Land across several repositories atomically

Meta-changes, for work that spans repositories.

Written By Dustin

Last updated 22 minutes ago

tovio meta create <name> --atomictovio meta create <name> --sequencedtovio meta attach <name> <chg-id> --repo <path>tovio meta attach <name> <chg-id> --forge <host:port> --target maintovio meta show <name>tovio meta listtovio meta land <name>tovio meta resume <name>

The problem it solves

A change to a shared library and the services using it must land together or the tree is broken between them. Git's answer is submodules, careful ordering, and hope. A meta-change makes it one coordinated operation.

Atomic or sequenced

Strategy	Behaviour
`--atomic`	Every member must pass its pre-land gate before any member lands. The default.
`--sequenced`	Members land in attachment order; a failure halts the sequence at that member.

Atomic is a coordinated all-or-nothing gate, deliberately not a two-phase commit across object stores. Members that already committed stay committed; the guarantee is that nothing commits until everything has cleared its gate.

Attaching members

A member is a (repository, change id) pair, and the link is to the stable Change ID — so it survives rebases and amendments in the member repository.

Flag	Default
`--repo <path>`	The current repository. Another local checkout, or a path recorded as-is for a repo not reachable here.
`--forge <addr>`	None — the member stays a local checkout. Give it to route through a Forge.
`--cert <file.der>`	`.tovio/relay-cert.der`. Only valid with `--forge`.
`--target <lane>`	`main` — the proposal target on the member's Forge.

Checking before you land

tovio meta show <name>

Reports the strategy, the state, and each member's landability: landable, conflicted, or unknown (remote) for a member repository this machine cannot reach. It never claims a member is landable when it cannot check — an honest offline pre-land gate is more useful than an optimistic one.

Across Forges

Members attached with --forge land through authenticated prepare, commit, and release steps backed by durable single-writer reservations, then the Forge's normal proposal land path. A participant that cannot complete one of those steps — unreachable, drifted proposal tip, an expired reservation, or a refusal by the normal land gate — surfaces as TVO-OP-019. Earlier successful commits are immutable and are recorded as they happen; outstanding reservations are released, and otherwise expire by TTL.

If a land is interrupted

tovio meta resume <name>tovio meta list

A partial outcome is recorded as partially_landed. resume re-attempts only the members not yet landed, and is idempotent — a fully-landed meta-change simply reports landed.

It is local coordinator state

Meta-changes live at .tovio/meta.vex and are never synced. Coordinating who runs the land across several organizations is a human step; this command handles the gate and an honest resume after a partial land.