OpenWOP — The OpenWOP protocol

Everything that makes OpenWOP a standard — the wire contract, the evolution process, the security posture, and the project that maintains them — lives in one of six surfaces below. This page exists so a reviewer can find the surface they need without digging through the index.

Specification

The normative wire contract. v2 was cut 2026-09-05 and is the current major; v1.x continues as a parallel track, receiving additive and safety-fix releases until the host-inventory rule in COMPATIBILITY.md §5 retires it.

v2 spec corpus → — 37 prose documents: 20 normative core docs plus 17 extension families advertised under extensions.<org>.<key>.
REST API reference → — every endpoint with request, response, and error envelope, rendered from api/openapi.yaml.
Profiles → — v2 keeps the profile set deliberately small: openwop-discovery-core, openwop-core-standard, and the openwop-conformance-seams-v2 test-seam profile. Everything else a host can claim is a capability key in the capability record — secrets, nodePackRuntimes, interrupt, production, runList and the rest — advertised individually rather than bundled into more profiles.

Comparisons and positioning

Where OpenWOP sits relative to adjacent agent protocols.

A2A vs MCP vs OpenWOP → — a specification-level comparison of agent-to-agent collaboration, tool/context integration, and durable workflow orchestration.
Tool calling → — what tool calling standardizes, and the four surfaces OpenWOP adds on top of it: catalog, durable invocation events, fail-closed authorization, and effect idempotency.
OpenExO 3.0 and OpenWOP → — an architecture thesis for using OpenWOP as the durable execution protocol beneath OpenExO 3.0, the Intelligence Stack, REWRITE, and Edge Twins.
Overview & axioms → — the six axioms, the claim vocabulary, and the rule deciding what is core and what is an extension.

Conformance

How a host proves it implements the spec.

Conformance leaderboard → — live record of which hosts pass which scenarios, sourced from INTEROP-MATRIX.md.
Conformance suite → — @openwop/openwop-conformance, the npm-published behavioural test suite that gates every leaderboard row.
Error codes → — the canonical error vocabulary every conforming host emits.

RFCs

How the protocol evolves.

RFC index → — every RFC, status, and target version. each major stays additive-only per COMPATIBILITY.md.
RFC process → — what counts as Draft / Active / Accepted, the comment-window discipline, and the path to a v2 working group.

Governance

Who decides what gets in, and how.

Governance → — decision rules, role definitions, the bootstrap-phase amendment, and the cross-vendor working-group charter for v2.
Maintainers → — current maintainer set, recruitment criteria, and the affiliation policy that drives the vendor-neutral-org migration tripwire.
Contributing → — per-artifact change rules (editorial / additive / safety-fix / breaking), the eight-step CI gate, the DCO requirement.

Security

What's promised, what's threat-modelled, and how to report a vulnerability.

Security posture → — threat model, disclosure policy, public invariants (CTI-1, SR-1, MCP-1).
GitHub Security Advisories → — coordinated disclosure channel for vulnerabilities.

Versioning and roadmap

What's stable, what's planned, what's tracked but not committed.

Versioning policy → — additive within a major, the 90-day safety-fix window, breaking changes only in major versions.
Changelog → — every spec, schema, SDK, and reference-host change with its compatibility classification.
Roadmap → — gap-closure tracks the steward maintains in the open. No dates beyond what has a CHANGELOG.md entry.