# Claude claim — 2026-08-17 (afternoon)

Continuing the Codex ArgoCD migration thread at the owner's instruction. Codex's
own worktree `D:\VSF-DUOCTHU-codex-argocd` was clean at `1684e10` with nothing
in flight when this claim was taken.

## Owned by Claude in this session

- `infra/helm/medical-chatbot/values-practice.yaml` (new)
- `infra/helm/medical-chatbot/values-practice-data.yaml` (new)
- `.github/workflows/helm-chart.yml` (practice render + assertions)
- The two personal practice ArgoCD Application specs
  (`medical-chatbot-app`, `medical-chatbot-data`) — moving inline values into
  the tracked files above.

Worktree: `D:\VSF-DUOCTHU-claude-gitops`, branch `agent/gitops-tracked-values`.

## Not touched

- `git.vinmec.tech`, team ArgoCD/k3s, team repos — hard boundary, unchanged.
- The Compose production EC2 and `realvuxbaro.me`. `infra/helm/**` is not in
  `deploy.yml`'s path filters, so pushing this work cannot restart production.
- The uncommitted AWS-static-credentials Helm diff in the main worktree
  `D:\VSF-DUOCTHU` (branch `agent/query-history`). Left exactly as found.

## Which migration risk this closes

Open risk 1 in `ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md`: the live
practice Applications carried their entire configuration in untracked inline
`spec.source.helm.values`, so the cluster could drift from the repository with
no commit recording it — the same class of failure that left practice on
DeepSeek with reranking off while production ran Qwen with reranking on.

Image tags stay inline deliberately: `.github/scripts/sync_practice_argocd.py`
regex-rewrites them on every push, so a tag committed to Git would be stale by
design. Nothing secret was inline, so nothing secret moves.

Equivalence was checked before the Application specs were edited: both tracked
files parse to structures identical to the live inline values with only the
`aiService.image` / `web.image` blocks removed.