The product

A package is a scoped, versioned bundle of assets owned by an organization, named @scope/name. An asset is one unit of AI workflow content of one asset type: instruction, skill, agent, workflow, prompt, hook, mcp_server, provider_config, template, policy or telemetry_schema.

A package version is an immutable snapshot with a release channel, a version status (draft, review, published, deprecated) and declared dependencies. File content is stored once as blobs addressed by their SHA-256 hash, and a secret scan blocks a version whose content contains a credential.

A workspace is an organization’s desired state for one repo, folder, service or key. It holds workspace targets: paths with their own packages, version constraints, providers and a target root (the project directory or the user’s home directory).

Every workspace change creates the next workspace revision. Workspace overrides pin one package’s version constraint or release channel for one target or all of them, and workspace policies hold rules such as the lockfile policy and required providers.

A renderer turns assets into one provider’s files, and a render plan lists exactly which files must exist for one target and provider at one revision. The `wl` CLI renders and writes files for Claude, Codex and Gemini; the GitHub Copilot renderer is implemented in the registry’s render preview endpoint.

Every rendered file has a trust category. Executable, network-bearing and authority-expanding files need a recorded approval before they are written, and files Workloom does not own are never overwritten.

The registry API (Fastify, documented as OpenAPI 3.0) holds packages, workspaces and organization data. The dashboard is where members browse the public registry and manage their organization. The `wl` CLI binds a directory to a workspace, pulls, syncs, pushes, manages home profiles and runs reviews.

The desktop app (Tauri) binds a folder to a workspace and shows its status, diffs, sync and overrides.