The seven concepts you actually need

1. Change

A unit of work with a stable identity (chg:, a random 128-bit id) that survives rebasing, amending, splitting, and absorbing. It is the thing you propose, review, and land. Commits still exist underneath, addressed by a BLAKE3 content hash (blake3:), but you work with changes.

2. Lane

What Git calls a branch. A lane is a conflict-free replicated reference ordered by a hybrid logical clock, which is why two replicas advancing the same lane converge instead of diverging. You do not live on a lane; you land work onto it. Some lanes are protected — the policy manifest can require that a change is conflict-free, reviewed, or signed before it may advance one.

3. Policy

A rule attaching a path pattern to read and write conditions written over attributes, such as role=engineer & team=payments. Policy is enforced by encryption at snapshot time, not by a server check — which is why it still holds on a cloned repository sitting on someone else's disk. tovio access check <path> shows, attribute by attribute, why an identity does or does not satisfy one.

4. Capability token

A scoped, time-limited authorization, usually for an AI agent. It names the paths, operations, and lanes allowed, and it can mint sub-tokens that are never wider than itself. The scope is checked before anything is sealed, so an out-of-scope write fails rather than being caught afterwards. Reading content marked secret needs an explicit secret_clearance on top of the scope.

5. Conflict object

A conflict recorded in the repository rather than written into your files. It carries both sides, their base, and the conflicting change ids. Your tree stays buildable while it is open, and you resolve it by choosing a side, editing, or splitting the resolution by region. Creating a conflict is a success, not an error — tovio conflicts exits 0.

6. Forge

The optional commercial collaboration server. It hosts repositories, runs proposals and reviews and required checks, arbitrates lock grants, emits events and webhooks, and keeps a signed audit trail. You do not need one: tovio serve in the free CLI is a real TLS server for clone, fetch, and push with your permission policy enforced. What it lacks is exactly the collaboration platform above.

7. Provenance

The recorded answer to who made a change, under what authorization, and why. For an agent that includes the model, the task id, the token, and the full delegation chain. It is what makes tovio log --why (the attested reasoning behind a change), tovio log --session <chg> (the run record behind it), and the audit trail meaningful rather than decorative. Run records come in tiers of decreasing strength — attested, observed, backfilled — and every surface labels which tier it is showing, so a self-reported transcript is never mistaken for a signed one.

The documentation site has a longer treatment of each of these under Concepts.