Agent Atlas / Runtimes and workbenches

andrewyng/openworker

What is andrewyng/openworker, and what does it do?

A local-first desktop agent runtime whose provider switching, approval gates, reusable skills, and security-focused coworkers make the harness itself an inspectable security boundary.

Desktop agent runtime Scope profile Project documented Reviewed August 26, 2026
Intended operator

People delegating file, terminal, connected-app, and security work from a desktop agent.

Primary surfaces

desktop workbench / local Python agent server / security coworkers and reusable skills

Tracked repository

andrewyng/openworker

Teaching mechanism

Security coworkers drive scanners instead of impersonating them

The bundled code, dependency, and cloud-posture workflows name concrete scanners, require coverage disclosures when a tool is missing, and reserve fixes or cloud changes for reviewable code paths.

Evidence limitOpen instructions make the intended workflow auditable, but do not establish scanner availability, model judgment quality, safe configuration, or production effectiveness on a particular machine.
Inspect the source
System map status

Reporting is still in progress.

This scope profile names the project's place in the field and one useful mechanism. It does not claim that every runtime boundary has been inspected.

Learn Through This Project

9 lessons
Chapter 1 Before the First Model Request Chapter 2 The Invisible Prompt Chapter 3 Tool Calls: Contract, Authorization, Execution Chapter 4 Loops, Workflows, and Recovery Chapter 5 Delegation Is a Distributed System Chapter 7 The Approval Trap Chapter 8 The Human Control Loop Chapter 9 Trust Must Make Its Case Chapter 10 The Future Has Three Branches

Compare Its Boundaries

8 labs
Comparison labTool ContractsComparison labGoverned MemoryComparison labDelegation ReceiptsComparison labApproval BoundariesComparison labHuman WorkbenchComparison labSessions And RecoveryComparison labEvidence And EvaluationComparison labMaturity Signals

Latest Reporting

1 article
Builder Work: The Underscore That Rewound Another Agent

September 19, 2026 — An OpenWorker patch attributed to Devin protects a neighboring workspace during a database migration. Its strongest lesson is the assertion about the row that should not move. andrewyng/openworker

Primary Sources

OpenWorker repository

Primary public source for the desktop runtime, tools, approvals, provider routing, and bundled coworkers.

 OpenWorker v0.2.0 release

Release receipt for the security coworkers, reusable skills, model choices, and security hardening.

Open Questions

  • Can an auditable harness keep scanner coverage, model judgment, tool installation, and cloud authority visibly separate for non-specialist teams?

Profile facts were reviewed as of ; newer reporting is dated separately above. An evidence label is not a product score or proof that uninspected capabilities are absent.