Your policy manifest is unattested

The policy manifest is signed. A serving edge refuses to serve an unattested manifest and peers refuse to adopt one, which surfaces as TVO-SYNC-008 — typically the moment you push, or the moment a teammate pulls.

The same code covers a second, different refusal: a manifest that would roll policy backwards. Read the message before assuming it is an attestation problem — if you are being told your manifest is older than the served one, re-signing is not the fix and will not help. Pull first, reconcile, and re-apply your change on top.

The fix

tovio policy sign

Re-attests the working-copy manifest under the repository owner root. This is the documented recovery. Content is unchanged — only the signature is recomputed — so it is safe to re-run as many times as you like.

Then commit and push, so the attested manifest actually reaches every replica.

Why a manifest ends up unattested

• It was edited by something other than tovio policy set.
• It was carried across from a repository or branch whose owner key differs.
• The identity that signed it was rotated or recovered, so the old signature no longer verifies under the current root.

That last one is worth remembering after tovio key recover: recovery installs a fresh identity, so re-signing the manifest belongs on your post-recovery checklist alongside re-granting teammates.

Do not hand-edit the manifest

Every edit made outside the CLI has to be re-attested anyway, and a manifest that parses but was written by hand is exactly the situation the signature exists to detect. Use tovio policy set and tovio policy remove.

Check the result

tovio policy list

tovio policy show <path>

Signing changes no declarations, so the output should be identical to what you had before — if it is not, stop and find out why before pushing.

Redact before you share

policy list output is your access map: path globs and the role, team and clearance vocabulary your organisation uses. If you need help with a sync refusal, share the error code and the shape of the problem — not the manifest, not the path globs, and never the contents of .tovio/.