The product

A package is a named, versioned collection of canonical assets: instructions, skills, agents, workflows, prompts, hooks, MCP servers, provider configs, templates, policies and telemetry schemas. Provider files are always derived from it.

A package version is immutable. It starts as a draft, passes a content scan before it can be promoted to pending_review, and is then approved or rejected. Channels point a package at one of its versions.

A workspace says which packages render into which targets for which providers, under which policies. Each change creates a workspace revision. An adapter maps the assets to a provider’s files, and the render plan lists every file before anything touches disk.

The `wl` CLI renders for Claude Code, Codex and GitHub Copilot. Adapters for Gemini and Cursor exist in the source but are not used by the CLI yet.

Each asset has a trust class. A trust gate blocks trust-sensitive assets, such as hooks, MCP servers and tool permissions, until someone explicitly approves them.

Workloom-owned files are tracked in the state file. `wl sync` exits non-zero when files on disk have drifted from the desired state, and files Workloom does not own are never touched.

The registry API (Hono, OpenAPI) holds packages, workspaces, organizations, signing keys and telemetry. The dashboard is where members publish and review packages, manage workspaces and read telemetry. The `wl` CLI binds a directory, pulls, checks drift, pushes and publishes.

The desktop app (Tauri) connects to a registry with an API token, finds a directory’s binding, watches its files, and queues pull, push and sync.