What ships in the Zeq SDK

One surface for synchronized physics, deployable state machines, and a verifiable compute envelope. Everything on this page is live.

2026-07-31 (later) — The engine stopped guessing what a letter meant

U_g = mgh asked for gravitational potential energy with a mass and a gravity but no height used to return 1.325e-32 J. It bound h to Planck's constant and used it as the height. No warning, a well-formed answer, and a valid signature over a number nobody supplied.

That is the worst thing this system can do. Every other defect announces itself as a refusal or a NaN; this one announced itself as a correct-looking number, and the receipt would have verified perfectly.

It was not one operator. The first use of every ambiguous letter was a collision:

letter	first collision	was bound to
e	r_a = a(1+e) — orbital eccentricity	2.718
g	CS52 block time — a computer-science operator	9.81 m/s²
h	CS51 hits/(hits+misses) — a cache count	6.6e-34
R	L = 4πR²σT⁴ — stellar radius	8.314 J/(mol·K)
F	a = F/m — force	96485 C/mol

An ambiguous letter is now asked for, not assumed. The engine binds it only on positive, syntactic evidence: e raised to a power is Euler's number and can be nothing else; h beside a ν or a λ is Planck's constant. Everything else comes back as a missing input, with the reason stated — "these symbols determine the answer; supplying defaults would fabricate it." π, c, G, ħ, k_B, N_A, m_e and ε_0 are never mistaken for variables and are untouched.

The unit was wrong separately: mgh reported M²·L³·T⁻³ where gravitational PE is M·L²·T⁻². A right value with a wrong receipt is the more dangerous half, because a reader who trusts the label is misled by an answer that checks out. Both now come from one shared rule, so the value and its unit cannot disagree.

What it already signed: nothing. 106 operators were exposed to this. Across 14 nodes and 1,129 envelopes, none names any of them. The fix is forward-only.

Coverage went up — 594 to 595 of 894 (67%) — because asking for a symbol costs nothing once the caller supplies it. What it removes is the case where they didn't.

Alongside it, the parse-failure class went from 22 operators to 7, and 15 of those were never the parser's fault. A proportionality (I ∝ A²) omits its constant deliberately; returning A² would silently set it to 1. ⟹ is an entailment, not arithmetic. RSA's operands exceed double precision, so a floating-point residue would be confidently wrong. E = ħω, \quad p = ħk states two results and answering only the last discards the first. Each now says what it is instead of blaming the engine. The four that were real — a bare √, E^*, \frac{1}2, and a decimal inside a subscript — compute.

And \text{note} no longer becomes three variables named n, o and t.

2026-07-31 — Operators compute their own equations, and a sign error that had been hiding

515 of the 894 unserviced operators now return a value from the equation the registry publishes beside them, up from 212 at the start of the day. Ask for THRUST_TSIOLKOVSKY with I_sp, m_0 and m_f and you get the rocket equation — 6774.19 m/s, checkable against any textbook — because the operator never needed a bespoke solver, it needed its own equation read.

Every gain came from one systematic cause at a time, each found by counting rather than guessing:

Cause	Operators
LaTeX ordering — a pass that needed the backslash ran after one that ate it	~200
Unicode: physics is not always written in LaTeX (8πG/c⁴ T_μν)	36
Juxtaposition across whitespace (γ m c²)	72
\b is the wrong boundary for a command name (\mu_0)	45
Indexed sums Σ, expanded from your numbered inputs	—

New input conventions. A Σ expands from what you supply: Σ p_i ln p_i over three states is p_1, p_2, p_3, and the range is taken from the indices present — Shannon entropy of two equiprobable states returns ln 2. An indefinite integral takes from and to. Bra-ket takes amplitudes: ⟨ψ|φ⟩, ⟨ψ|O|ψ⟩ and the Born rule all resolve from psi_1, psi_2, … and O_11, O_12, …. Definite integrals get real quadrature — ∫₀^∞ x⁶e⁻ˣdx returns 720, which is Γ(7).

Units are derived, never asserted. They come from propagating SI dimensions through the arithmetic, so a moment of inertia comes out M·L² and a centre-of-mass velocity L·T⁻¹ without anyone writing that down. When a symbol carries no known dimension the unit is withheld and the symbol named, rather than guessed — a wrong unit on a verifiable receipt is worse than no unit.

A relation is not an assignment. Δx·Δp ≥ ħ/2 states a bound; returning ħ/2 would assert the product equals it. Inequalities, ≈, limits, asymptotic bounds (O(n log n) is a growth rate), transfer functions, density matrices and state vectors now each refuse as what they are, instead of sharing a message that pointed at the parser. An envelope carries one number, and a density matrix is not one.

The sign error

-x² was being evaluated as (-x)². Unary minus bound tighter than exponentiation, so e^(-x²) computed e^(+x²) — every equation containing -x^n was affected. It survived roughly 1,700 passing tests and was caught the moment one integral was held against a closed form: ∫e^(-x²) returned 1.47e10 where √π was expected.

No envelope attests a value affected by it. Three of 1,612 equations carry the pattern; none was ever served by the generic evaluator; and across all 14 nodes and 1,103 envelopes the only match predates the evaluator by twelve days. That check is now a tool — infra/envelope-exposure.sh — because when a fault is found the question is not "is it fixed" but "what has it already signed".

Nodes now seal what they hold

Each node appends a signed digest to its hash-linked spine every cadence: how many envelopes it holds, a hash over which operators they name, and the registry generation it is serving. Counts you can check against the node's own live answer, on a chain it cannot quietly rewrite.

---

2026-07-30 — Claim your monthly credits, from wherever you already are (Chrome 1.287.55)

Every machine now carries a monthly grant of 128 ZEQ. It is not given — it is claimed, and claiming costs a small proof-of-work priced in the Landauer operator (LZ1 = k_B·T·ln2 × bits). An honest claim takes about a second.

The claim is reachable from every surface you might be standing in:

Surface	Where
Vault	Machines tab, per machine
Credits wallet	/vault/credits/ → Account
Chrome extension	Machine tab → Credits
VS Code	Zeq: Wallet opens the credits wallet

Why a claim and not an automatic top-up. Registration takes two client-generated values and nothing else — no email, no payment — so an identity is free to manufacture. Anything of value hanging directly off a signup is therefore free to farm. Hanging it off a claim means the grant costs something, and the database enforces one claim per machine per calendar month: proof-of-work sets the price, the unique constraint sets the limit. Unclaimed months do not accrue.

Signing up is still free and instant. The first three accounts from an address cost nothing; only the fourth within an hour is priced. Work tuned for compiled code is roughly 90× heavier in a browser, so charging every signup would tax the newcomer and barely inconvenience anyone farming — a household, an office or a classroom passes straight through.

Also in this build: /api/solve and /api/multibody now accept position and referenceMode: "gravity", so real gravitational problems can be expressed over HTTP; solver rejections return 400 with the solver's own message instead of a blank 500; and POST /api/zeq/reverify re-runs a numerical result and returns a signed verdict any stranger can verify with the public key from /api/identity — no account required. For signed closed-form claims, POST /api/attest remains the stricter path.

---

2026-07-28 — Build a shape, not a blank page

Every Zeq application is one of five shapes. Naming the shape decides the structure before a line is written, so that choice is now the first step of building — and the tools know all five.

zeq_scaffold takes an archetype alongside its stack:

zeq_scaffold { app: "my-app", archetype: "provable-record" }

archetype is the shape — the contracts and the triggers. stack is the technology. Naming a shape writes ARCHETYPE.md (what this shape is, what fires it, what lands on the chain, and what you must not build) plus a real contract seed under contracts/, and picks a sensible default stack. Passing stack alone behaves exactly as before.

The five: provable-record (an unforgeable record that X happened) · reproducible-computation (a calculation anyone can re-run and check) · deployable-logic (logic on a trigger leaving a checkable trail) · simulation (continuous integration with drift reported, not hidden) · interactive-agent (a live surface backed by verifiable state).

The same five are contract templates under the Archetypes category, so they are reachable from Zeq Studio's browser and /api/contracts/templates as well as the scaffold. One source, three doors.

An unknown archetype is refused with the near-miss, exactly like an unknown stack. Asking for provable_record tells you it meant provable-record instead of quietly building something else.

The reference architecture is published at /building-on-zeq/ and condensed into every project's ZEQ.md, so the model is the same whether you read it, ask the AI, or open the repo.

New tool — zeq_skills. The skills directory is now browsable: each skill names the physics domains it works in and the input quantities it expects, with units. Use it before pinning operators. Skills are capability templates; zeq_lib_search finds npm/pip packages — different shelves.

2026-07-25 — Two doors, named the same everywhere

Zeq Studio now says plainly which door you are in: Build it myself or Build it with AI. Same two labels, so the choice is visible before you start rather than implied by which page you happened to open.

The AI door is a door, not a requirement. Create, edit, add files, commit with a ZeqProof and deploy to a live URL — none of it touches AI. Templates and Expert in the contracts IDE are likewise AI-free.

2026-07-25 — Contracts inside Zeq Studio, without leaving your code

Studio now has a Contracts button that opens the real State Contracts IDE — SAVED · GENERATE · TEMPLATES · EXPERT, on your own machine — beside the editor instead of in another tab. Templates and Expert need no AI: that is the "build it myself" door, intact.

It is the same application, mounted, not a copy. A contracts panel written specially for Studio would have started drifting from the one everyone already uses immediately, so /apps/contract-ide/ runs in-surface with its own page chrome hidden — one nav, the real app, still perfectly usable standalone.

2026-07-25 — Deploy from VS Code too (extensions 1.287.53 / 1.287.54)

The Studio work closed the loop on the web and immediately left the editors behind, which is the exact drift the cross-surface rule exists to prevent. So Zeq: Deploy this workspace (live URL on your machine) is now a VS Code command: it syncs the folder first — deploying a repo that is behind your editor publishes yesterday's code and looks like a failed deploy — then publishes and offers the live URL and your Observer.

deployRepo() and liveUrl() went into the shared zeq-project-repo.js rather than into the extension, next to ensureRepo and mirrorFile, for the same reason those are there: web, Chrome and VS Code read one file, so they cannot drift on what deploying means or where a published app lands.

VS Code 1.287.53, Chrome 1.287.54, on all four download paths.

2026-07-25 — Zeq Studio: write code on a phone, commit it with a proof

Zeq Studio is a standalone application at /apps/zeq-studio/, listed in the Zeq Store, and the messenger channel mounts it rather than keeping a copy — the same mount-never-rebuild rule the channels follow.

One project, one repo. Creating a project used an endpoint that scaffolds under an org while every commit writes to your ZID account, so a project could exist as two repos of the same name and your edits never reached the scaffolded one. Create and edit now both go through the ZID-owned repo. You can also add files any time — nested paths included — each one a commit with its own ZeqProof.

The code box is now an editor on a phone. One pane at a time (Files / Code / Preview), 16px text so iOS stops zooming the page when you focus it, real horizontal scrolling with a wrap toggle, Tab to indent, Shift+Tab to outdent, Enter that keeps your indent, and autocorrect off — it is code, not prose.

A guard for a bug class that passes every syntax check. Studio rendered as raw text in production because a scaffold template held a whole HTML document in a string: the page server injects its script tags at the first closing body tag in the document, which was the one inside our own JavaScript. scripts/check-inline-scripts.js now fails the commit on that and on literal script open-tags in inline blocks — clean across 284 pages.

Deploy works now — the loop is closed. Write code, commit it with a ZeqProof, press Deploy, and your app is live at /s/<machine>/p/<app>/. No local tooling, on a phone if you want.

Deploy used to answer "no machine bound — sign in to bind, then push again". That advice was correct and impossible to follow: the bind only ever happened when you signed in at ai.zeq.me, so signing in where you actually were changed nothing. Binding is now part of deploying. Your machine key is minted against the machine you already own, from your own session — if you own none, it says so and stops rather than inventing one to make the request look like it worked.

2026-07-25 — The messenger is the ecosystem: every application, mounted, one surface

The rule that fixed it: mount, never rebuild. Hand-made channel panels were replaced by the applications that already exist, running in-surface. The pages are same-origin, so the frame hides the page's own chrome from inside (stripFrameChrome; pages can mark pure-navigation blocks data-embed-hide) — one menu, the real app, the framework untouched and every app still standalone.

• Compute Credits mounts /vault/credits/ — balance, envelopes, transfer, claims, swap, burn ratio, transparency. Not a summary of it: it.
• Contracts mounts /apps/contract-ide/ — Saved · Generate · Templates · Expert. Two of the four paths involve no AI; 316 templates across 45 categories deploy with none. State contracts are not an AI feature.
• State Observer mounts /state/?slug=<yours> — chain-valid rows, the time machine, live balance.
• ZEQ DNS mounts the vault's #names panel.
• Zeq Mail mounts /apps/mail/ — compose, folders, aliases, the user's @zeq.me address, beside their messages.
• The Ecosystem directory — one pinned channel, 35 applications in seven groups with a filter; a row runs the real app in-surface with back and reload. The whole ecosystem reachable without another sidebar row.
• The ID Card is a Zeq ID card — an identity face above the links builder: machine, live-page address (copies in place), .hz names, envelopes split movable / soulbound light proofs, tier, genesis Zeqond, and Verify on my entangled state jumping to the Observer channel in-app. Existing endpoints only. The builder itself is the live Settings node, moved, never cloned — cloning would double-bind ids; the move is restored on every exit path (the guard that skipped restoring on the builder's own channel destroyed the node on re-render — caught by using it, not by the syntax check).

Definition of done changed. A phase is done when it has been deployed, opened in the browser as a signed-in user, exercised, and screenshotted — structural checks alone shipped a channel that rendered a ZID and nothing else. Everything above was verified that way, including the mobile pass at 390×844.

2026-07-24 — Your machine, your observer: owner permissions, two AI contacts, and the framework as channels

A machine's owner is its owner. Permission checks keyed only on the state_machine_admins grants table and ignored the machine's own owner_zid. Any machine whose grant row was never seeded left the owner forbidden on their own machine — a 403 that blocked minting an API key, generating a contract and writing a page. Both gates (requireMinRole, canWrite) now treat the owner as satisfying any role; grants stay additive for everyone else.

Compute is unlimited for the Foundation. The physics waiver read only the Stripe plan string, so a Foundation account on the free plan was metered and — with an empty wallet — every compute failed. A purpose='master' owner is now unconditionally unlimited-physics, independent of plan, so no downgrade or expiry sweep can re-meter it. Read-only and fail-closed.

DeepSeek v4. DeepSeek retired deepseek-chat and deepseek-reasoner at 15:59 UTC on 2026-07-24 and the API now rejects them. Defaults move to deepseek-v4-flash (the direct successor) and deepseek-v4-pro, including the bridge's last-resort fallback — the one that fires exactly when model resolution is already struggling.

Two AI contacts, one process. The messenger AI is now Zeq Learn — compute and teach, no build — alongside a new Zeq Build, which carries the Workbench journey (5 SKILL → 6 PLAN → 7 BUILD) and ships applications start-to-finish onto the user's own ZID. Both reach the same 32-tool machine MCP as the LibreChat surface, so the two stay at parity by construction rather than by discipline. Learn is stripped of the mutating build tools. Replies render Markdown with copy/save code boxes, and Continue now appears only when the model actually hit its token cap.

The framework as channels. Each framework application is a chat: ID Card, Compute Credits, Contracts, State Observer, Builds, Store — grouped into collapsible categories with reorder and hide. They are built natively against the APIs, not iframed: /vault/credits/, /contracts/ and /apps/ each ship their own nav, so embedding them stacked a second menu inside the chat and dragged a desktop layout onto a phone. The exception is a user's own deployed app, which carries no framework chrome and so runs live in the surface, with the sandbox mirroring the grant the app is already served with (omitting allow-pointer-lock would silently break camera control in the sim-3d stack).

Every explorer link is yours. An audit found 54 bare /state/ links across 24 files — nav, footer, landing, auth, vault, apps — all opening the network observer. For a signed-in user that is the wrong destination everywhere. Link binding is now central (one pass on identity, a capture-phase click interceptor and a coalesced MutationObserver), keyed on the live href rather than a marker that went stale on re-render. The last two holdouts traced to the wizard's genesis ticker, which rewrote them back to bare /state/ on every tick.

Sign-in could not complete. The session-expired Continue built its return target from the current URL — correct on an app page, but on /auth/ it wrapped auth inside its own return, nesting one level deeper per click and never reaching the app. Fixed, with protocol-relative targets rejected. The fix then had to be reached: changing a file without bumping its ?v= leaves browsers on the cached copy for an hour, and the cache-bust chain only busts if every link in it is bumped.

The bridge is under version control again. The running zeq-bridge had diverged to 2,124 lines while the repo held 613: roughly 1,500 lines of live code — the repo/scaffold tool surface, provider routing, the zeq-auto resolver — existed only on the VPS disk, with no history and no rollback. Committed verbatim after scanning for credentials; all secrets remain process.env.

2026-07-20 — Zeq Mail: HTML email, local-first file transport, and an agent that mails you a page

HTML email, rendered safely. Inbound mail was losing its HTML at the door: the delivery agent took the text/plain part of a multipart/alternative message and stopped, so for essentially every newsletter and notification the HTML was discarded before it ever reached storage. Both parts are now kept (migration 0036, encrypted with the same scheme as the body).

• The reader renders HTML in an iframe whose sandbox omits both allow-scripts and allow-same-origin, loaded via srcdoc, with a restrictive CSP inside the document. That sandbox is the security guarantee; the sanitiser is a deliberate second layer.
• Remote images are blocked by default — a remote image in mail is a tracker that reports the open, the time and the IP. One tap to show them, and a per-sender always-allow.
• Cards render HTML too, scaled to the email's real 600px canvas so the card is a true thumbnail rather than a zoomed crop.
• Composing takes a pasted fragment or a full page, previews it through the same sandbox the recipient will use, and sends multipart/alternative with a plain-text part derived from the HTML when none was written.

Files are transported, not stored. Attachments now carry a 24-hour expiry. Recipients are registered on send and confirm receipt only after the bytes are written to their own device; once every recipient has confirmed, the server drops its copy. The TTL is the backstop for recipients who never collect, and it is enforced both by a sweeper and on read, so a stalled sweeper can never serve an expired byte.

zeq_mail_html — a new MCP tool. An agent builds an HTML email and delivers it to the caller's own inbox for review and forwarding. It takes no recipient parameter, deliberately: a model-driven tool that can email arbitrary addresses is a spam cannon one prompt-injection away from being someone else's.

Attachment bytes are encrypted at rest. Subjects, bodies, HTML and even attachment filenames were encrypted while the files themselves sat on disk in the clear — the label sealed and the document open. Blobs are now stored as independently-sealed frames (AES-256-GCM, deflate-before-encrypt, skipped when it would grow the data), which is what lets a chunked upload append at all. Download decrypts frame by frame, so a 1 GB attachment is never held in memory, and refuses to serve bytes that fail authentication. Files written before the change remain readable via a magic-header check, so nothing in flight broke across the deploy.

Security fix — mail was accepted for mailboxes that do not exist. Address resolution had a catch-all that returned any 4–64 character local part verbatim as the owner, so mail to made-up-name@zeq.me was stored against a mailbox nobody owns, unbounded, with no bounce to the sender. Format validation alone had the same hole for well-formed but non-existent identities. Delivery now requires a real identity row and fails closed on a lookup error.

2026-07-18 — real solvers everywhere, and a numerical fallback that says so

33 dedicated solvers, and no operator left inventing. This pass closed the gap between the 1,606-operator catalogue and the engine that answers for it.

• +80 new closed-form operators across 8 domains — condensed matter (Fermi–Dirac, σ = neμ, Hall, BCS gap/Tc, Josephson), astronomy (Kepler III, Schwarzschild mass, Hubble, redshift, L = 4πR²σT⁴), signal processing (SNR, Nyquist, windows), control theory (overshoot, rise/settling, gain/phase margin), network science, finance, computational + statistics (Amdahl, Shannon capacity, Fitts, Bayes, binomial, normal PDF), neuroscience, and cryptography. 264 operator IDs now compute a closed form; every value checked against textbook references and live via the public HTTP path.
• The ODE master-equation fallback. Where no closed form matches, solveGeneric now integrates the HULYAS master equation (RK4) and returns a real, deterministic value instead of a bare NaN — transparently disclosed with a NUMERICAL FALLBACK note so it is never mistaken for the operator's own physics. Dedicated closed forms are never overridden.
• 100% honesty net. A neutral audit of all 1,606 operators finds every one either computes a real value (closed form or ODE fallback) or names exactly what it needs (a series, a graph, a field, the right input) — or refuses an unknown operator ID. None fabricate.
• Docs corrected. The solvers and the honesty contract now describe the fallback and refusal behaviour; the coverage map reads 51 dedicated / 2 aliased / 11 generic / 1 mismatch. Stale counts (18 solvers, 1,576 operators) refreshed to 33 solvers / 1,606 operators across every page and served surface.

2026-07-17 — the machine stops inventing

Breaking, and deliberate. A missing required input used to be replaced by a silent default. GR37 with no mass returned 2970.4641 m — that is 2G·(2e30)/c² — with a valid zeqProof attached. The proof was not lying; it simply was not proof of what a reader assumes.

Now the machine refuses:

{ "value": null,
  "inputError": { "code": "MISSING_INPUT",
                  "message": "missing required input \"M\" (accepted: M, mass)",
                  "missing": "M", "accepts": "M, mass" } }

• 51 silent defaults removed across 19 solvers. Intent is now explicit at every read site (req / std / opt), so a signature is extractable rather than inferred.
• assumed — when a standard condition IS used (g, room temperature, 1 atm, electron mass), it is declared back to you. QM9 with only a velocity returns an electron's wavelength; now it says so.
• safe() no longer launders failures into zeros. A non-finite result used to return 0 J / 0 N / 0 Pa with a proof. A fabricated number invites doubt; a 0 reads as a measurement.
• Steps 4 and 5 of the envelope report degraded on a refusal instead of ok.

Migrating: value may be null — guard arithmetic on it. Check inputError first (it names the missing quantity and every alias). Check assumed — if it is present, the number rests on a condition you did not state. HTTP stays 200; a refusal is an answer about your question, not a failure of the machine.

See The honesty contract.

Also shipped

• POST /api/zeq/operator-spec (no key) — which inputs an operator takes: required / conditional / assumed / optional, with every alias. Call it instead of guessing a key name.
• POST /api/zeq/lib-search (no key) — 208 curated libraries across 44 categories, one merged catalogue. (The old panel copy said "71 across 16": wrong by ~3x, because a hardcoded count is a promise nobody keeps. Counts are now derived from the data.)
• GET /api/zeq/harness — what a node offers, and honestly what it does not.
• ZeqGit at zeqgit.zeq.me — one canonical host. /zeqgit/ also now resolves on every node (it was on 5 of 15). Scaffold returns the repo link beside the app URL; editing a file in the web editor redeploys in ~3 s, no button.
• Two conformance vectors corrected. OP-snell-glass and PP-cyclotron-e each certified a value computed from an input they never supplied. Both golden VALUES are unchanged — they were correct physics for the defaults; only the stated inputs were wrong. corpus_sha256 moves; registry_version does not. Nobody is re-certified.
• registry_drift on /api/zeq/conformance — a corpus stamped for a different registry is now flagged, not merely reported.

The kernel

The ZeqVM compute kernel runs on the HulyaPulse timebase (1.287 Hz, Zeqond period 0.777 s) with the KO42 metric tensioner applied to every computation and a ≤0.1% precision bound. Named operators return a signed ZeqProof envelope (operator sequence, master-sum, R(t), phase, Zeqond tick, proof, precision bound) that round-trips through zeq_verify.

The canonical ko42Modulation.ts lands the 1.287 Hz in computation three honest ways: gauge (exact time reparametrization, physics-preserving, gauge-invariant to float epsilon), drive (explicit Mathieu/Floquet — resonance at n·0.6435 Hz, μ=εω₀/4 measured to 96% of theory), and probe (a lock-in residual estimator). Parametric drive is wired opt-in into the nano-zeqond engine (driveEps, default 0). See The mathematics → KO42 and precision ladder.

Operators

A catalogue of 1,500+ operators across quantum mechanics, Newtonian mechanics, general relativity, computer science, and more, with 18 closed-form solvers for the core physics domains. Each operator page shows its formula and a runnable example.

The dimensional gate keys each solver to a sufficient input combo that determines its primary output: an insufficient subset returns 400 with the combo list in the message, so a query never answers from filled-in defaults. The gate mirrors the dispatch shortcuts verbatim ({n_e}→PLASMA; {d,θ}/{λ,θ}/{a,h,k,l}→CRYSTAL with a as the lattice constant [L]; ENV/GEO/SEIS→FD, CLIM/ATMOS→TD, exotic→SM, MS/ST/MT/CP/BP→STRUCT, CRYSTAL variants), so every domain runs VALIDATE.

State machines, contracts, and channels

Every account gets its own ZeqVM state machine bound to its ZID, with a hash-linked entangled-state audit log. The /api/state/* surface exposes a unique machine, an owner ZID, a genesis Zeqond, a hash-linked audit log, a 1:1-bound zsm_ API key, a viewer/operator/admin/owner role hierarchy, and public-or-private visibility with a public registry at /api/state/aggregate/list. Spin-up is one POST and auto-mints a default zsm_ admin key returned once.

Author state contracts — deployable JSON programs that run on triggers (every Zeqond, cron, on-event, on-aggregate, with dry-run and replay), each transition ZeqProof-anchored. Deploy from 316 built-in templates by templateId, no LLM key required; each is an operator-grounded 4-state monitor (nominal → watch → alert → resolved) with arithmetic guard conditions and a ZeqProof per transition. zeq_solve accepts strict: true (+ optional maxIterations, 1–40) to tighten the precision bound toward ≤0.1% and reports tuneStatus: "converged" or "timeout" truthfully.

Host live pages on your machine with state channels at /s/<machine>/p/<page>/. Every byte commit and every serve is hash-recorded on the entangled state under a strict sandbox CSP.

Concept pages: State machines, Contracts, Hosting.

Audit entangled state + PoHC

Every event lands in a hash-linked audit log that validates against itself at any time:

curl __ZEQ_BASE_URL__/api/state/:slug/pohc/validate

Each row commits the hash of the payload, never the bytes: the framework proves what was claimed at Zeqond N and you keep the bytes. To opt into server-side bytes, wrap the payload in a HITE-sealed envelope and the audit row carries transitionType: "sealed_event". The PoHC protocol surface (/api/protocol/pohc/*) exposes the 5-layer Proof of Harmonic Convergence: pulse-attestation, phase-agreement, hash-linkage, operator-coverage, and energy-record.

Nano-Zeqond engine

A local, pulse-locked compute that integrates a differential master equation at sub-zeqond resolution and prints a signed state every 0.777 s zeqond, with energy drift held inside KO42 ≤0.1% and reported live. Three interchangeable engines share one clock:

• Field ϕ (ZeqNanoEvolver) — the HULYAS master-equation core □ϕ = ∇²ϕ − μ²ϕ − λϕ³ as a differential field. Drift ≤0.026%.
• Molecular dynamics (ZeqMdEngine) — velocity-Verlet F=ma under Lennard-Jones + harmonic bonds, NVE; energy and momentum conserved, drift ≤0.064%, LJ verified to machine precision.
• GPU deep-nano (ZeqGpuField) — the master-equation field as a 2-D grid stepped in parallel on WebGL2: 9.4×10⁹ cell-updates/second, matching the CPU reference to float precision (3.3×10⁻⁷), drift 0.0077%, with automatic CPU fallback.

The evolver offers opt-in integrator: 'yoshida4' (4th-order symplectic composition — 501× lower truncation error at 1.4× cost, convergence order 4.00) and opt-in precision: 'dd' (double-double ≈106-bit state for long-horizon or chaotic research, 19.8× cost, agreeing with f64 at 3.5e-15 over 1000 steps). The energy record is Kahan-compensated in all modes. See State Contracts → Nano-Zeqond Engine.

Tally tokens

A receipt is minted on every successful contract transition — transferable, burnable, queryable. It is the framework's economy. The per-state-machine surface is /api/state/:slug/tally/* and the protocol-level surface is /api/tally/*. Every paid framework action calls chargeForCompute() atomically before doing work; compute consumes fuel and the Foundation is funded by envelope mints. See ZEQ economy.

bearer envelope

ZEQ envelope envelopes are portable bearer instruments. Any envelope can be exported to a PIN-locked .ZEQ file or a QR / NFC payload, moved fully offline, and redeemed on any domain — burn-on-origin / mint-on-destination keeps exactly one live copy (single-spend settled by the record).

• Vault (/vault/credits/) — per-envelope Download .ZEQ and QR / NFC, plus Upload / redeem and Paste QR / NFC, behind a masked-PIN modal. Envelopes are HiteCrypto-encrypted; a scanned code is useless without the PIN.
• Claim links (/claim) — the QR / NFC encodes a normal-looking URL with the envelope in the #fragment, so it scans like any link and opens a claim page — yet the envelope never reaches the server until redeemed. PIN-locked end-to-end.
• Unified mesh vault — signing in on any domain shows every envelope you own across the mesh, tagged by home state (Ed25519-signed peer fan-out).
• Web CLI — zeq.envelope.qr(ZT-…,PIN) and zeq.envelope.paste(zeqcoin:v2:…|link,PIN).

Clients

Hosted REST API, language SDK clients (TypeScript, Python, Go, Rust, Java, Ruby, Swift, Kotlin, C++, plus raw HTTP), a terminal CLI and native binary, an MCP server (connect any MCP-compatible AI, exposing the current 18-tool set as a thin stdio→/api/mcp bridge), and the Kernel Skill for LLM agents.

• Zeq for VS Code — a full ZeqVM client built around the Control Center dashboard: every capability is a clickable card, AI-optional. Deploy state contracts from templates or from a plain-English description (POST /api/contracts/generate), see the CKO envelope (operator chips with KO42 first, Master Sum, R(t), phase, Zeqond tick, ZeqProof, precisionBound gauge), browse the full operator registry and the skills packs, scaffold libraries into your folder via npm · pip · cargo · go, read the SDK in an in-editor browser tab, and watch the Live Observer tick every Zeqond. See Editor & Browser → Zeq for VS Code. Your open folder becomes its own ZeqGit repo, and Zeq: Sync workspace to ZeqGit mirrors it as ZeqProof-anchored commits.
• Zeq for Chrome — the browser side panel hosts the live Workbench, the ZeqGit dashboard, and the Observer in-panel (?embed=1), with the CKO envelope widget, compute-appends-to-chain, and page security checks. See Editor & Browser → Zeq for Chrome.

Both clients are listed in the App Store (Developer category) and have a dedicated Extensions install page. The MCP server is installable from the framework's own npm registry: npm config set @zeq:registry https://zeqsdk.com/registry && npm install -g @zeq/mcp, then run zeq-mcp. All three @zeq packages (sdk, mcp, audit-daemon) resolve from that registry on every fork.

MCP tools

zeq_spin_up provisions the caller's own ZeqVM state machine and mints a real, active free-tier zeq_ak_ key, returning the recovery equation and key once; it is authenticated with a demo key (POST /api/demo-key/mint, free, no signup). The demo-key mint is priced in entropy via LZ1 = k_B · T · ln(2) × bits_erased: the first demo key per IP/hour is free, each additional one demands an escalating proof-of-work (18 → 21 → 24 → 26 leading-zero bits), capped at 30/hour/IP. Contracts are tools too: zeq_contract_templates, zeq_contract_deploy (by templateId with no LLM key, or a full definition), zeq_contract_list / zeq_contract_get / zeq_contract_fire, and zeq_contract_generate. zeq_publish_page publishes a live HTML app to /s/<machine>/p/<page>/ and zeq_observer reads the entangled-state proof-of-computation feed. zeq_compute signs a ZeqProof (value + unit) and returns structuredContent with full verify inputs, so zeq_verify round-trips.

ZeqGit

A self-hosted git + PDF repository, ZeqGit, live at zeq.dev/zeqgit and listed in the Zeq Store.

• One account, one ZeqGit. Signing in to the framework auto-provisions your ZeqGit account via single sign-on — one ZID, no second login. The ZeqGit bridge validates the framework's v3 session token via POST /api/zeq-auth/verify-v3, accepting the token from the zeq_auth_token cookie, an Authorization: Bearer header, or ?token=. Guests hitting any /zeqgit/... page are redirected to the Zeq dashboard.
• Every project a repo, every file versioned. Projects create private repos through the bridge (commits authored as you via Sudo); the full Gitea UI lives at /zeqgit/<you>/<repo>. A single shared module, shared/zeq-project-repo.js, holds the naming/ID/endpoint logic and is vendored into both extensions, so every surface derives the same repo from the same input (repoName = slug(name) + "-" + id, a rename-proof content hash).
• PDFs viewable inline — the Zeq-branded ZeqReader (pdf.js) renders PDFs and docs in place; Git LFS for large binaries; permissions enforced by Gitea.
• Every commit anchored with a ZeqProof (HMAC-SHA256(operator | result | zeqond)) on a hash-linked sequence at 1.287 Hz, fed by a push webhook and exposed via /zeqgit-bridge/repo/activity.
• Secrets are server-side and locked down — no .env — and the service runs isolated in its own containers.

Identity & economy

One ZID = one account = one state machine. Every compute a user issues — wizard, prove, mail, message, playground, app dev, contract transition — is attributed to one of the user's two keys: the account zeq_ak_* for compute and the state-machine zsm_* for entangled-state writes. Public read endpoints remain reachable without auth when the machine is flagged is_public=true.

Bring-your-own-key (BYOK) covers 8 LLM providers (OpenAI, Anthropic, DeepSeek, Ollama, OpenRouter, Together, Groq, Fireworks) via /api/zeq/llm/credentials/*, account-scoped and AES-256-GCM-encrypted with ZEQ_FIELD_KEY, prefix-only after creation. The Transparency Oracle writes a per-Zeqond network supply snapshot (network_snapshots) and exposes /api/transparency/{now,history,breakdown,revenue} publicly. A ZEQ balance rides each machine, and a free demo key (POST /api/demo-key/mint) gives a no-signup first run.

Useful links

• Spin up your first state machine — start here.
• State machines concept — the noun, in detail.
• Contracts concept — operator-triggered state machines.
• Tally tokens concept — the receipt.
• Hosting — spin-up-as-webapp.
• Examples gallery — runnable patterns.
• API reference — every public route.

---

Middleware active. Kernel on the 1.287 Hz HulyaPulse. Awaiting next Zeqond.