---
name: release-seed-machine-env-ruling
description: "Operator-ruled 2026-07-26: the MACHINE-scope SPT_RELEASE_SEED on HFENDULEAM is intentional — publish via the hex-env fallback, don't re-raise the runbook _CMD-only rule here."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 600922b5-736a-4dce-be8d-9d89847e08d6
  modified: 2026-07-26T06:56:50.829Z
---

On HFENDULEAM the release signing seed is stored in the **MACHINE-scope** env var `SPT_RELEASE_SEED` (64 hex). `docs/RELEASE-RUNBOOK.md` step 4 forbids the raw-env form on any CI-runner/multi-user host, and this box does host a CI runner — so at the v0.43.0 cut I stopped before signing and escalated. **Operator ruling: the machine-wide storage is INTENTIONAL. Publish with the env seed. Leave the variable in place.**

**Why:** it is a deliberate operator setup on their own box, not an accident. The accepted risk (CI job steps — third-party `build.rs`, proc macros, test binaries — inherit the machine environment) is known and owned by the operator.

**How to apply:** run `cargo run -p xtask -- release-publish …` **without** `SPT_RELEASE_SEED_CMD` set, so xtask falls back to reading `SPT_RELEASE_SEED` directly. Do not set the `_CMD` form here: on Windows it runs under powershell and hex-decodes its stdout, so piping already-hex seed through it double-decodes and panics `seed is 32 bytes: TryFromSliceError` (see [[v0250-published]]). Never delete or clear the variable. Do not re-raise the step-4 rule as a blocker on this box — it is escalated-and-ruled; raising it again costs a release window. The rule still stands on every other host. Recorded in deployah's durable role too.

doyle's follow-up: amend the runbook with a **dated, host-scoped recorded operator ruling** that names the accepted risk — not a softening of the rule (the rationale stays true everywhere else). doyle gates that docs PR; it is not release-blocking. See [[v0430-published]].