2026.10.4

All pre-built binaries passed smoke test.

Installing (and the nvim-plugin-stash.tar.bz2 asset)

The Neovim plugin stash ships as a separate release asset, not inside the
source tarball -- it is ~328 MB of bz2'd git packfiles, so committing it would
grow every clone permanently. Download it alongside the tarball and pair them:

tar xzf engineering-loadout-*.tar.gz
cd engineering-loadout-*/

# online: fetches + verifies the stash from this release
./tools/fetch-stash

# air-gapped: stash + sha256sums.txt downloaded elsewhere and copied over
./tools/fetch-stash --from-file /path/to/nvim-plugin-stash.tar.bz2 \
              --sums     /path/to/sha256sums.txt

./loadout install @shared-all      # bundled tools
./loadout install @envs-all        # per-user shell configs

Run fetch-stash from inside the extracted directory; it places the stash at
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2 and records it in .content-manifest.fetched.

--sums is required with --from-file: without the sha256sums.txt from this
same release there is nothing to verify against, and a stash that fails its hash is
deleted rather than left on disk. Do not copy the asset into place by hand --
.content-manifest is a strict allowlist and the installer refuses any payload file
with no manifest entry, so a hand-placed stash is rejected, not silently trusted.

Without the stash, Neovim still installs and starts; the plugin step is skipped with
a warning naming fetch-stash.

Asset checksums (SHA-256)

Integrity-critical files pinned by this release. .content-manifest in turn pins every payload file, so verifying it (or running ./loadout doctor --verify) covers the whole tree.

File	SHA-256
.content-manifest	a5601d5d32a7e25b8a1b0719d9fe134e09b6afc10a4908bd788792aba65b4bcc
loadout	c72bdcc7863d7e73da499d4bcdb61c4f4fa6f8e4edbaab6472e48c6fde9c15f4
loadout_main.py	21de4a7b5facc36ad50bb55669e96eb1c78fc5d7abecdb76b652f4b21a5b7522
payload/packages.json	25cceb18bb4322e5f0450337a65268ce0bdcc711038d9964358be5e20f6ad134
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2	28a5ad38ccd430d09e15e47ff2de09945f6f1b68111f93f706e8b9e4e4bc0e30
sbom.cdx.json	e0d4ef7882f5d54cd24d5e2894a61d8524a676935feb8207e3456ef8e74ba152

SBOM

sbom.cdx.json (CycloneDX) inventories the shipped closure: every Python wheel
(syft) and every registry package. Its SHA-256 is
in the checksums table above, so the signed tag binds it like any other asset.

Verifying this release

# from a checkout of the tag (or an extracted source archive):
sha256sum -c sha256sums.txt     # pins the integrity-critical files above
./loadout doctor --verify       # re-hashes every payload file vs .content-manifest
git tag -v 2026.10.4                # verify the SSH-signed tag