Fingerprint the Qdrant corpus by content, not by count

infra/helm/medical-chatbot/values-prod.yaml

@@ -1,10 +1,33 @@
+# Production values for the eventual ArgoCD cutover of realvuxbaro.me.
+#
+# Not live yet: production still runs Docker Compose on its own EC2, which is
+# the DNS-level rollback for the migration. This file is what the production
+# ArgoCD Application will render from once the rehearsal gates pass.
+#
+# The behavioural settings mirror the production runtime contract audited on
+# 2026-08-17 — see coordination/ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md.
+
 global:
   environment: production
+  # The GHCR packages are private, same as on the practice cluster. The Secret
+  # must exist in the target namespace before the first sync.
+  imagePullSecrets:
+    - name: ghcr-pull-secret
 
 aiService:
   replicaCount: 2
   image:
-    tag: latest
+    repository: ghcr.io/baovu2k4/vsf-duocthu-ai-service
+    # Deliberately empty. Production must run an immutable, verifiable image,
+    # so the tag is supplied per deploy as a commit SHA — through the ArgoCD
+    # Application's inline values, exactly as the practice cluster does. A
+    # `latest` here would make "which code is production running?" unanswerable
+    # and would break rollback, since the same tag would point at new content.
+    #
+    # `medical-chatbot.image` turns this empty value into a hard render error
+    # rather than a silent fallback to the chart's `local` development tag.
+    tag: ""
+    pullPolicy: Always
   config:
     embeddingProvider: cohere-v4
     embeddingDimensions: 1024
@@ -18,7 +41,9 @@ aiService:
 web:
   replicaCount: 2
   image:
-    tag: latest
+    repository: ghcr.io/baovu2k4/vsf-duocthu-web
+    tag: ""
+    pullPolicy: Always
 
 ingress:
   enabled: true