Zerops Mate

A control surface for coding agents that live inside Zerops containers.

A hard fork of T3 Code (MIT), frozen at upstream commit f94a0d646ed78a4788e4af6417f74202a628a5e9 (tag upstream-base-2026-08-28) — no further git merge/rebase upstream/main. Upstream's own README is kept unmodified at docs/upstream-README.md; their LICENSE and copyright notice are untouched, as MIT requires. What continues past the freeze, and how: see "Where to read next" below.

The idea in one paragraph

Every Zerops project already runs a zcp container: Ubuntu, a shell, the project's code, and Claude Code + Codex already installed and authorized. So the Zerops Mate server runs inside that container. The separately hosted web client lets a user sign in with their own Zerops account and connect to the container without a pairing code or shared container secret. The agent sits next to the code — file operations are local, work survives closing your laptop — and it already has the platform in its hands: the zerops_* MCP tools (deploy, logs, import, scale, env, subdomain…) that make this different from a generic agent GUI.

  hosted web client                          zcp container (one per Zerops project)
 ┌──────────────────────────┐                ┌─────────────────────────────────────┐
 │  threads, approvals,      │◄──────────────►│  Mate server, proxied at /mate/     │
 │  diffs, terminal          │                │  spawns `claude` / `codex` and uses │
 │  Zerops sign-in           │                │  zcp MCP tools; /var/www, git, term │
 └──────────────────────────┘                └─────────────────────────────────────┘

What runs where

• Sign-in is a Zerops identity, not a pairing code. The door checks project membership and mints a session; there is no code to copy and no secret shared out of band. Design: zeropsio/zcp:docs/spec-mate.md §3.
• zcp tracks the latest stable GitHub release, checks compatibility before installation, and supervises the server as zerops@mate. Nginx proxies the server API and WebSocket at /mate/; the web client is hosted separately at https://mate.zerops.io. Delivery: zeropsio/zcp:docs/spec-mate.md §2.
• The agent's leverage is the zerops_* MCP toolset already wired into the container. That toolset lives in zcp, not here — Zerops Mate is the client and the harness around it.

Releases

Releases are published on GitHub. Each carries the zerops-mate server tarball and its SHA256SUMS. Installing the tarball links the executable as mate.

Nothing is published to npm under the zerops-mate name. Zerops users do not install the tarball themselves because zcp owns the installation. The fork does not currently publish desktop or mobile clients; package-manager builds with the upstream T3 Code name are not Zerops Mate releases.

What is Zerops-specific here

Most of this repo is upstream T3 Code, either imported byte-identical (the wire-protocol packages) or ported behind our own interface (the provider drivers). The parts that are ours alone: apps/server/src/zerops/** and apps/web/src/zerops/**. The full zone map — what's imported, ported, owned, or deleted, and why — is docs/internals/zerops/fork.md §3–§4.

Where to read next

• docs/engineering-rules.md — the rules every change follows, shared with zcp and HQ.
• AGENTS.md — the knowledge map: where design, rules, measured facts, and tests each live.
• docs/internals/zerops/fork.md — the fork rules: the hard-fork decision, the zones, what was kept and what was deleted, how work gets done, upstream intake.
• zeropsio/zcp:docs/spec-mate.md — the design spec: the envelope on the wire, delivery, the door, client flow, the Zerops-aware client, git.
• docs/internals/zerops/verified.md — measured platform assumptions; intake.md covers upstream intake.
• Private zeropsio/mate-hq:docs/architecture/README.md — conceptual architecture. Public product contracts in this repository and the zcp spec remain self-contained.

Delivering a dev build

Not a release: docs/operations/release-and-deploy.md, "Unreleased server build in a running container".