We are not building another cloud SaaS orchestration tool. We are building a decentralized nervous system for your personal AI. We call this architecture the Suzent Mesh.

At the core of this matrix is the Node System.

Escaping the Sandbox: What are Nodes?​

In the Suzent paradigm, your primary agent is the "Mind," and Nodes act as its sensory organs and actuators scattered across your network.

Inspired by OpenClaw's distributed control philosophy, the Node system shatters the traditional local-sandbox limit. It allows your agent to seamlessly reach across the network to execute commands, read environments, or borrow compute power from other devices you own.

Currently, the Mesh is forging a unified cluster out of your primary workstations:

• Peer PC/Mac/Linux Rigs: Link your devices so the agent can traverse them. Your lightweight laptop agent can seamlessly read files from your home server, trigger heavy bash scripts on your Linux rig, or deploy a localized agent instance on a remote desktop.
• (The Horizon) Mobile & IoT Endpoints: Soon, the Mesh will extend to smartphones and ambient devices, transforming them into remote eyes and ears (camera.snap, location.get) for your sovereign agent.

The Architecture: A Hub-and-Spoke Matrix​

At its foundation, the Mesh operates on a low-latency, WebSocket-based JSON-RPC protocol.

1. The Core (NodeManager): Your primary Suzent Server acts as the central dispatcher.
2. The Synapses (Nodes): Devices establish secure WebSocket tunnels (ws://<host>:<port>/ws/node) to the core.
3. The Handshake: Upon linking, a node declares its identity, platform, and a strict manifest of capabilities (commands it authorizes the core to invoke).
4. Invocation: When your agent decides an action must happen elsewhere, the NodeManager dispatches the command matrix to the target node, executing it natively on the remote hardware.

Zero-Trust Sovereign Boundaries​

Power requires absolute control. Permitting an AI to execute code across your network demands a paranoid, scope-gated security model. We do not route your telemetry through corporate cloud relays.

• Loopback Trust: The local app (127.0.0.1) operates with native authority.
• Node Scope (node): Gained via a physical operator-approved pairing ritual. It grants WebSocket presence but zero HTTP access.
• Agent Scope (agent): The "Control Grant." This permits a remote peer only to trigger an isolated /chat session on the target device.
• Full Scope (full): A heavily guarded, revocable host token minted exclusively for total remote API operation.

Peer Control: Machine Telepathy​

For devices running full Suzent environments, the Mesh unlocks something profound: Peer Control.

Instead of treating a remote PC as a dumb terminal, Suzent treats it as a peer intelligence. You can grant one device permission to drive the agent of another.

• Local Discovery: Suzent actively sweeps your domain via mDNS (LAN) and Tailscale (cross-network) to find dormant peer nodes.
• The Grant: You issue a cryptographic control-grant. The target operator approves, forging a durable, secure link.
• The Trigger: Your local agent can now stream prompts, context, and even file attachments to the remote agent.

The Result: You are working on a thin ultrabook in a coffee shop. You ask your Suzent agent to analyze a massive local dataset. Recognizing its limits, your local agent delegates the task to the Suzent agent running on your water-cooled workstation at home, streaming the analytical thoughts and results back to your laptop in real-time.

Speaking A2A: The Open Door​

Peer Control is powerful, but on its own it is a closed federation — Suzent talking to Suzent. A sovereign network whose only citizens are copies of itself is not sovereign. It is just a smaller walled garden.

So the Mesh also speaks A2A (Agent2Agent) — the open agent-interoperability standard now governed by the Linux Foundation. Not a Suzent dialect. The actual protocol, JSON-RPC over HTTP, verified in our test suite against the reference SDK client.

This is a deliberate division of labor, and it mirrors how MCP and A2A divide the world:

Nodes are deliberately not being folded into A2A. A node publishes exactly what it can do (camera.snap, system.script); A2A's entire premise is opaque execution, where you delegate a goal and never see inside. Those are different contracts, and collapsing them would destroy the manifest that makes nodes useful.

Discovery Is Ours; Reach Is Theirs​

A2A defines four ways to find an agent: a well-known URL, a curated registry, direct configuration, and an authenticated extended card. Notably, there is no global public directory of A2A agents, and the spec contains no LAN discovery at all.

That is precisely where the Mesh earns its keep. Suzent finds peers on your own network with zero configuration, via mDNS and Tailscale — something the standard cannot do. A2A then gives those findings somewhere to go beyond your own hardware.

• Your card: Each device can publish an Agent Card at /.well-known/agent-card.json — its name, its OS environment, its skills, and how to authenticate. It is off by default. Publishing announces that you exist; it authorizes nothing. Execution still requires a grant you approved by hand.
• Their card: Paste any A2A agent's URL. Suzent fetches the card, confirms it is real, and adds it to the Mesh next to your own devices.

Tasks That Can Ask You Questions​

Real delegation is not fire-and-forget, and this is where the open standard bought us something our own protocol could not express.

A2A models work as a task with a genuine lifecycle: submitted → working → completed, but also failed, canceled, and the interesting one — input-required. A remote agent that hits an ambiguity can stop and ask, and the task waits.

legal-review · input-required "Which jurisdiction should I assume?"

Your Mesh shows that question, you answer it inline, and the same task resumes — because the reply carries the task's ID. A one-shot "send a message, stream a reply" channel simply has nowhere to put that pause. Every delegated task is visible in the Mesh with its live state, and can be refreshed or canceled mid-flight.

The Result: the coffee-shop scenario, but the workstation at home is no longer the only possible destination. Your agent can hand the statistical modeling to a specialist agent that a colleague runs, receive a clarifying question back, answer it, and stream the result home — without either side having ever heard of the other's framework.

Tap into the Mesh​

The Mesh is already active in the CLI. You can view your network matrix and trigger remote executions immediately:

# Scan your sovereign network
suzent node list

# Inspect a node's declared capabilities
suzent node describe "Home-Server-Alpha"

# Command the remote node
suzent node invoke "Home-Server-Alpha" system.script run="deploy.sh"

Any A2A client can reach a device that has published its card:

# Read a Suzent device's Agent Card — the standard discovery path
curl https://your-device:25314/.well-known/agent-card.json

You can inspect and drive the open half of the Mesh from the Mesh tab in Settings: your own Agent Card and its publish switch, every Suzent peer and external A2A agent side by side, and the live state of every task in flight — in either direction.

The Sovereignty Continues​

The Suzent Mesh is the death of the isolated terminal. Nodes give your agent hands across your own hardware; A2A gives it a voice among agents you did not build.

Sovereignty was never about isolation. A system that can only talk to itself has not escaped the cage — it has just decorated one. Real sovereignty is owning your side of an open protocol: your keys, your hardware, your rules, and no vendor's permission needed to speak to anyone.

As we extend the Mesh to mobile endpoints and deepen our A2A support, your personal AI will cease to be just an app on your screen. It will become a unified, ambient intelligence that surrounds you—entirely owned by you, serving only your laws, and able to negotiate with the wider world on equal terms.