The defaults that are on before you change anything

TOVIO collects no telemetry and reports nothing about your usage anywhere. Four behaviours are nevertheless on by default, and each one does something without being asked. They are collected here rather than scattered, because a version control system that acts on its own should say so plainly on the way in.

1. Secret scanning, before anything is written

Every commit runs a first-party secret scanner over the snapshot, as an enforcing check bound to the pre-snapshot event. A finding blocks the write rather than warning about it. You do not have to install or bind anything: the binding is synthesized for you in every repository, and a narrower hand-written binding will not silently replace it — a weaker one runs alongside the default rather than suppressing it.

The two sanctioned levers are turning it off and swapping it out:

tovio config set secrets.scan off

tovio config set secrets.scanner <plugin-id>

TOVIO_SECRETS_SCAN is the environment equivalent, which is the one you want in CI. Note that a build made with --no-default-features drops the scanner feature entirely and injects nothing — a lean build is a build with no default scanning.

2. Automatic sync

After a command that advances history — a commit, a land, a lane switch — TOVIO runs one throttled sync. By default this happens inline, on the same thread, after the command's own output and before your prompt returns; sync.auto.mode detached moves it to a quiet background child instead. It exists to shrink the window in which two people's work drifts apart, because a lane conflict only becomes possible once both sides have moved past their merge base.

What it will and will not do:

• It does nothing at all until a repository has a saved remote. A purely local repository never contacts anything.
• Pulling is unconditional; pushing is not. The first publication of a lane is always a manual act. After that, only the current lane is pushed, and never a protected one.
• It refuses to run over a dirty working copy and skips its turn rather than risk overwriting uncommitted edits. It also skips if the repository is busy, instead of waiting.
• It folds your lane's upstream in only when that is conflict-free. A would-be conflict is left alone for a deliberate tovio land.
• It is never fatal and never noisy. A failure does not change your command's exit code and prints nothing to standard output. Being offline is silent.
• The default interval is 120 seconds, floored at 5 so a typo cannot turn it into a connection storm.

Turn it off for one command with the global --no-sync flag, for the session with TOVIO_NO_SYNC, or permanently:

tovio config set sync.auto off

Narrower knobs exist if you want to keep pulling but stop pushing (sync.auto.push off), run it out of band (sync.auto.mode detached), or change the interval (sync.auto.interval). Every key honours a matching TOVIO_* environment variable, and the environment wins.

3. Agent-transcript capture

If you commit while an AI coding session is running, TOVIO looks for that session's transcript and attaches it to the commit as an observed run record. The same happens on tovio resolve and tovio land. The point is that six months later you can ask what a change was for and get an answer.

Be clear about what this is:

• It is self-reported and unattested. Nothing binds it to a capability token, and it never enters the signed audit chain. Every read surface labels it as observed, so it cannot be mistaken for a signed record.
• A mandatory secret scan gates the write. A finding blocks the capture rather than warning about it (TVO-PROV-007).
• A transcript belonging to a different project is refused (TVO-PROV-009).
• It is stored in the repository, which means it syncs with the repository.

There is no flag to turn capture on, because it is already on. Decline it for one commit with --no-session, or durably:

tovio config set provenance.observed_capture off

A repository can also pin this in its policy manifest, in which case an attempted capture is refused with TVO-PROV-008. A policy value that is present but unreadable fails safe to off.

4. Semantic indexing

tovio commit builds a symbol graph for the languages it recognizes — Rust, TypeScript and JavaScript, Python, and Go. It is what makes tovio semantic diff, find-def, find-refs, callers, tested-by, search, and impact answer.

The index is advisory by default and entirely offline: it needs no network, and it never blocks an operation unless a protected lane has explicitly opted into the semantic-check land gate — at which point a semantic conflict can refuse a land on purpose. Symbol data for protected paths is sealed like any other protected content, so the index cannot become a name-enumeration oracle over files you are not cleared to read. A build made with --no-default-features never constructs the index at all, and the queries then simply find nothing.

What is not on by default

For contrast, and because people ask: file locking is opt-in and requires a policy declaration, the filesystem monitor daemon is off, plugins other than the default secret scanner run only where you bind them, and semantic extraction beyond the four default languages sits behind an off-by-default build feature.