Track the practice cluster's Helm values in Git

infra/helm/medical-chatbot/templates/ai-service.yaml

@@ -10,8 +10,12 @@ data:
   QDRANT_URL: {{ default (printf "http://%s-qdrant:6333" (include "medical-chatbot.fullname" .)) .Values.qdrant.url | quote }}
   QDRANT_COLLECTION: {{ .Values.aiService.config.qdrantCollection | quote }}
   EMBEDDING_PROVIDER: {{ .Values.aiService.config.embeddingProvider | quote }}
+  EMBEDDING_DIMENSIONS: {{ .Values.aiService.config.embeddingDimensions | quote }}
+  EVIDENCE_MINIMUM_SCORE: {{ .Values.aiService.config.evidenceMinimumScore | quote }}
+  AWS_REGION: {{ .Values.aiService.config.awsRegion | quote }}
   ANSWER_PROVIDER: {{ .Values.aiService.config.answerProvider | quote }}
   ANSWER_MODEL_ID: {{ .Values.aiService.config.answerModelId | quote }}
+  RERANK_ENABLED: {{ .Values.aiService.config.rerankEnabled | quote }}
   ENTITIES_PATH: {{ .Values.aiService.config.entitiesPath | quote }}
   METRICS_ENABLED: {{ .Values.aiService.config.metricsEnabled | quote }}
   OTEL_ENABLED: {{ and .Values.observability.enabled .Values.aiService.config.otelEnabled | quote }}
@@ -40,6 +44,7 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
         app.kubernetes.io/component: ai-service
       annotations:
+        checksum/runtime-config: {{ dict "config" .Values.aiService.config "environment" .Values.global.environment "qdrantUrl" .Values.qdrant.url "observabilityEnabled" .Values.observability.enabled | toJson | sha256sum | quote }}
         prometheus.io/scrape: "true"
         prometheus.io/path: /metrics
         prometheus.io/port: "8000"

infra/helm/medical-chatbot/values-practice-data.yaml

@@ -0,0 +1,28 @@
+# k3s practice cluster — the `medical-chatbot-data` release.
+#
+# Companion to values-practice.yaml. The practice cluster deliberately splits
+# the chart into two ArgoCD Applications so that PostgreSQL and Qdrant survive
+# every app rollout, prune and self-heal: only this release owns the
+# PersistentVolumeClaims, so an app-side sync failure can never delete the
+# 15,100-point corpus or the query history.
+#
+# It therefore runs *only* the stateful half — PostgreSQL and Qdrant are left
+# at their chart defaults (`enabled: true`) and everything else is switched off.
+#
+# Kept inline on the Application rather than here: nothing. This release has no
+# image tag that CI rewrites and no secret, so it is fully tracked in Git.
+
+global:
+  environment: k3s-practice
+
+aiService:
+  enabled: false
+
+web:
+  enabled: false
+
+observability:
+  enabled: false
+
+ingress:
+  enabled: false

infra/helm/medical-chatbot/values-practice.yaml

@@ -0,0 +1,72 @@
+# k3s practice cluster — the `medical-chatbot-app` release.
+#
+# This file is the Git source of truth for every stable, non-secret setting of
+# the practice rehearsal environment. It exists because the same values used to
+# live only inside the ArgoCD Application's inline `spec.source.helm.values`,
+# where they were invisible to review, diff and rollback: the cluster could
+# drift from the repository without a single commit recording it. That is how
+# practice ended up on DeepSeek with reranking off while production ran Qwen
+# with reranking on.
+#
+# Two things deliberately stay OUT of this file and remain inline on the
+# Application:
+#
+#   - `aiService.image` / `web.image` — rewritten on every push by
+#     `.github/scripts/sync_practice_argocd.py`, which regex-replaces the tag
+#     in the inline values. A tag committed here would be stale by design.
+#   - anything secret. Nothing in the practice release currently needs one;
+#     Bedrock authenticates through the node's instance role.
+#
+# ArgoCD applies `valueFiles` in order and then the inline values last, so the
+# image block inline still wins over anything the chart defaults set here.
+#
+# The behavioural settings below mirror the production runtime contract audited
+# on 2026-08-17 (see coordination/ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md).
+# Practice is only useful as a migration rehearsal while they stay in sync.
+
+global:
+  environment: k3s-practice
+  # The GHCR packages are private; without this the Pods fail ImagePullBackOff.
+  imagePullSecrets:
+    - name: ghcr-pull-secret
+
+# PostgreSQL and Qdrant are owned by the separate `medical-chatbot-data`
+# release so that redeploying the app never touches persistent state. This
+# release therefore runs neither, and points at the data release's Services.
+postgres:
+  enabled: false
+
+qdrant:
+  enabled: false
+  url: http://medical-chatbot-data-medical-chatbot-qdrant.medical-chatbot-data.svc.cluster.local:6333
+
+secret:
+  postgresHost: medical-chatbot-data-medical-chatbot-postgres.medical-chatbot-data.svc.cluster.local
+
+aiService:
+  config:
+    embeddingProvider: cohere-v4
+    embeddingDimensions: 1024
+    evidenceMinimumScore: 0.12
+    awsRegion: us-east-1
+    answerProvider: bedrock-converse
+    answerModelId: qwen.qwen3-next-80b-a3b
+    rerankEnabled: true
+
+observability:
+  grafana:
+    # Practice-only convenience: the rehearsal cluster is a throwaway box and
+    # Grafana sits behind the same ingress host. Never set this on production.
+    anonymousAdmin: true
+
+ingress:
+  enabled: true
+  className: traefik
+  host: readytochat.realvuxbaro.me
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  tls:
+    - hosts:
+        - readytochat.realvuxbaro.me
+      secretName: readytochat-tls

infra/helm/medical-chatbot/values-prod.yaml

@@ -7,7 +7,12 @@ aiService:
     tag: latest
   config:
     embeddingProvider: cohere-v4
+    embeddingDimensions: 1024
+    evidenceMinimumScore: 0.12
+    awsRegion: us-east-1
     answerProvider: bedrock-converse
+    answerModelId: qwen.qwen3-next-80b-a3b
+    rerankEnabled: true
     otelSampleRatio: 0.25
 
 web:

infra/helm/medical-chatbot/values.yaml

@@ -31,8 +31,12 @@ aiService:
     port: 8000
   config:
     embeddingProvider: disabled
+    embeddingDimensions: 1024
+    evidenceMinimumScore: 0.12
+    awsRegion: us-east-1
     answerProvider: disabled
     answerModelId: deepseek.v3.2
+    rerankEnabled: false
     # The Dockerfile bakes the catalog file in at this path; config.py's own
     # repo-relative default only resolves inside a full monorepo checkout,
     # not this flattened image layout. Matches apps/ai-service/.env.example.