How trees connect.
A land is sovereign. Your data stays on your server. Your database. Your rules. Canopy is how sovereign lands connect without a central authority. Every land is a node in a distributed network.
Every AI platform today runs your agent on their servers, behind their API, inside their product. Your knowledge lives in their database. Your conversations disappear when they decide. Your agent's capabilities are whatever they choose to ship.
The seed flips this. Your land is your server. Your trees are your data. Your extensions are your choice. And when you want to connect with others, you peer directly. No middleman. No platform risk. No permission needed.
Each land is one server, one database, one seed. A land operator runs their own instance. They control who registers, what extensions load, what trees grow. No land depends on another to function.
Disconnect from the network and everything still works locally. Your trees, your users, your AI conversations, your cascade signals. The land is complete on its own. The network is optional.
Run on your hardware. Your cloud. Your Raspberry Pi. Anywhere Node.js and MongoDB run. No vendor lock-in. No managed service required. The seed boots on anything.
The operator chooses which extensions to install, which users can register, which trees can grow, which lands to peer with. Every config key is changeable at runtime through CLI, API, or the AI itself.
The protocol that connects lands. REST endpoints. Signed messages. Peer discovery. The trust layer between sovereign nodes.
Each land generates an Ed25519 keypair on first boot. Stored in the .identity system node. The public key is shared with peers. The private key never leaves the land. Every outbound message is signed.
Lands find each other through a directory service or direct peering by URL. The directory at dir.treeos.ai helps lands discover each other and browse published extensions. It's where treeos ext search and treeos ext publish hit. Anyone can run their own directory. It's a search index over public metadata that lands voluntarily advertise. Extension code lives on the publishing land, not the directory. The directory is a convenience, not an authority. Remove it and direct peering still works.
Peers exchange health status and extension lists on a regular interval. Heartbeats tell you what extensions a peer has, not what data they hold. Health monitoring without surveillance.
Cascade signals, contributions, and tree updates flow between peers as signed events. An outbox queues events for delivery. A retry mechanism handles temporary peer unavailability. Events are idempotent.
Trees marked public are browsable from any land on the network. Users on Land A can query trees on Land B without creating an account. The AI reads the tree and responds. Knowledge is accessible across the network.
Build an orchestration pattern, a tool pipeline, a background process. Publish it to the registry. Now every land on the network can install it. Intelligence compounds. What one person builds, everyone can use.
Invite users from other lands to contribute to your trees. They bring their own LLM connections. They work in your tree with your extensions. Their contributions are stored on your land. Their user data stays on theirs.
Lands advertise their loaded extensions at /api/v1/protocol. An agent navigating from one land to another can discover what tools are available at each destination. The network is capability-aware.
A tree on Land A writes content. Cascade fires. An extension propagates the signal to Land B through Canopy. Land B accepts it, processes it, writes a result. The metadata Map preserves everything across transit.
The metadata Map uses MongoDB's Mixed type. Unknown keys survive serialization and deserialization. An extension that isn't installed on the receiving land still has its metadata preserved. When that extension is installed later, the data is already there.
A user on Land A navigates to a tree on Land B. They write a note. The note is sent to Land B via Canopy. Land B creates a ghost user record (username + home land URL) and stores the contribution. The real user data stays on Land A.
The kernel's guarantee. No configuration can prevent a cascade signal from arriving at a land. The signal is always accepted. Always produces a result in .flow. Extensions decide what to do with it. But the kernel always lets it in.
User data never leaves your land unless you send it.
Email is a protocol. Gmail is a product built on it. You can run your own email server or use someone else's. The protocol connects them all. The seed is the protocol. treeos.ai is one land running it. Anyone can run their own.
Git is distributed. Every clone is a full copy. GitHub is a hosted service that adds collaboration on top. The seed works the same way. Every land is a complete system. The directory adds discovery. The protocol adds connection. But each land stands alone.
Trees live on your server. Your MongoDB. Your filesystem. Nobody can read your private trees, delete your data, or change your access. You decide what's public. You decide who peers with you. Full sovereignty.
If the directory goes down, your land keeps running. If a peer goes offline, your trees are unaffected. The network is resilient because each node is independent. There is no single point of failure.
Every extension published to the registry makes every land on the network more capable. Every public tree adds knowledge that any agent can access. The more people participate, the more powerful the network becomes. Not through centralization. Through contribution.
Run your own land. Connect to others. Share what you build.
Built to be unstoppable.
Open source. AGPL-3.0. No kill switch. No terms of service that revoke access. The protocol is public. The code is public. The network belongs to everyone who runs it.