The product

A canonical package is a versioned, immutable, organization-scoped bundle of assets: instructions, skills, agents, prompts, hooks, MCP server configs and provider configs. Provider files are always derived from it, never the reverse.

Package versions move from draft through review to approved, a deterministic content scan gates promotion, and channels point each package at its current version.

A workspace says which packages apply to one repository or home directory, for which providers. A provider adapter turns the assets into that provider’s native files, and the render plan lists every file with its content hash.

Claude Code and Codex renderers are implemented. Gemini, GitHub Copilot and Cursor have fixtures defined and are planned.

Each asset has a trust class. Hooks, MCP servers and tool permission grants need explicit approval before they are written, so they never silently appear on a developer’s machine.

Workloom-owned files are tracked by hash. `wl sync --ci` fails a build when files on disk have drifted from the desired state, and files Workloom did not render are never touched.

The registry API (Hono, OpenAPI 3.1) holds packages, workspaces and organization data. The dashboard is where members manage the registry, workspaces, home stacks, telemetry and administration. The `wl` CLI binds a directory to a workspace, pulls, syncs, pushes and reviews.

The desktop app (Tauri) wraps a bundled local API sidecar and shows the status, diffs and drift of your local workspaces, with pull, sync and restore.