Secrets & Config — the one map for the scattered platform plumbing

Why this file exists. Four kinds of "platform plumbing" — site-domain provisioning, the email-services topology, the secrets / KMS / API-key surface, and the env vars / hub .env keys an app actually needs — were each documented in one place buried in a much larger SoT. An agent that hits "Missing site configuration for email", or doesn't know which four ports email needs, or passes an accessLevel the createApiKey proc rejects, had to know exactly which file + line to open. This doc is the single discoverable index: it states the load-bearing fact inline and then links back to the canonical SoT for the full detail. It does not fork detail — when the SoT changes, this file points at it; it doesn't duplicate it.

Read this when: you are wiring an app's .env, standing up email delivery, exercising any secret/API-key flow, or you hit one of the config errors named below. It is a reference, not a phase — nothing here is on the four-phase critical path for a basic no-email app.

This file is consume-only over the upstream runbooks it links. The local-email-services Docker-Compose runbook lives in constructive-io/constructive (a different repo) — this file points at it, it does not re-host it.