The public ledger.

emem.dev is the open, free Earth memory commons. A signed, content‑addressed spatial memory where every place‑time resolves to a verifiable fact, read over MCP or REST, no keys, no account. geo.qa is built on it, speaks it, and extends it.

Explore emem.dev →Read the protocol

46 · source schemes

81 · MCP tools

Apache‑2.0 · no keys

Plate i · the open latticecommons · 1:∞

Fig. i. One open grid covers the whole planet. Anyone can resolve a cell, read the fact filed against it, and check the signature without asking permission.

Chapter I

An open memory of the Earth.

emem.dev fuses open Earth observation into one addressable record. Every place‑time resolves to a fact, every fact ships a receipt, and you read it over the same MCP an agent already speaks.

Most spatial data lives behind a tile server or an API key, and what comes back is pixels, not answers. emem.dev inverts that. It treats the planet as a memory: a grid of stable cell64 addresses, and against each one a stack of dated, ed25519‑signed facts an agent reads and quotes directly.

Forty‑six open source schemes feed it. Sentinel‑2 every five days at ten metres, Sentinel‑1 radar through cloud, MODIS greenness on an eight‑day beat, ERA5 weather daily, Hansen forest loss once a year. One hundred and sixty composition algorithms turn those measurements into named bands. The result is a single record you query by place and time, not by file.

You read it over MCP, the same tool protocol your model already uses, or plain REST. No keys for the public commons. And because every answer is signed, you do not have to trust the server that served it. You check the math yourself, offline.

# resolve a place over MCP, no key emem_locate lat=1.290 lon=103.851 → cell 0xab1f0b27a4d… (cell64) # ask the open memory a question emem_ndvi cell=0xab1f0b27a4d… since=-30d → ndvi = 0.71 mean over 5 observations indices.ndvi · MODIS · Sentinel-2 ◇ receipt cid base32 · ed25519 signed

Spec. 1. A public read: locate a cell, ask for a band, get a fact and a receipt. Nothing here required a login.

Open source	Writes into the memory	Resolution	Cadence
Sentinel-2 L2A	multispectral surface, indices	10 m	~5 day
Sentinel-1 SAR	all-weather radar, structure, moisture	10 m	6–12 day
MODIS NDVI	vegetation greenness	250 m	8 day
ERA5	temperature, wind, precipitation	0.25°	daily
Hansen GFC	forest loss year, cover	30 m	annual
JRC surface water	water occurrence, recurrence	30 m	monthly
Met.no	near-term weather fields	station	hourly
FIRMS	active fire detections	375 m	daily
CAMS	air quality, aerosols	~40 km	daily
SoilGrids	soil properties	250 m	static
Overture	building footprints, places	vector	on release

Tab. 1. A sample of the 46 open schemes. Each is composed into named bands and filed against the grid, dated and signed.

Chapter II

cell64, the open address.

The commons names every place with a 64‑bit integer: cell64, a patch about 9.55 m on a side at the equator, the width of one Sentinel pixel. It is the open base. geo.qa adds H3‑resolved addressing on top.

cell64×band×tslot→Fact

cell64Where. A 64‑bit integer over an equirectangular quantization: 21 latitude bits, 22 longitude bits. About 9.55 m wide at the equator, taller‑than‑wide above ~30°. Not a hex grid, not H3.

bandWhat. A named measurement slot. indices.ndvi, weather.temperature_2m, hansen.loss_year. 124 wired, 42 callable by name.

tslotWhen. A temporal slot: unix seconds divided into tiers from static to hourly. Reads are bi‑temporal; history is append‑only.

factThe answer. Primary (measured), derivative (delta, mean, trend, rate, anomaly), or a negative fact: a signed absence with a reason. No silent fallbacks, so “not queried” never reads as “nothing here.”

receiptThe proof. Canonical CBOR → BLAKE3 hash → ed25519 signature. Verify offline against the key at /.well-known/emem.json.

cell64 is deliberately simple: a flat integer anyone can compute in a few lines, on a grid that lines up with the Sentinel pixel pitch. That is the open base. On top of it, geo.qa resolves the same places through H3, so a private tenancy can address neighbourhoods, roll a city up one resolution, and join across scales. It still emits receipts in the open format, so public and private cite the same way.

Plate ii · one cell, decomposedband × tslot

Fig. ii. A single cell64 address holds many bands across many tslots. Resolving one returns a fact and the receipt that signs it.

factndvi = 0.71

cell640xab1f0b27a4dffff

tslot2026-05-04 … 2026-06-01

bandindices.ndvi · mean

hashblake3 · cid base32 (26 ch)

ed25519 signed · canonical CBOR · emem.dev verifiable

Chapter III

Public flows in, private never flows out.

The open commons and your geo.qa tenancy run the same protocol. The proofs are identical down to the byte. What differs is the licence and the boundary, and the boundary only lets data in.

	Open · emem.dev	Your geo.qa tenancy
Licence	Apache-2.0, public	tenant-private, yours
Addressing	cell64 · 64-bit grid	H3-resolved, multi-res
Hash	BLAKE3	BLAKE3
Signature	ed25519	ed25519
Receipt	canonical CBOR	canonical CBOR
Offline verify	yes, against the public key	yes, against your key
Sources	open EO only	open EO + your fleet

The cryptography is the same on both sides: same hash, same signature scheme, same receipt encoding. So a single agent reads a public fact and a private one in one answer and proves both. The only asymmetry is direction. Open Earth observation flows into your tenancy, and nothing from your tenancy flows back out.

What flows in

the public commons, free to consume

◇Open EO. Every one of the 46 schemes, already composed into bands and signed.
◇The protocol. Same MCP tools, same REST shape, same receipt format.
◇Public proofs. Citeable from inside your boundary without a callback.

What never leaves

your tenancy, by construction

◇Your fleet. The facts your own sensors write stay in your memory.
◇Your keys. Writes are capability-bound under your attester pubkey.
◇Your models. Trained and served inside the boundary, airgapped.

Chapter IV

Free to cite.

A proof is only worth something if anyone can check it. On emem.dev anyone can, including people who never signed up. One content id resolves the same fact and the same signature on every machine that asks.

verify.py

# anyone can verify a receipt, offline, no account
import requests, emem

# 1. fetch the public key once
key = requests.get(
    "https://emem.dev/.well-known/emem.json",
).json()["pubkey"]

# 2. check the signature against the bytes, no callback
ok = emem.verify_receipt(receipt, key)
assert ok  # ed25519 over canonical-CBOR · BLAKE3

emem_locatea place → its cell64 address, no key required

emem_recallevery signed fact filed at a cell

emem_recall_polygonread a whole region in one public call

emem_verify_receiptcheck a signature offline, against the public key

emem_fetchresolve a fact by its content id

emem_memory_bundlea multi-fact signed envelope to cite as one

# two analysts, never met, citing the same ground emem_fetch cid=ememfact_3pq7r2k9w4x1m8h0a5z6 → hansen.loss_year = 2024 at 0xab1f0b27a4d… analyst A verify_receipt(fact) → ok analyst B verify_receipt(fact) → ok (same bytes, same proof) ◇ one fact · one receipt · no server in the middle

Spec. 2. A content id is enough. Two parties who never coordinated resolve the same fact and prove the same signature, each on their own machine.

Read the open ledger.

Resolve a cell, read the fact, check the signature. No login, no callback, no trust in the server that answered. geo.qa is the private upgrade that cites the same way.

Explore emem.dev →Read the protocol

geo.qa · a vortx ground decoder · emem.dev open protocol