When TOVIO deliberately sends file contents to a model

There is exactly one place where TOVIO will deliberately send the contents of your files off your machine: model-assisted conflict resolution, requested explicitly with tovio resolve --ai.

It is documented here rather than buried, because "we cannot read your code" does not cover a disclosure you consented to, and pretending otherwise would be the dishonest version of this article.

Two preconditions, both yours

• It runs only when you pass --ai. There is no automatic invocation and no setting that turns it on for future runs.
• No model is bundled. Nothing is reachable until you set the ai.provider configuration key naming one. With it unset, --ai does not fall back to some quiet built-in model — it falls through to the plugin resolver seam, and with nothing bound there it simply fails.

The consent prompt applies to protected paths, not to every path

This distinction matters and is easy to get wrong, so it is stated rather than glossed.

Before anything is sent, the path is classified. A path whose policy is anything other than clearly unrestricted — including a policy that cannot be parsed — is treated as protected. The failure mode is caution, not optimism.

For a protected path, the full gate runs before any egress: consent is asked per invocation on a real terminal, the default answer is no, and --json, --quiet, or any non-interactive session refuses outright rather than auto-consenting. A script cannot agree on your behalf.

For an ordinary unprotected path — which is most files in most repositories — there is no consent prompt. Passing the flag is treated as the authorization, the disclosure is recorded on a best-effort basis, and the contents go to your configured provider. So tovio resolve --ai in a non-interactive job will disclose unprotected file contents without asking again. If that is not what you want, do not configure a provider, or do not pass the flag in automation.

A protected disclosure is written down before it happens

A protected disclosure produces a signed audit entry recording the path, the provider, and that the disclosure was classified protected. It records no content. That entry is written and verified first: if the repository cannot persist it, the disclosure is refused. A disclosure that cannot be audited does not happen.

One limitation to set expectations: the entry is written before the model answers, so it records that the conflict was disclosed rather than which side was eventually chosen, and it records the protected classification as a fact rather than a written explanation.

What this means honestly

If you use this feature, the contents of the conflicting file reach a third-party model provider under that provider's terms. TOVIO's encryption did not fail; you authorized an exception. The design of this seam is to make that exception explicit, per-use, avoidable by simply not using it, and — for protected content — recorded in your local audit chain before it happens. “Recorded” rather than “permanent”: that chain lives on your machine and does not replicate, so it is evidence for you to keep, not evidence held somewhere you cannot reach.

If that trade is not one you want to make, do not pass the flag. Ordinary conflict resolution never contacts anything.