Cannot reach a remote

First, which code

• TVO-NET-001 — refused at admission. The source address is not permitted by CIDR policy. This is evaluated before the connection ACL and before authentication, so your credentials are irrelevant to it.
• TVO-SYNC-001 — the relay or Forge could not be reached at all: DNS, connection, TLS, or handshake. Because TOVIO is offline-first, this does not stop you working locally.
• TVO-SYNC-002 — the peer answered but speaks a wire-protocol version this client cannot negotiate. One side needs upgrading.
• TVO-OP-011 — a non-2xx refusal from the far side. 401 not authenticated, 403 not permitted, 404 no such resource, 409 a stale version. The Forge’s own reason is printed verbatim.

Pinned identity no longer matches

Two separate fail-closed pins, and the code tells you which one moved:

• TVO-SYNC-004 — the relay’s serving identity is not the one you pinned. The handshake completed and the relay proved liveness, but it is not the same relay.
• TVO-SYNC-007 — the repository owner / Key Authority identity is not the one pinned on first contact. This is the trust root, so it is refused hardest.

tovio remote show <name>tovio remote list

Either the operator genuinely rotated — get the new material from them through a channel you trust — or something is intercepting the connection. Do not look for a flag to skip verification. There deliberately is not one.

Some error messages currently suggest tovio remote status. That subcommand does not exist; the working command is tovio remote show <name>. This is a known wrong remediation string, not a broken install.

Proxies and VPNs

An intercepting proxy breaks certificate pinning by design. If you are on a corporate network that inspects TLS, a native remote will not work through it, and it will usually surface as TVO-SYNC-004.

Admission refusals

A CIDR policy refusal is not a bug — the operator has an allow list and your address is not on it. Deny-wins, and it fail-closes on an address it cannot parse. Ask the operator, and mention whether you are on a VPN, because that changes the address they see.

Policy manifest refusals

TVO-SYNC-008 — the served policy manifest is either not attested by your pinned owner root, or carries a lower version than the one you already hold (a policy rollback). Refused deliberately; report it to the Forge operator rather than working around it.

Reporting it

The code, and whether you are on a VPN or behind an inspecting proxy. Not the host, not the repo id, not the certificate.