2026.10.1

All pre-built binaries passed smoke test.

Installing (and the nvim-plugin-stash.tar.bz2 asset)

The Neovim plugin stash ships as a separate release asset, not inside the
source tarball -- it is ~328 MB of bz2'd git packfiles, so committing it would
grow every clone permanently. Download it alongside the tarball and pair them:

tar xzf engineering-loadout-*.tar.gz
cd engineering-loadout-*/

# online: fetches + verifies the stash from this release
./tools/fetch-stash

# air-gapped: stash + sha256sums.txt downloaded elsewhere and copied over
./tools/fetch-stash --from-file /path/to/nvim-plugin-stash.tar.bz2 \
              --sums     /path/to/sha256sums.txt

./loadout install @shared-all      # bundled tools
./loadout install @envs-all        # per-user shell configs

Run fetch-stash from inside the extracted directory; it places the stash at
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2 and records it in .content-manifest.fetched.

--sums is required with --from-file: without the sha256sums.txt from this
same release there is nothing to verify against, and a stash that fails its hash is
deleted rather than left on disk. Do not copy the asset into place by hand --
.content-manifest is a strict allowlist and the installer refuses any payload file
with no manifest entry, so a hand-placed stash is rejected, not silently trusted.

Without the stash, Neovim still installs and starts; the plugin step is skipped with
a warning naming fetch-stash.

Asset checksums (SHA-256)

Integrity-critical files pinned by this release. .content-manifest in turn pins every payload file, so verifying it (or running ./loadout doctor --verify) covers the whole tree.

File	SHA-256
.content-manifest	327316b51eb309a989648684d7b1f2a28ad5a6651dfb674f769a707f7f835582
loadout	c72bdcc7863d7e73da499d4bcdb61c4f4fa6f8e4edbaab6472e48c6fde9c15f4
loadout_main.py	1b4a3c527f8f6a179ce20b8faec4b055014b9581ca10ca1feb61c265f63763b3
payload/packages.json	96dd54e17c846f6fbe5696e55ca09a5659233adeb56f5623c12599e41380968a
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2	28a5ad38ccd430d09e15e47ff2de09945f6f1b68111f93f706e8b9e4e4bc0e30
sbom.cdx.json	300bb12015f75ee649c2f8250e86c12fb32ba44790000e2b8e71ada1d07f2ee4

SBOM

sbom.cdx.json (CycloneDX) inventories the shipped closure: every Python wheel
(syft), the offline Rust crate store, and every registry package. Its SHA-256 is
in the checksums table above, so the signed tag binds it like any other asset.

Verifying this release

# from a checkout of the tag (or an extracted source archive):
sha256sum -c sha256sums.txt     # pins the integrity-critical files above
./loadout doctor --verify       # re-hashes every payload file vs .content-manifest
git tag -v 2026.10.1                # verify the SSH-signed tag

Pre-built binary versions

Tool	Binary	Version
surfer	surfer	0.7.0