OpenWOP — Open Workflow Orchestration Protocol
OpenWOP is an open, wire-level protocol for multi-agent workflow orchestration. It defines how AI agents, deterministic tools, sub-workflows and human reviewers take turns inside one durable, suspendable, replayable run, and how independent hosts (workflow engines, SDKs, debuggers, agent runtimes) interoperate over the same contract.
Start here
New to OpenWOP? Watch the one-and-a-half-minute film, then pick one:
- Try it, no sign-up: app.openwop.dev, the reference app (privacy).
- Run it on your own computer: the quickstart starts a small practice host in a few minutes.
- Build a host: start with
docs/IMPLEMENT-CORE.md, not with the whole corpus. We are looking for the first independent implementation; open an issue if you are trying one.
- See every repository: the SDKs, CLI, examples, packs and white-label app are listed at github.com/openwop.
More: every film · the paper (Zenodo, CC BY 4.0; evidence in openwop/openwop-paper) · openwop.dev
Status
The protocol is at major 2. spec/v2/core/ is the normative tree: thirty Stable documents under a kernel word budget, with optional extensions in spec/v2/ext/ and one declaration file, spec/v2/declaration.json. The corpus version is in spec/v2/release.json.
v1 has reached end of support (RFC 0234). The v1 tree is frozen at spec/v1/ for clients that still speak it; new work targets v2. Migration: docs/migration/v1-to-v2.md.
RFC status (248 RFCs excluding template): RFCs that are Accepted (245), that are Active (1 — RFC 0121), and that are Draft (1 — RFC 0038 Parked). Per-RFC detail: docs/PROTOCOL-STATUS.md.
What the protocol does not yet prove is listed in docs/KNOWN-LIMITS.md.
Install
Published artifacts. Protocol contract, 2.x line: @openwop/openwop-conformance (npm, v2.46.34) with its exact-pinned contract peer @openwop/spec-artifacts (v2.46.34), both published from this repo on the corpus tag. Client SDKs, 2.x line: @openwop/openwop (npm, v2.7.0) · openwop-client (PyPI, v2.7.0) · github.com/openwop/openwop-sdks/go/v2 (Go modules; tag go/v2.7.0). The three SDKs ship from openwop/openwop-sdks at feature parity, and the conformance suite versions independently (currently v2.46.34). The 1.x SDK line (github.com/openwop/openwop-sdks/go (Go modules, v1.7.0), @openwop/openwop@1, openwop-client<2) remains installable for v1 clients.
Measure a host with the suite:
npm install --legacy-peer-deps @openwop/openwop-conformance @openwop/spec-artifacts
OPENWOP_BASE_URL=https://your-host.example npx openwop-conformance --target-major 2
What OpenWOP gives you
| Concern | Guarantee | Spec |
|---|
| Durable suspend and resume | A human-gated or long-running step does not pin a process; the run persists and resumes against the same state. | interrupt.md, persistence.md |
| Replay and fork | Any point in a run's event log can be forked into a new run, in replay or branch mode. | replay.md |
| Versioning | Hosts and clients negotiate the protocol version, and a deploy never breaks an in-flight run. | versioning.md |
| Events and streaming | One closed event envelope, delivered by SSE (with stream modes), long-poll and webhooks. | events.md, webhooks.md |
| Human in the loop | One interrupt shape for approval, clarification, refinement and cancellation. | interrupt.md |
| Idempotency | HTTP Idempotency-Key for retries and an engine invocation id for replays. | idempotency.md |
|
OpenWOP does not standardize the model call, the orchestration topology inside a node graph, the tool-exposure protocol (that is MCP) or cross-process agent messaging (that is A2A).
Security and conformance
SECURITY surface: 226 invariants in SECURITY/invariants.yaml — 189 protocol-tier (verified at the spec gate; every one has at least one public test in conformance/src/scenarios/), 35 reference-impl-tier (verified by reference impls' CI), 2 advisory.
The conformance suite decides compliance mechanically and signs a certification bundle per host. Each host's measured results are in INTEROP-MATRIX.md. To report a vulnerability, see SECURITY.md.
Document index
The v2 core corpus. Each document is the normative home of the capability families it names; spec/v2/README.md explains the layout.
| Document | Covers |
|---|
overview.md | Axioms, reading order, retiring a surface, v1 end of support |
versioning.md | Major negotiation, OpenWOP-Version, release identity |
capabilities.md | The discovery document and the capability record |
identity.md | Subjects, auth lanes, id grammars, resume tokens |
runs.md | Create, read, list, cancel and fork runs; run limits and residency |
events.md | The event envelope, SSE, poll, envelopes, host events |
errors.md | The error envelope and code registry |
headers.md | OpenWOP-* headers |
interrupt.md | Interrupt kinds, resume values, re-entry |
|
Total: 30 docs.
Machine-readable artifacts: schemas/v2/, api/v2/openapi.yaml, api/v2/asyncapi.yaml and api/seams-v2.yaml.
Quickstart
QUICKSTART-10MIN.md: boot the v2 reference host and run a workflow over curl, an SDK and SSE.QUICKSTART.md: the full v2 walkthrough against any host: discovery, auth, runs, streaming, webhooks, fork and replay, packs, conformance.- Guides:
docs/IMPLEMENTER-PATH.md (from zero to a published certification), docs/PRODUCTION-RUNBOOK.md, docs/SECURITY-OPERATOR-GUIDE.md, docs/PACK-AUTHOR-QUICKSTART.md.
Repositories
This repository holds the protocol contract: the spec, schemas, OpenAPI and AsyncAPI documents, RFCs, SECURITY invariants and the conformance suite. Everything built on it lives in sibling repositories:
Contributing and governance
Report a spec problem as a GitHub issue labelled openwop-spec, naming the document, the section and the requirement.
License
Apache-2.0. See LICENSE.
