Organization-level packages · workspace desired state
Your organization’s AI workflow, as desired state.
Publish skills, agents, prompts and configs once, as immutable packages your organization owns. Each workspace declares which packages and providers every target gets; Workloom renders them for Claude, Codex and Gemini, writes them into repositories and home directories, and reports drift from that desired state.
.root: project
providers: claude, codex, gemini
- @acme/base-instructions ^2.1.0
- @acme/review-kit ~1.4.0
services/ledgerroot: project
providers: claude
- @acme/ledger-rules 1.0.3
~root: home
providers: claude, codex
- @acme/dev-env ^3.0.0
Sample data · revision 12 · 3 workspace targets · drift: clean
Desired state, not copy-paste
- 01
Owned by the organization
Packages are scoped to an organization (@scope/name), and each package version is immutable once published. Teams, roles, API keys, webhooks and org policies live beside them.
- 02
Declared per workspace
A workspace is the desired state for one repo, folder or service: a set of workspace targets, each with its own packages, version constraints and providers. Every change creates the next workspace revision.
- 03
Applied to home directories too
A home profile writes the same packages into your home directory, confined to an allowlist (~/.claude, ~/.codex, ~/.cursor, ~/.config/workloom, ~/AGENTS.md). It never overwrites a file Workloom does not own.
What the platform does
- 01
Organization packages
Scoped, immutable packages of skills, agents, prompts and configs, owned by your org.
- 02
Workspace desired state
Each workspace declares which packages, versions and providers every target gets.
- 03
Provider rendering
Assets become each provider’s native files, from a deterministic render plan.
- 04
Home profiles
Apply AI dev-env configuration to $HOME, attributed and cleanly removable.
- 05
Trust categories and approval
Risky files need recorded consent before they are written.
- 06
Drift detection
Know when files on disk differ from the declared revision, in CI or locally.
- 07
Secret scan and AI review
A deterministic scan blocks credentials; an advisory AI review never blocks.
- 08
Organization access
Roles, teams, scoped API keys, org policies and an audit log.
- 09
Webhooks
Signed HTTPS deliveries for publishes, approvals, drift and reviews.
- 10
Sync telemetry
Outcome events from pull, sync, diff and push, with an opt-out.
From a package to files on disk
- Step 1
Publish
`wl push <path> --package @scope/name` publishes a local asset directory as a new package version. The secret scan runs first, and `--draft` keeps the version out of the published set.
- Step 2
Declare
In the dashboard or the API, give a workspace its targets: which packages at which version constraints, for which providers, written to the project or to home. Each change is a new workspace revision.
- Step 3
Bind
`wl init` or `wl bind --workspace <id>` links a local directory to that workspace and its registry.
- Step 4
Pull and sync
`wl pull` fetches the current revision, resolves it into the lock file, renders each provider’s files and writes the ones Workloom owns or may create. `wl pull --dry-run` prints the plan first.
One desired state for every repo and every laptop
Publish your organization’s AI workflow content once, declare where it goes, and let `wl sync --check` tell you when anything drifts.