diff --git a/00_VEKLOM_BIBLE.md b/00_VEKLOM_BIBLE.md
index 996d298..963826a 100644
--- a/00_VEKLOM_BIBLE.md
+++ b/00_VEKLOM_BIBLE.md
@@ -1,6 +1,6 @@
 # 00 — VEKLOM BIBLE — READ FIRST
 
-**Mandatory context for every human or AI working in this repo.** Canonical operational source: `reprewindai-dev/veklom-ops-command/00_VEKLOM_BIBLE.md`.
+**Mandatory context for every human or AI working in this repo.** Cross-repo canonical operational source: `reprewindai-dev/veklom-ops-command/00_VEKLOM_BIBLE.md`.
 
 Veklom is the sovereign AI **capability control plane / runtime authority layer**. It governs capability, not a permanent fleet of privileged agents.
 
@@ -12,6 +12,6 @@ Boundaries: VCCP/UCH/UCR = capability lifecycle; cAPI/Covenant = governed connec
 
 Standalone Veklom products may keep independent UIs. Capability OS consumes their underlying capabilities and rebuilds the OS surface natively.
 
-GitHub is source truth; Coolify is deployment truth. Use Coolify UI/API for management; SSH only for direct host/container verification/ops. Internal ports `3000`/`8000` are valid behind Traefik; the old blanket prohibition is retired. Never commit secrets or hard-code ephemeral runtime IDs.
+GitHub is source truth; Coolify is deployment truth. Use Coolify UI/API for management; SSH only for direct host/container verification/ops. For this cAPI repository, the reported production/root service port is `3003`; `3000` and `8000` are forbidden fallbacks. `3003` remains `UNVERIFIED` until deployed SHA, HTTP/protocol identity, container listener, and Traefik routing agree. Never commit secrets or hard-code ephemeral runtime IDs or private infrastructure addresses.
 
-Use evidence labels `VERIFIED_LIVE`, `VERIFIED_REPO`, `CONFIGURED`, `LAST_KNOWN`, `TARGET`, `UNVERIFIED`, `DEMO`, `ARCHIVED`. This Bible supersedes older Golden Bible, agent-alignment, topology, deployment-authority, and port-doctrine docs wherever they conflict.
\ No newline at end of file
+Use evidence labels `VERIFIED_LIVE`, `VERIFIED_REPO`, `CONFIGURED`, `LAST_KNOWN`, `TARGET`, `UNVERIFIED`, `DEMO`, `ARCHIVED`. Where the cross-repo Bible currently conflicts with this explicit cAPI port contract, record the conflict as deployment/source drift and do not silently adopt a noncanonical fallback.
diff --git a/AGENTS.md b/AGENTS.md
index d900739..9e8ad0b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,6 +2,8 @@
 
 Before any work, read [`00_VEKLOM_BIBLE.md`](./00_VEKLOM_BIBLE.md).
 
-That file is the canonical Veklom cross-repo architecture/runtime contract. Repo-local source and tests govern Covenant/cAPI implementation details only when they do not conflict with current runtime evidence or the Bible.
+That file is the Veklom cross-repo architecture/runtime context. Repo-local source and tests govern Covenant/cAPI implementation details only when they do not conflict with current verified runtime evidence.
 
-Do not infer service placement, ports, health, compliance, or production status from old docs. Use Coolify UI/API/MCP for Coolify management; SSH is for direct host/container verification or operations. Host port `8000` is currently Coolify-owned even though internal Docker port `8000` can be used behind Traefik.
+For cAPI, the current reported runtime contract is port `3003`. Ports `3000` and `8000` are forbidden cAPI production/root fallbacks and must not appear as Docker, listener, health-check, Compose, or Traefik defaults. Treat `3003` as `UNVERIFIED` until deployed SHA, HTTP/protocol identity, container listener, and Traefik routing agree.
+
+Do not infer service placement, health, compliance, or production status from old docs. Use Coolify UI/API/MCP for Coolify management; SSH is for direct host/container verification or operations. Never commit secrets or concrete private infrastructure addresses.