How it works

The loop has five steps: publish, install, gate, sync and check. Here is each one, with the command that does it.

Step 1
Publish
Create a draft package version with `wl push --draft --package <path>`. A registry admin approves the version, and `wl visibility` can make it public in the catalog.
Step 2
Install
`wl install <package>` pins a package ref in your home workspace. For a repository, `wl init` writes a workloom.workspace.json and `wl pull` fetches the current workspace revision.
Step 3
Gate
Before any write, the trust gate blocks denied hooks, unapproved MCP servers, permission wildcards, sandbox weakening, inline secrets and plugins that are not on your allowlist.
Step 4
Sync
`wl sync` (alias `wl apply`) writes the approved projections, fills in template tokens and {{secret:NAME}} references locally, applies settings effects and records every owned file.
Step 5
Check
`wl sync --check` reports drift without writing, so CI can run it, and --report sends the result to the registry. `wl doctor` runs the same trust and drift check on your home workspace.

Set up a new machine with one manifest

Keep your AI tool config in versioned packages, install it into every machine’s home directory, and let CI tell you when a repository drifts.