Loadout Context Engine

The README says Loadout writes local gitignored overlays, avoids shared instruction files, binds its UI to localhost, stages diffs, and uses atomic writes, environment allowlists, secret-name denial, token redaction, script trust, dry runs, doctor, and clean. The npm workflow also checks that a non-interactive invocation refuses a silent installation. This supports reasonably strong privilege control, confirmation, effect disclosure, and recovery. Points are withheld because security.md, the installer, synchronization, updater, and implementation are absent, so network destinations, command isolation, secret-detection coverage, and every write path cannot be checked. Curl-to-shell installation, dynamic shell fragments, automatic config pulls, and self-update expand the execution and supply-chain surface. Cargo dependencies use broad version requirements and Actions use mutable major-version tags; no dependency audit, artifact checksum, or release-signing evidence is supplied. Authorship, repository ownership, MIT copyright, and the inspirations for bundled workflows receive basic attribution, but per-item provenance and licenses for vendored material are not shown.

The README, Cargo manifest, and CI are broadly consistent about the Rust CLI, command name, platforms, and test entry points. CI covers formatting, Clippy, Linux/macOS tests, a browser smoke test, and the declared minimum Rust version. The command catalog, doctor, explain, and the npm refusal check show attention to diagnosable failures. Deductions reflect the absence of implementation, lockfile, and test bodies, which prevents static confirmation of dependency availability and message quality. Cargo comments say some studio dependencies are for capabilities to be wired in later slices while the README presents those capabilities as current, creating a modest consistency concern. Windows requires WSL, while git, browsers, and external agent executables remain explicit but externally supplied dependencies.

The material thoroughly identifies scenarios across Rust, Node, Next.js, Go, Python and other stacks, repo-less machine work, five named agents, CLI/VS Code usage, global/project configuration, and customizable workflows. Deterministic target matching, exactly-one selection, a remembered prompt for ambiguous matches, and default-or-empty behavior give trigger selection unusually precise documentation. Deductions apply because boundaries around dynamic shell providers are not fully developed in the supplied files, workflows are guidance rather than enforced policy, and generic integration is manual. Native support is limited to macOS/Linux, Windows depends on WSL, and some agent integrations require global hooks, environment variables, or local wiring files.

The README has strong information architecture spanning quick start, model, workflows, support matrix, storage, commands, safety, installation, and documentation. Installation channels, source builds, updates, and platform requirements are concrete, and examples are extensive. The complete MIT text matches Cargo metadata, justifying full license credit. Deductions reflect necessary but cognitively costly naming differences between load and loadout, colon and dash commands, and agent-specific filenames; limitations are distributed rather than consolidated. Cargo declares 0.28.0 and README links releases, but no changelog, version policy, or migration policy is included. Maintenance responsibility can only be inferred from the Ellery Familia copyright, package scope, and repository URL; no maintainer roster, support policy, or security-reporting route is shown. Unknown publisher identity is not treated as suspicious.

The outputs are directly consumable agent overlay files, augmented by explain, preview, plan HTML, structured feedback, and cross-agent workflow commands, making the product's intended results highly usable. Separating personal context from repository instructions, automatic stack selection, and consistent workflows across agents offer credible incremental value over a single static instruction file. Deductions apply because the value and cost claims rest chiefly on README descriptions rather than supplied implementation or comparative evidence. Users must maintain global TOML, trust dynamic scripts, accommodate agent-specific wiring, and accept complexity from git synchronization, self-updating, and several generated files.

Most product claims are tied to named commands, concrete paths, configuration examples, selection rules, and CI jobs. Cargo metadata corroborates the README's product identity and license, while the npm workflow corroborates the stated consent behavior. Deductions reflect the absence of core source, Cargo.lock, linked security/concepts documents, test bodies, release configuration, and installer code, leaving security controls, determinism, byte-identical rendering, automatic wiring, and synchronization untraceable to implementation. The documentation often distinguishes guidance from enforcement, but strong statements such as “never touched,” byte identity, and exclusive official channels lack independent corroboration in the supplied material.