Fingerprint the Qdrant corpus by content, not by count

infra/helm/medical-chatbot/templates/_helpers.tpl

@@ -10,6 +10,23 @@
 {{- end -}}
 {{- end -}}
 
+{{/*
+Container image reference.
+
+The tag is demanded explicitly rather than defaulted so that a values file
+which deliberately leaves it unset fails the render instead of silently
+inheriting the chart's `local` development tag. Production and practice both
+supply an immutable commit SHA per deploy — practice through the ArgoCD
+Application's inline values, rewritten by sync_practice_argocd.py — and a
+chart that guessed a tag here would deploy something nobody asked for.
+
+Usage: {{ include "medical-chatbot.image" (dict "image" .Values.web.image "name" "web") }}
+*/}}
+{{- define "medical-chatbot.image" -}}
+{{- $tag := required (printf "%s.image.tag must be set to an immutable tag (a commit SHA); the chart will not guess one" .name) .image.tag -}}
+{{- printf "%s:%s" (required (printf "%s.image.repository must be set" .name) .image.repository) $tag -}}
+{{- end -}}
+
 {{- define "medical-chatbot.labels" -}}
 app.kubernetes.io/name: {{ include "medical-chatbot.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}

infra/helm/medical-chatbot/templates/ai-service.yaml

@@ -55,7 +55,7 @@ spec:
       {{- if .Values.aiService.migration.enabled }}
       initContainers:
         - name: migrate
-          image: "{{ .Values.aiService.image.repository }}:{{ .Values.aiService.image.tag }}"
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.aiService.image "name" "aiService") | quote }}
           imagePullPolicy: {{ .Values.aiService.image.pullPolicy }}
           command: ["python", "migrate.py"]
           envFrom:
@@ -69,7 +69,7 @@ spec:
       {{- end }}
       containers:
         - name: ai-service
-          image: "{{ .Values.aiService.image.repository }}:{{ .Values.aiService.image.tag }}"
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.aiService.image "name" "aiService") | quote }}
           imagePullPolicy: {{ .Values.aiService.image.pullPolicy }}
           ports:
             - { name: http, containerPort: 8000 }

infra/helm/medical-chatbot/templates/web.yaml

@@ -22,7 +22,7 @@ spec:
         {{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
       containers:
         - name: web
-          image: "{{ .Values.web.image.repository }}:{{ .Values.web.image.tag }}"
+          image: {{ include "medical-chatbot.image" (dict "image" .Values.web.image "name" "web") | quote }}
           imagePullPolicy: {{ .Values.web.image.pullPolicy }}
           env:
             - name: AI_SERVICE_URL