Move a repository from Solo to Team

tovio identity init

Provisions a cryptographic identity for an existing Simple repository, upgrading it to Team so you can enrol other recipients, issue attributes, and act as the Key Authority.

There is no tovio policy promote. If you have seen that command referenced anywhere, it does not exist — promote exists only as tovio change promote and tovio agent promote, which are unrelated.

It does not re-encrypt your history

This is the important correction. identity init is fast and does not rewrite the object store. Existing public history stays exactly as it is; only newly protected paths seal going forward. Nothing that was committed in the clear becomes protected retroactively.

So if a secret is already sitting in your history in the clear, upgrading to Team does not fix it. That still needs tovio obliterate, and the credential should be rotated.

It creates your recovery phrase

Along with the identity, TOVIO generates the independent recovery key and escrows it: printed on a terminal, or written to .tovio/tovio-recovery-key.txt on a non-interactive run. Capture it now. Losing both the identity key and this phrase is the unrecoverable case.

Before you run it

1. Review your existing policies — tovio policy list — since they are about to govern other people.
2. Have collaborators' identity.pub files ready (they each run tovio identity show).

After

tovio identity showtovio key export backup.key --passphrase-file pass.txttovio access grant --identity ./peer.identity.pub --attr role=backendtovio access check <path> --identity ./peer.identity.pub

Back up the new key immediately, then enrol people. Remember grants are prospective: a teammate starts reading a protected path at its next commit, not retroactively.

What does not change

History, change ids, and the everyday commands.

If it fails

Initialization is a durable transaction and fails closed rather than half-applying. Two refusals you may meet, both safe:

• TVO-IDENT-007 — the repository identity changed between a preview and the write. Nothing was initialized. Refresh, choose the recovery destination again, and retry. Never reuse the stale request.
• TVO-IDENT-008 — a different pending initialization was recovered and completed first, so your request was not applied. Inspect the now-settled identity and retry only if you still need to.

An existing identity is never overwritten by either path.