Skip to main content

What's Coming

Workloom is built in phases. Here is what exists today and what is planned.

Today (Phase 1)​

The local wl loop is functional:

  • Registry and workspace data model with TypeScript types and Zod schemas
  • Claude renderer — renders skills, agents, instructions, MCP configs, hooks to .claude/ files
  • Codex renderer — renders instructions, agents to AGENTS.md and .codex/config.toml
  • Content-addressed storage with SHA-256 hashing and gzip compression
  • CLI commands — wl login, wl bind, wl pull, wl push, wl status
  • Fastify API server with auth, registry, and workspace endpoints
  • Next.js web app for browsing packages and managing workspaces
  • In-memory stores for development (no database required)
  • Dev mode auth with local JWT issuer (no external IdP required)

Phase 2: Hosted Registry​

  • Persistent database-backed registry
  • HTTPS object upload/download with signed URLs
  • SHA-256 verification on all downloaded objects
  • Device authorization flow with real IdP integration
  • CI service account tokens
  • Workspace revision history
  • Audit events

Phase 3: Web Management​

  • Package approval workflows
  • Workspace assignment UI with monorepo target editor
  • Rendered file diff preview in the browser
  • SSO/SAML integration
  • RBAC and team permissions

Phase 4: Telemetry​

  • Anonymous sync and drift event collection
  • Package adoption dashboards
  • Workflow success/failure tracking
  • Version regression detection
  • Admin opt-out controls

Phase 5: Provider Expansion​

  • Copilot renderer — .github/copilot-instructions.md and .github/instructions/ committed projections
  • Gemini adapter — extension packaging and install/link support
  • Desktop app for non-terminal users
  • Public marketplace with package signing, scanning, and moderation

Design principles​

These carry across all phases:

  • Registry is source of truth — local files are generated projections, not canonical
  • Immutable versions — published packages never change
  • Deterministic rendering — same input always produces same output
  • No rsync, no SSH — HTTPS transport only, works with corp proxies and SSO
  • CI-first — wl sync --check is a first-class command, not an afterthought
  • Trust gates — hooks, MCP servers, and permission changes require explicit approval
  • Privacy by design — telemetry never collects source code, prompts, or PII