Verifiable config distribution

BetterSign™

Config distribution becomes plog distribution. A daemon publishes configuration into its provenance log; a trusted consumer syncs, verifies, and pulls it into real files on disk.

Stable identity

A VLAD remains stable while its keys and protected metadata rotate.

Self-verifying history

Every state transition is hash-linked and authorized by the previous log state.

Decentralized discovery

VLADemlia helps peers locate current records without becoming the trust root.

Routine rotation

Key changes become signed updates that followers can verify and apply.

Verifiable config distribution

Config Pull

What Config Pull Is

A daemon publishes configuration values into its own provenance log. A consumer that trusts that daemon already syncs and verifies the log, so distributing config becomes the same operation as distributing plog state.

Pulling turns verified plog state into real files: a WireGuard interface config, an SSH known_hosts file, a TLS client config, a PEM certificate bundle, or a governance document staged for review.

It reuses the existing DHT synchronization. There is no new transport, no background polling, and it is not a secrets channel. Private keys are never pulled; only public material and declarative configuration.

Publish, Pull, Review

The producer publishes entries under a /config/ path in its own plog. The consumer pulls a domain from a trusted VLAD and materializes the artifact, or fetches a governance document for review only.

All commands talk to the local daemon over its Unix socket, and every route is default-deny: read to pull, manage to publish or grant trust.

# Producer: advertise a WireGuard peer in your own plogbs config publish --path /config/wireguard/interface/address --value "10.0.0.1/24"bs config publish --path /config/wireguard/peers/$VLAD/public_key --value-file peer.pub# Consumer: review as a dry-run, then trust the domain and writebs config pull wireguard --from-vlad $PUB_VLAD --output /etc/wireguardbs config pull wireguard --from-vlad $PUB_VLAD --trust --write --output /etc/wireguard# Governance: fetch to a review file, never auto-appliedbs governance fetch policies --from-vlad $PUB_VLAD --trust

Config Domains

Low-authority domains render to live files. High-authority governance domains are fetched to a review file and never applied to a running daemon.

Domains and Artifacts

wireguard
wg-quick interface config; the private key stays local
ssh
known_hosts entries keyed by the publisher VLAD
tls
validated TLS client configuration
certs
PEM bundle of certificates only, never a private key
governance
policies, templates, guards, and audit-rules staged for human review

Trust And Safety

Every value read from a plog is treated as attacker-influenced. Each value is validated into a strict typed model before any renderer sees it, so out-of-grammar input cannot fabricate a shell hook or smuggle a private key into a bundle.

What A Pull Enforces

Before rendering
  • The whole plog chain is re-verified; only post-verify state is served
  • Trust is required for that specific domain, granted on first use per domain
  • An older or forked head is refused by the anti-rollback floor
  • A signed freshness heartbeat proves the head is current, so a relay cannot serve stale config
When writing
  • Values are parsed into typed domain structs, rejecting out-of-grammar bytes
  • Renderers use compiled-in templates; a pulled template never reaches an engine
  • Writes are path-contained under the output root with an atomic previous-version backup
  • Governance domains are review-only and each fetch is durably audited first
Channel Existing DHT plog sync
Trust Domain-scoped, trust on first use
Safety Typed validation boundary