ACP Agent Protocols

The ACP namespace collision

Protocol boundary map

Assign each protocol to the boundary it was designed to standardize. The durable architecture composes them rather than selecting one universal protocol.

Precise scope

The official protocol defines communication between code editors or IDEs and coding agents. Public implementations extend the pattern into CI, custom frontends, headless harnesses, and orchestration, but the coding/editor assumption remains the normative center. The architecture is MCP-friendly, UX-first, and based on a trusted editor–agent relationship. [S01][S02][S20][S22][S23]

Version and maturity model

ACP has independent release surfaces. Conflating them creates false compatibility assumptions.

Confirmed Active is a visibility and focus signal, not final approval. [S08]

Stable v1 lifecycle

Correct initialization shape

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": 1,
    "clientInfo": {
      "name": "enterprise-agent-workbench",
      "version": "1.0.0"
    },
    "clientCapabilities": {
      "fs": { "readTextFile": false, "writeTextFile": false },
      "terminal": false
    }
  }
}

Every omitted capability is unsupported. A client must not call optional methods merely because they exist in a newer schema or SDK. [S03]

Correct v1 prompt shape

{
  "jsonrpc": "2.0",
  "id": 12,
  "method": "session/prompt",
  "params": {
    "sessionId": "sess_abc123",
    "prompt": [
      { "type": "text", "text": "Audit the authentication middleware." }
    ]
  }
}

V1 does not accept a client-assigned message ID in this request. Message IDs, where present, are agent-generated update metadata. [S05]

Future v2 direction

V2 is an Active RFD collection. It consolidates lessons from additive v1 evolution and introduces breaking changes. Active indicates maintainer focus, not production stability. [S08][S09]

// Proposed v2 semantics
client → agent: session/prompt(...)
agent  → client: { "result": {} }   // accepted, not completed
agent  → client: session/update(user message with agent-owned ID)
agent  → client: session/update(state, tools, plans, messages...)
agent  → client: session/update(running | requires_action | idle)

Public cancellation and compaction failures show that the lifecycle redesign responds to concrete implementation pressure. [S10][S25][S26]

Remote ACP transport

The proposed standard remote transport is Active. It defines a shared /acp endpoint with Streamable HTTP and WebSocket profiles. Authentication remains orthogonal; connection and session headers are identifiers, not credentials. Hardening work remains. [S11]

transport:
  family: experimental-acp-http
  carrier: websocket
  endpoint: /acp
  framing: json-rpc
  authentication: oauth2
  token_binding: dpop
  origin_policy: explicit-allowlist
  session_affinity: required
  replay: unsupported
  revocation: gateway-enforced
  tested_profile: enterprise-acp-remote-0.3

Copilot also exposes a port mode, while Goose has local and remote ACP work. These do not automatically equal the proposed standard transport. [S20][S33][S40]

Implementation corpus

Findings that improve the architecture stance

client
× ACP adapter
× underlying runtime
× exact versions and build digests
× negotiated capabilities
× extension profile
× permission profile
× transport profile
× workspace and identity policy

Assumption audit

Canonical session model

interface CanonicalAgentSession {
  enterpriseSessionId: string;
  tenantId: string;
  principalId: string;
  workloadId?: string;

  acp: {
    connectionId: string;
    sessionId: string;
    wireVersion: 1;
    schemaVersion: string;
  };

  runtime: {
    adapterName: string;
    adapterVersion: string;
    adapterDigest: string;
    vendor: string;
    vendorSessionId?: string;
    vendorRuntimeVersion?: string;
  };

  profile: {
    compatibilityProfileId: string;
    extensionProfileId: string;
    permissionProfileId: string;
    transportProfileId: string;
  };

  workspaceGrantId: string;
  policyDecisionRootId: string;
  auditTraceId: string;
}

Ownership matrix

Security and control model

Permission decision chain

Example enterprise profile

profile: enterprise-acp-v1
profileVersion: 1.0.0
wireProtocol: 1

combination:
  client: enterprise-workbench@2.4.1
  adapter: codex-acp@pinned-digest
  runtime: codex@app-server-compatible-version
  transport: stdio-supervised
  permissionProfile: interactive-medium-risk
  extensionProfile: codex-profile-3

required:
  - initialize
  - session/new
  - session/prompt
  - session/cancel
  - session/update

conditionallyRequired:
  - session/list
  - session/resume
  - session/close
  - session/delete
  - usage_update
  - messageId

prohibited:
  - reusable secrets in ACP payloads
  - unbounded stdout messages
  - authorization from tool title
  - unregistered metadata authority
  - production v2 without a feature flag

releaseEvidence:
  conformanceReport: artifact://reports/acp/codex-profile-3
  sbom: artifact://sbom/codex-acp
  signature: required
  lastQualifiedAt: 2026-07-23

Declared versus verified

Required qualification suite

Process supervisor requirements

Retired Agent Communication Protocol

The BeeAI Agent Communication Protocol repository was archived on August 27, 2025 and states that the work is now part of A2A under the Linux Foundation. New agent-to-agent systems should target A2A. Use a migration adapter only for existing deployments. [S34][S35][S36]

Agentic Commerce Protocol

Agentic Commerce ACP is separately maintained by OpenAI and Stripe. It remains beta and uses complete date-versioned snapshots. The latest released snapshot is 2026-04-17, covering cart, feed, orders, authentication, and MCP. [S37]

AG-UI overlap

AG-UI is a general-purpose, bidirectional, event-based protocol for user-facing applications. It overlaps ACP at the broad “agent ↔ client” layer but is not coding-editor-specific. Use ACP for coding workbenches and AG-UI for general application frontends unless a bridge normalizes both. [S38]

When to prefer a native integration

Use a vendor-native interface when the ACP path removes or obscures security-critical hooks, precise tool identity, context-compaction evidence, provider telemetry, lifecycle controls, or new runtime features. Preserve both ACP and native adapters behind one canonical enterprise runtime interface.

interface EnterpriseAgentRuntime {
  initialize(context: IdentityAndPolicyContext): Promise<RuntimeCapabilities>;
  createSession(input: CreateSessionInput): Promise<CanonicalAgentSession>;
  prompt(sessionId: string, content: CanonicalContent[]): AsyncIterable<CanonicalAgentEvent>;
  cancel(sessionId: string, operationId?: string): Promise<CancelResult>;
  close(sessionId: string): Promise<CloseEvidence>;
}

class AcpRuntimeAdapter implements EnterpriseAgentRuntime { /* qualified ACP */ }
class NativeCodexAdapter implements EnterpriseAgentRuntime { /* native fidelity */ }
class NativeClaudeAdapter implements EnterpriseAgentRuntime { /* native fidelity */ }

Implementation roadmap

Success criteria

• Adding one qualified ACP agent does not require a client-specific integration.
• Every privileged action is attributable to principal, agent, adapter, tool, arguments, policy, approval, and execution evidence.
• Cancellation reaches a terminal state within a bounded period, including child-process cleanup.
• Cross-session and cross-tenant routing tests produce zero leakage.
• Provider usage reconciles with protocol telemetry within an explicit tolerance.
• Adapter upgrades can be rolled back without orphaning enterprise session records.
• Native integrations remain available when ACP cannot preserve required control or fidelity.

Update triggers

• A new ACP schema, SDK, Rust crate, or wire major.
• V2 or remote transport moves to Preview or Completed.
• Authentication, tool identity, proxy, MCP-over-ACP, or session RFD maturity changes.
• Governance moves to an independent foundation or decision authority changes.
• A major client or runtime changes ACP support.
• A2A, MCP, AG-UI, or Agentic Commerce ACP changes protocol boundaries.
• A security issue changes the recommended trust model.

Repeatable update workflow

Current watchlist

Methodology and limitations

This synthesis prioritizes official specifications, governance, releases, public source code, and official implementation documentation. Issue reports identify concrete failure modes. They do not establish prevalence and may describe resolved defects. No neutral conformance suite was executed against every implementation for this artifact. Some vendor runtime internals are not fully public. Version statements should be revalidated after the generated timestamp.