duocthu/coordination/CLAUDE_CLAIM_2026-08-17.md

Claude claim — 2026-08-17 (afternoon)

Continuing the Codex ArgoCD migration thread at the owner's instruction. Codex's own worktree D:\VSF-DUOCTHU-codex-argocd was clean at 1684e10 with nothing in flight when this claim was taken.

Owned by Claude in this session

• infra/helm/medical-chatbot/values-practice.yaml (new)
• infra/helm/medical-chatbot/values-practice-data.yaml (new)
• .github/workflows/helm-chart.yml (practice render + assertions)
• The two personal practice ArgoCD Application specs (medical-chatbot-app, medical-chatbot-data) — moving inline values into the tracked files above.

Worktree: D:\VSF-DUOCTHU-claude-gitops, branch agent/gitops-tracked-values.

Not touched

• git.vinmec.tech, team ArgoCD/k3s, team repos — hard boundary, unchanged.
• The Compose production EC2 and realvuxbaro.me. infra/helm/** is not in deploy.yml's path filters, so pushing this work cannot restart production.
• The uncommitted AWS-static-credentials Helm diff in the main worktree D:\VSF-DUOCTHU (branch agent/query-history). Left exactly as found.

Which migration risk this closes

Open risk 1 in ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md: the live practice Applications carried their entire configuration in untracked inline spec.source.helm.values, so the cluster could drift from the repository with no commit recording it — the same class of failure that left practice on DeepSeek with reranking off while production ran Qwen with reranking on.

Image tags stay inline deliberately: .github/scripts/sync_practice_argocd.py regex-rewrites them on every push, so a tag committed to Git would be stale by design. Nothing secret was inline, so nothing secret moves.

Equivalence was checked before the Application specs were edited: both tracked files parse to structures identical to the live inline values with only the aiService.image / web.image blocks removed.