2026.10.5

All pre-built binaries passed smoke test.

Installing (and the nvim-plugin-stash.tar.bz2 asset)

The Neovim plugin stash ships as a separate release asset, not inside the
source tarball -- it is ~328 MB of bz2'd git packfiles, so committing it would
grow every clone permanently. Download it alongside the tarball and pair them:

tar xzf engineering-loadout-*.tar.gz
cd engineering-loadout-*/

# online: fetches + verifies the stash from this release
./tools/fetch-stash

# air-gapped: stash + sha256sums.txt downloaded elsewhere and copied over
./tools/fetch-stash --from-file /path/to/nvim-plugin-stash.tar.bz2 \
              --sums     /path/to/sha256sums.txt

./loadout install @shared-all      # bundled tools
./loadout install @envs-all        # per-user shell configs

Run fetch-stash from inside the extracted directory; it places the stash at
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2 and records it in .content-manifest.fetched.

--sums is required with --from-file: without the sha256sums.txt from this
same release there is nothing to verify against, and a stash that fails its hash is
deleted rather than left on disk. Do not copy the asset into place by hand --
.content-manifest is a strict allowlist and the installer refuses any payload file
with no manifest entry, so a hand-placed stash is rejected, not silently trusted.

Without the stash, Neovim still installs and starts; the plugin step is skipped with
a warning naming fetch-stash.

Asset checksums (SHA-256)

Integrity-critical files pinned by this release. .content-manifest in turn pins every payload file, so verifying it (or running ./loadout doctor --verify) covers the whole tree.

File	SHA-256
.content-manifest	e9283b3b088998f30b13b125c1801ec313ed9364bfbc2ed66799a2834d23ed7e
loadout	c72bdcc7863d7e73da499d4bcdb61c4f4fa6f8e4edbaab6472e48c6fde9c15f4
loadout_main.py	5a9c0f072bf28e32e8e8d0faef6358c42375f8a73ba3283bb60c71f2e9488cc1
payload/packages.json	a0e8b24c82b2756bcf4a470450b56f80bbe4242c00aaa60dabe8153bdcc13e56
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2	28a5ad38ccd430d09e15e47ff2de09945f6f1b68111f93f706e8b9e4e4bc0e30
sbom.cdx.json	b55746952f49ed97aab73bd3b94f13bfa471d130d024e2c05faa74074c1f9a19

SBOM

sbom.cdx.json (CycloneDX) inventories the shipped closure: every Python wheel
(syft) and every registry package. Its SHA-256 is
in the checksums table above, so the signed tag binds it like any other asset.

Verifying this release

# from a checkout of the tag (or an extracted source archive):
sha256sum -c sha256sums.txt     # pins the integrity-critical files above
./loadout doctor --verify       # re-hashes every payload file vs .content-manifest
git tag -v 2026.10.5                # verify the SSH-signed tag