-CAPI-010 — Not available from the dashboard yet
- TVO-COLLAB-001 — Issue, comment, or milestone not found
- TVO-COLLAB-003 — Issue request refused validation
- TVO-COLLAB-004 — Issue action not permitted
- TVO-COLLAB-005 — Invalid issue transition
- TVO-REL-001 — Release refused: the tag does not exist
- TVO-REL-002 — Release refused: the tag already has a release
- TVO-REL-003 — Release asset already exists: assets are never replaced
- TVO-REL-004 — Release asset name is not a safe file name
- TVO-REL-005 — Release request refused validation
- TVO-REL-006 — Release action not permitted
- TVO-REL-007 — Release asset too large
- TVO-REL-008 — Release asset limit reached