2026.10.6

All pre-built binaries passed smoke test.

Installing (and the nvim-plugin-stash.tar.bz2 asset)

The Neovim plugin stash ships as a separate release asset, not inside the
source tarball -- it is ~328 MB of bz2'd git packfiles, so committing it would
grow every clone permanently. Download it alongside the tarball and pair them:

tar xzf engineering-loadout-*.tar.gz
cd engineering-loadout-*/

# online: fetches + verifies the stash from this release
./tools/fetch-stash

# air-gapped: stash + sha256sums.txt downloaded elsewhere and copied over
./tools/fetch-stash --from-file /path/to/nvim-plugin-stash.tar.bz2 \
              --sums     /path/to/sha256sums.txt

./loadout install @shared-all      # bundled tools
./loadout install @envs-all        # per-user shell configs

Run fetch-stash from inside the extracted directory; it places the stash at
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2 and records it in .content-manifest.fetched.

--sums is required with --from-file: without the sha256sums.txt from this
same release there is nothing to verify against, and a stash that fails its hash is
deleted rather than left on disk. Do not copy the asset into place by hand --
.content-manifest is a strict allowlist and the installer refuses any payload file
with no manifest entry, so a hand-placed stash is rejected, not silently trusted.

Without the stash, Neovim still installs and starts; the plugin step is skipped with
a warning naming fetch-stash.

Asset checksums (SHA-256)

Integrity-critical files pinned by this release. .content-manifest in turn pins every payload file, so verifying it (or running ./loadout doctor --verify) covers the whole tree.

File	SHA-256
.content-manifest	80e929d5f0ef3f7377b041f881a511fcdbed77b078ac40b13fd9fa73acafa2fc
loadout	c72bdcc7863d7e73da499d4bcdb61c4f4fa6f8e4edbaab6472e48c6fde9c15f4
loadout_main.py	69b963cd888b5baa486f73ecab306d08b4fa6056e6b0b0f1e9e206b4e0891a4c
payload/packages.json	e93bf77517484c05c386f136dfa874c1d0be77688d5bb4f5aee93b73824b6677
envs/nvim/vendor/plugins/nvim-plugin-stash.tar.bz2	28a5ad38ccd430d09e15e47ff2de09945f6f1b68111f93f706e8b9e4e4bc0e30
sbom.cdx.json	399b79262d760de24057a4bee6ffd95a90e6e80b4c2b4e6ef053e10d73b375b1

SBOM

sbom.cdx.json (CycloneDX) inventories the shipped closure: every Python wheel
(syft) and every registry package. Its SHA-256 is
in the checksums table above, so the signed tag binds it like any other asset.

Verifying this release

# from a checkout of the tag (or an extracted source archive):
sha256sum -c sha256sums.txt     # pins the integrity-critical files above
./loadout doctor --verify       # re-hashes every payload file vs .content-manifest
git tag -v 2026.10.6                # verify the SSH-signed tag