Record the verified platform sender and match the deployment source.

The attended release returned sender_deployed_verified for
platform@coulomb.social. Inspection shows one ready replica and a completed
journal. The ledger rows were kept and no mail was sent.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

deploy/k8s/railiance/README.md

@@ -13,9 +13,11 @@ be used. Read the-custodian/docs/agent-environment-orientation.md first.
 
 Platform owns OpenBao custody, Kubernetes-auth ClusterSecretStore
 openbao-email-connect and its scoped ESO ServiceAccount (RPF-WP-0045).
-ExternalSecret email-connect/email-connect-runtime delivers the existing
-EMAIL_CONNECT_INGEST_TOKEN, EMAIL_CONNECT_SMTP_USERNAME and
-EMAIL_CONNECT_SMTP_PASSWORD fields. Never read or print Secret objects/annotations.
+The receiver sender is platform@coulomb.social. Its SMTP username is that
+same address and its SMTP password comes from Secret
+email-connect-platform-smtp, projected from the admitted platform reader.
+Callers come from the mounted callers file. Never read or print Secret
+objects or annotations.
 Route needs through warden route find/show email-connect-transactional.
 
 The static ESO token bootstrap and duplicate store template are retired.

deploy/k8s/railiance/configmap.yaml

@@ -17,7 +17,6 @@ data:
   # Matches the live user-engine Ingress host on railiance01 (nip.io until a
   # coulomb.social alias is cut over). Update when the public hostname changes.
   EMAIL_CONNECT_PORTAL_URL: "https://users.coulomb.social"
-  # Envelope From — interim identity matches the live forgejo IONOS SMTP lane
-  # (forgejo@coulomb.social) used to seed CCR-2026-0010. Switch to a dedicated
-  # noreply@ mailbox when that credential is minted separately.
-  EMAIL_CONNECT_SENDER: "forgejo@coulomb.social"
+  # Envelope From. The SMTP username and password are explicit Deployment
+  # environment entries from the admitted platform projection, not this map.
+  EMAIL_CONNECT_SENDER: "platform@coulomb.social"

deploy/k8s/railiance/deployment.yaml

@@ -52,12 +52,17 @@ spec:
           envFrom:
             - configMapRef:
                 name: email-connect-config
-            - secretRef:
-                name: email-connect-runtime
-                optional: false
           env:
             - name: EMAIL_CONNECT_CALLERS_FILE
               value: /etc/email-connect-callers/callers.json
+            - name: EMAIL_CONNECT_SMTP_USERNAME
+              value: platform@coulomb.social
+            - name: EMAIL_CONNECT_SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: email-connect-platform-smtp
+                  key: password
+                  optional: false
           resources:
             requests:
               cpu: 5m