RUL-011 — Ports from .env, no hardcoded numeric defaults anywhere

Ruling

For the CXP gRPC kernel port (and ports generally): no hardcoded numeric default, not in source, not in tests. Every place that needs a port reads it from the active ORCHESTRATA_ENV_PROFILE (env/{dev,test,prod}.env layered over .env secrets); if unset, raise a clear config error — no numeric fallback.

Evidence

• Project memory feedback-ports-from-env-no-defaults (stated 2026-06-20): the port was hardcoded in ≥4 places and drifted — docker-compose ran the agent-runtime on 50053 while code defaulted to 50051. A regression test that asserted == 50051 was itself the wrong fix (pins a literal instead of removing the hardcoding).

Enforcement

• gate src/orchestrata_ultimate/prolog/gate_rules.pl infra_key_with_default

Verification

scripts/code-review.py's ConnectionStringChecker includes REDIS_PORT in its tracked ENV_VAR_KEYS and raises ENV_DEFAULT (ERROR, category config) whenever an env-var read for a tracked key carries a positional or keyword default= argument.