Require signed commits

tovio policy signingtovio policy signing --require-commitstovio policy signing --require-protected-ref-updatestovio policy signing --require-commits=falsetovio policy signing --reset

Bare tovio policy signing shows the active requirement. Each flag is a tri-state: pass it bare to turn the requirement on, pass =false to turn it off explicitly, or omit it to leave it as it is. --reset removes the declaration entirely and restores optional, legacy-compatible signing.

The two requirements

• --require-commits requires every newly authored commit under this manifest to carry a valid signature.
• --require-protected-ref-updates requires a valid signed update envelope for every lane covered by branch protection. The signature covers the complete lane register, and its signer must match the authenticated writer on the connection.

The second does not turn an ordinary lane into a protected one, and it does not substitute for review requirements.

What it gets you

Every commit is attributable to a key rather than to an author string anyone can type. On a repository where agents commit, this is what makes provenance meaningful: the signature binds the commit to the identity that actually produced it.

You cannot evade it by choosing an old policy

Each commit links the manifest it was authored under, so the historical decision stays independently verifiable. But a receiver also applies its currently served requirement to commits newly introduced beyond the refs it already trusts, and it walks reachable ancestors — so a signed tip cannot smuggle in an unsigned commit underneath it, and a writer cannot select an older manifest to get around the policy.

Before turning it on

• Everyone needs a working identity — tovio identity show.
• CI and automation need signing identities too. Workload identity gives a pipeline a short-lived one without a stored secret.
• History imported from Git does not carry valid TOVIO signatures. Existing unsigned commits stay readable because their historical manifest did not require a signature; the requirement applies going forward.

What a refusal looks like

If the requirement is active and the edge has no usable repository identity, or a produced signature does not match its declared signer, the mutation is refused before the ref moves with TVO-CRYPTO-015. Nothing is published unsigned and repaired later. The usual cause is a locked OS keychain or a repository identity that is not present on the current device.

A signature that is present but invalid is always rejected, requirement or no requirement.

After a rewrite

Rewritten commits need signing again — the signature covers content that changed.

Verifying

tovio audit verifytovio fsck --strict