Glossary of TOVIO terms

The vocabulary that trips people up, shortest useful definition each.

Written By Dustin

Last updated 31 minutes ago

Working with history

Lane	What Git calls a branch: a replicated pointer to a commit. Converges rather than diverging. You land work onto a lane, you do not live on it.
Change	A unit of work with a stable `chg:` id that survives rebase, amend, split, and absorb.
Change ID	A random 128-bit identifier rendered `chg:<base32>`, assigned when the change is created.
Commit	An immutable content-addressed snapshot, identified by a `blake3:` hash. Sits underneath a change and embeds its change id.
Draft change	A private, exploratory change that cannot be proposed or landed until you promote it.
Stacked changes	A chain in which each change is the parent of the next — the shape you get when work builds on unlanded work.
Land	Integrating one or more lanes into a target lane (default `main`). What you would call merging.
Merge-base	The lowest common ancestor of the two sides of a merge or rebase — the point they last agreed.
Snapshot	The automatic capture of your working copy into the current change. Replaces staging.
Op-log	The local, append-only record of every operation — not just commits — that `undo` and `redo` walk. Never synced.
Staleness	How far a change's base is behind its target lane, in commits and in age. `tovio health` reports it.
Protected lane	A lane the policy manifest designates as gated — it may require conflict-freedom, review, or signatures before anything advances it.
Meta-change	A change spanning several repositories, grouped so it lands atomically or in a controlled sequence.

Conflicts

Conflict object	A conflict recorded in the repository rather than written into your files. Carries both sides, the base, and the conflicting change ids.
Buildable state	A tree with no unresolved conflict markers in it — the property TOVIO preserves by storing conflicts instead of inlining them.
Materialized view	The rendering of a tree that contains conflicts, showing each conflicted path as a flagged placeholder rather than marker text.
Semantic conflict	A textually clean but interface-incompatible change — the merge succeeds and the build does not. Detected by the optional symbol-graph layer.

Permissions and keys

Policy	A path pattern plus read and write conditions, enforced by encryption at snapshot time.
Attribute	A signed claim about an identity, such as `role=engineer`, that policy conditions test against.
Clearance	The specific authorization (`secret_clearance`) that lets a holder read secret-marked content. Agents need it explicitly, on top of their token scope.
Seal	Writing an object with its encryption and signatures applied. Scope and clearance are checked before this happens, never after.
Identity	A cryptographic principal — human, agent, CI, or deployment — with a signing key and a set of enrolled devices, each holding its own key that never leaves that machine.
Key Authority	The entity that decides which identities may read which policy paths and hands out wrapped keys. Absent in Solo; an authorization oracle in Team, a role the repository owner plays; threshold- or hardware-backed in Enterprise.
Recovery key	An independent key escrowed at `init` that can restore an identity's decryption access if its private key is lost — data-loss recovery, unique to an encrypted version control system.
Tier 0 / 1 / 2	Solo, Team, and Enterprise cryptographic tiers. Solo needs no Key Authority; Team adds one; Enterprise adds attribute-based encryption.
Obliteration	The intentional, audited, permanent removal of an object's payload, leaving a signed tombstone in its place. Human-only.

Agents

Capability token	A signed, scoped, expiring authorization, typically issued to an agent. Sub-tokens may only narrow it.
Path scope	The glob set a token authorizes. Reads and writes outside it are refused before anything is written.
Provenance	The record of who changed something, under what authorization, and why.
Rationale	The attested reasoning behind a change — decision, confidence, alternatives rejected. Surfaced by `tovio log --why`.
Session (run record)	The record of one agent run: its originating prompt and ordered turns. Comes in attested, observed, and backfilled tiers, and every surface labels which it is showing.
Behavioral snapshot	A versioned record of an AI system's behavioral surface — model, prompts, tools, memory, retrieval, policy — versioned independently of the code.

Sync and collaboration

Relay	A bare TOVIO server that stores and serves objects — a Forge in its minimal form, and what `tovio serve` gives you.
Forge	The optional commercial collaboration server: hosting, proposals and review, required checks, lock arbitration, events, and the audit chain.
Proposal	A Forge object linking a change to its reviewers and their decisions. The unit a review happens on.
Lock	An exclusive or advisory hold on an unmergeable binary path, for paths policy has declared lockable. Every lock carries a time to live.
HLC	Hybrid logical clock — physical time plus a logical counter, which is how concurrent lane updates order deterministically.
Sparse / partial clone	Cloning only part of a repository: a path scope, no file content, a size limit, or a shallow history. Every axis grows back later; none of them loses data.
Bridge mode	Two-way interop with a Git remote during migration, through conflict-safe namespaces and without force pushes on either side.

The documentation site carries a fuller glossary with links into the specifications.