ARCP
Internet-Draft/Standards Track/v1.1
Agent Runtime Control Protocol

The durable envelope around long-running agent work.

ARCP is a transport-agnostic wire protocol for submitting, observing, and controlling long-running AI agent jobs — and nothing more.

01
What it is

ARCP defines the execution envelope around AI agent work: sessions, jobs, resumable event streams, capability-bounded leases, and delegation. It specifies how a job is submitted, how its events flow back, who is allowed to do what, and how the whole thing survives a dropped connection.

It is deliberately narrow. ARCP wraps the agent function — it does not implement the agent, expose its tools, or export its telemetry. Tool exposure is the concern of MCP. Telemetry export is the concern of OpenTelemetry. ARCP composes with them rather than absorbing them.

A job submitted over ARCP keeps running when the client disconnects, can be resumed or watched live from another machine, and cannot exceed the lease it was granted — a bound on what it may read, write, call, spend, and for how long.

ARCP · durable envelope
sessionjobevent streamlease
agent function
LLM SDK · reasoningMCP · tools
└─▶OpenTelemetry · telemetry export
02
Why it exists

Long-running agent jobs break the assumptions of a request/response API. They outlive the connection that started them, act with real spending and filesystem authority, and frequently need to be watched by more than one observer at once. ARCP exists to make that envelope explicit and enforceable at the wire level, so any client and any runtime can interoperate.

The protocol organizes every message under four concerns. Everything it specifies is in service of one of them.

Identity
Who is acting. Authenticated sessions and a per-job submitting principal.
Durability
Work survives disconnects. Sequenced events, resume after a drop, subscribe from elsewhere.
Authority
What an agent may do, bounded by capability, budget, and an expiring lease.
Observability
Structured progress, logs, metrics, and streamed results — plus W3C trace context.
03
How it works

An interaction is a session that carries one or more jobs. The wire format is a single JSON envelope; the transport is WebSocket for the network and stdio for in-process children.

01
Open a transport and exchange session.hellosession.welcome. The client declares identity and supported features; the runtime returns a session, a resume token, and an agent inventory with versions.
02
Send job.submit carrying a lease_request — what the agent may read, write, call, spend, and until when. The runtime replies job.accepted with the effective lease.
03
Consume the job.event stream: logs, thoughts, tool calls, structured progress, cost metrics, and chunked result_chunks for large outputs.
04
Reconnect with session.resume after a network drop, or job.subscribe from another session to watch a job live — without the authority to cancel it.
05
The job terminates with job.result or job.error. Leases that expire or budgets that run out fail closed.
job.submit
{
  "type": "job.submit",
  "payload": {
    "agent": "code-refactor@2.0.0",
    "lease_request": {
      "fs.read":     ["/workspace/app/**"],
      "fs.write":    ["/workspace/app/src/**"],
      "cost.budget": ["USD:5.00"],
      "model.use":   ["tier-fast/*"]
    },
    "lease_constraints": { "expires_at": "2026-05-13T23:42:00Z" }
  }
}
A job bounded in space, money, model, and time. The runtime enforces it on every operation.
04
Scope

The clearest way to understand a protocol is to know where it stops. ARCP draws a hard line and stays behind it.

Specifies

  • + The wire format for client–runtime communication
  • + The lifecycle of sessions, jobs, and event streams
  • + The authority model — leases with time and budget bounds
  • + Delegation, subscription, and job introspection
  • + Lease-bound provisioned credentials
  • + Trace context propagation

Does not specify

  • How agents are implemented
  • How tools are exposed → MCP
  • Telemetry export formats → OTel
  • Scheduling, priority, or pause/resume of running jobs
  • How agent state persists across restarts
  • Auth beyond bearer tokens