Global workflows for LLM agents
Write one protocol: who talks to whom, who calls a model, and who owns each decision. ZipperGen turns it into a separate program for each participant and runs them. Coordination deadlocks are ruled out by construction, and the core theorem is machine-checked in Lean 4.
@workflow
def email_approval() -> int:
User: message = next_unread_message()
while message @ User:
User(message) >> Writer(message)
Writer: draft = draft_reply(message)
Writer(draft) >> User(draft)
User: approved = approve_reply(draft)
if approved @ User:
User: handled = send_reply(draft, handled)
else:
User: handled = discard(handled)
User: message = next_unread_message()
return handled @ User @ User says who owns the decision. The Writer is never told
what was approved, because it does nothing either way, so the branch is
left out of its program entirely. Nobody writes that by hand.
The README, a tutorial, and the full guide are on GitHub. The projection is based on Message Sequence Charts and choreographic programming.
Bollig, Függer, Nowak. Provable Coordination for LLM Agents via Message Sequence Charts. arXiv:2604.17612. ISoLA 2026.
Bollig. Deadlock-Free Parallel Regions for Projected Workflows. EXPRESS/SOS 2026.
Bollig. Causal Past Logic for Runtime Verification of Distributed LLM Agent Workflows. arXiv:2605.20923. Under submission.