Push and pull in one step

tovio synctovio sync <host:port> <repo> --cert <file.der>tovio sync --pushtovio sync --pulltovio sync --isolate

sync is the everyday command: it pulls and pushes together, in that order. With no arguments it uses the origin recorded when you cloned.

The positional argument is an address, not a saved remote name. tovio sync origin <repo> would be read as the literal host origin. See the named-remotes article for what a name is and is not used for.

The remote moving is not a problem

If the remote advanced while you were working, that is the normal case, not an exceptional one. Lanes are conflict-free replicated references. A full tovio sync joins two diverged tips on the lane into a two-parent reconciliation commit. There is no "pull before you push" ritual and no force push.

What can still need attention is a content conflict — you and someone else edited the same lines. That becomes a conflict object; your tree stays buildable.

The one case that is refused

A push-only sync has no pull leg to reconcile with, so it cannot merge a divergence — it would silently orphan the remote's tip off the lane. tovio sync --push and tovio push therefore compare the relay's advertised frontier before uploading anything, and decline a diverged lane with TVO-SYNC-006. Nothing is uploaded and no ref moves on either side.

The fix is one command: run tovio sync, which reconciles on-lane, after which the push is a plain fast-forward. A genuine fast-forward, and a lane the relay does not hold yet, are never blocked.

Ordering, and what stops a sync early

The pull runs first. If it brings in a change your work depends on that still holds unresolved conflicts, the materialization gate refuses (TVO-CONFLICT-004) and the sync stops before pushing. Resolve, then sync again. --isolate builds against the last-known-clean version of each gated path instead, and pins it so tovio status flags the isolated build.

Explicit push and pull

tovio push <host:port> <repo> --cert <file.der>tovio pull <host:port> <repo> --cert <file.der>tovio pull <host:port> <repo> --cert <file.der> --isolate

Bare tovio push and tovio pull with no arguments print a migration hint for people arriving from Git rather than doing anything.

Failures

Everything transport-shaped is TVO-SYNC-*. A served policy manifest that is unattested or would roll policy backwards is refused as TVO-SYNC-008; a relay whose serving identity no longer matches the one you pinned is TVO-SYNC-004, fail-closed with no ref advanced.