Dustin

Sandboxed WASM lifecycle plugins, deny-by-default.

Plugins

Lifecycle events, and advisory versus enforcing.

What a plugin can do

install, list, show, uninstall, and where packages come from.

Install a plugin

Check a plugin before you trust it

bind, unbind, grants, filters, and what enforcing mode blocks.

Bind a plugin to an event

The default-on plugin, the three-way prompt, and the escapes.

Secret scanning

The manifest, the sandbox contract, and testing.

Write your own plugin

Reading the TVO-PLUGIN codes, and plugin doctor.

A plugin will not load or run

Tovio

Feedback

Roadmap

Docs

The questions that arrive from a legal or procurement inbox.

Licensing, versioning & project policy

The open-core split, stated plainly — and which component falls on which side.

What is open source and what is not

The short answer, what redistribution obliges, and where the line is.

Can I use TOVIO commercially?

What the trademark policy permits, what it does not, and how to ask.

Using the TOVIO name and logo

Pre-1.0, what is genuinely settled, and what may still change under you.

What the version number means

What is committed, per surface, and how a breaking change is announced.

Compatibility and deprecation promises

What is actually frozen, what is not, and what protects data you have already written.

Format and protocol stability

Where to start, what is required before a first pull request, and what review will hold you to.

Contributing to TOVIO

What leaves your machine, what the portal collects, and how to get it removed.

Privacy, data & your account

No background reporting to the project — and exactly what does leave your machine, when, and what it carries.

Does TOVIO phone home?

The four values a link may carry, what the portal itself holds, and the AI processing that is switched on.

What the feedback portal collects

Which analytics run, which regime applies to you, and the one cookie that records your choice.

Cookies on TOVIO sites

The supplier register, why it is a candidate list, and what it does not commit to.

Who processes data on our behalf

Where to write, what actually exists to delete, and what the address does not yet cover.

Request your data, or its deletion

Where the settings live, what notifies you, and what deliberately does not.

Change your email or notification settings

Opt-in by default, how to leave, and where to read updates without email.

Unsubscribe from product updates

How to reach us, what happens to what you send, and how you find out when it ships.

Feedback, roadmap & support

Which board to use, what to include, and what to leave out.

How to report a bug

Where to post, and what makes a request easy to act on.

How to request a feature

The six statuses, what each one means, and what moves a post between them.

What happens to your post

The inputs, the constraint, and why some answers are slow.

How we decide what to build

Status-only, no dates, and why it is built that way.

Reading the public roadmap

One system of record, and what everything else is a copy of.

Where release notes live

One notification, on the post you voted for, linking the release notes.

How we tell you something you asked for shipped

Not here. The private channel, and an honest account of its current limits.

Reporting a security vulnerability

Why posts are held for review, and what gets removed.

Community guidelines and moderation

What partners get, and how the segmented board and tickets work.

The design partner program

Which channel to use, and an honest account of what is covered today.

Contacting support

One article per failure people actually report. Each names what to redact before sharing anything.

Troubleshooting & error codes

The TVO-AREA-NNN shape, the exit-code classes, and where the remediation lives.

How to read a TOVIO error code

What to gather, and what to strip before sharing it anywhere.

Collect diagnostics safely

PATH problems, duplicate installs, and the version flag.

tovio: command not found, or the wrong version runs

TVO-PERM-001 — the most reported failure, and its diagnosis.

I cannot read a protected file

Auto-snapshot, and what usually causes the surprise.

My change has uncommitted work I did not expect

The TVO-TOKEN family, including mid-session expiry and what cannot be renewed.

Token expired or out of scope

The TVO-KEY family: missing, expired, unwrap failures, and recovery.

Key problems

TVO-NET and TVO-SYNC: TLS, pinned identities, proxies, admission.

Cannot reach a remote

TVO-SYNC, including a teammate's change not appearing.

Sync will not converge or materialize

Lock denied or stuck

TVO-STORE, fsck, and what a hash mismatch means.

Object store corruption

Import or bridge failed

A plugin refused to load

TVO-MCP: transport, bearer secret, and why remote access needs a proxy.

MCP client will not connect

Conflict surface errors

Large repositories, and the things actually worth tuning.

TOVIO feels slow

Limitations worth knowing before you hit them.

Known issues in the current release

The symbol graph, interface diffs, and versioning an AI system's behaviour.

Semantic & behavioral versioning

On by default, for Rust, TypeScript/JavaScript, Python and Go.

What the symbol graph gives you

semantic find-def and find-refs, and the rest of the query surface.

Find a definition or every reference

Catch breaking interface changes before landing

Why my land was blocked by a semantic check

behavioral snapshot, over model, prompts, tools, memory, retrieval and policy.

Version an AI system's behaviour

Diff or roll back a behavioural version

Automation: SDK, MCP & CI

Connect, read, and write from JavaScript.

Node SDK quickstart

What the SDK does that the CLI does not

The CI bridge, and the shape of a pipeline that uses it.

Run TOVIO in CI

Authenticate CI without a long-lived secret

Post check results back from CI

web-bridge, web-session, and the three auth postures.

Browser-driven agents at the web edge

The envelope, the exit classes, and which failures are worth retrying.

Error handling for automation

What a Forge will accept from an automated client.

Rate limits and concurrency

TOVIO where you already work. Status differs per surface, and each article says which.

Editors, desktop & the shell

Build it, install it, and point it at the CLI.

Install the VS Code extension

The views and actions worth knowing about.

What the VS Code extension gives you

Setup, the feature set, and current limitations.

Install the JetBrains plugin

The scope of the pre-release desktop app, honestly.

TOVIO Desktop: what it does today

What updating looks like today, and what the app does and does not do on its own.

Keep TOVIO up to date

status --prompt, and how to wire it in safely.

Show TOVIO state in your shell prompt

Use TOVIO from a script

Present a token as a Git credential

The failures that account for most reports.

Editor troubleshooting

Written for the person supervising an agent, not for the agent.

AI agents & capability tokens

Scope, clearance and provenance, in one page.

What an agent can and cannot do in TOVIO

Issue a capability token

The two mechanisms that actually narrow a token.

Scope a token properly

commit --token, and where scope is checked.

Let an agent commit

Monotonically narrower delegation, and what the chain records.

Delegate a token to a sub-agent

Immediate revocation, and what happens to work in flight.

Revoke a token right now

secret_clearance, enforced at seal and before protected reads.

Keep agents out of your secrets

See exactly what an agent did

The agent namespace

Review, promote or abandon an agent's work

tovio mcp serve, over stdio or loopback HTTP.

Connect an MCP client to TOVIO

The tool surface, and what is deliberately absent.

What the MCP server exposes

Coordination, intent, and how conflicting work surfaces.

Run several agents on one repository

Workload identity, without a stored secret.

Give CI a short-lived identity

The signed audit chain, exports, and the one genuinely irreversible operation.

Audit & compliance

Read the audit log

tovio audit verify, and what a failure means.

Verify the audit chain

tovio audit export, its four chain formats, and delivery.

Send audit records to a SIEM

tovio policy audit, --justification, and when reasons help.

Require a written reason for sensitive actions

tovio audit archive, behind a signed checkpoint.

Archive old audit entries

tovio policy signing, and what it costs to turn on.

Require signed commits

tovio obliterate — the one irreversible operation.

Permanently erase a file's contents

Per-file encryption, policies, access, and the key hygiene that makes it survivable.

Permissions, keys & secrets

Encryption at snapshot time, not a server check.

How per-file permissions actually work

The three crypto tiers, what changes between them, and what is actually shipping.