LAI Coding Automation

This service turns explicitly queued Gitea issues into reviewed pull requests. It no longer reads the Laravel production database and does not merge changes automatically.

Workflow

1. LAI creates one unlabeled Gitea issue for a wrong-answer report.
2. An administrator reviews it and explicitly applies ai:queued, either through the LAI admin dashboard or directly in Gitea.
3. This worker replaces the label with ai:running, clones main, and creates ai/issue-N.
4. mini-SWE-agent 2.4.6 implements the issue in a credential-free, unprivileged command environment.
5. The worker deterministically removes trailing spaces from newly changed text, then rejects any remaining whitespace errors, protected paths, symlinks, empty patches, and oversized diffs.
6. Deterministic setup and test commands run with isolated test database credentials.
7. A pull request containing Fixes #N, the original problem, changed files, and checks is opened.
8. The issue is labeled ai:ready or ai:failed and receives a status comment.

Normal reports are never selected automatically. The manual ai:queued label is the explicit approval and the only worker trigger.

Human review and merge are always required.

Security boundary

• Gitea and model credentials exist only in the root worker process.
• Agent-issued commands receive a strict environment without inherited worker variables.
• The agent runs as the unprivileged coder user.
• Git metadata lives outside the writable worktree, and Git hooks are disabled for commits.
• The Docker socket is not mounted. Repository cloning and pushing use HTTPS with a temporary GIT_ASKPASS credential file that is deleted immediately.
• .env, CI, Docker/deployment files, dependencies, generated storage, and symlinks are rejected.

The container is the intended execution boundary. Do not run the worker directly on a developer host.

Configuration

Copy .env.example to .env and set GITEA_TOKEN plus MISTRAL_API_KEY. Existing test database settings can be retained. Commands are separated with ;;. Laravel's default connection uses TEST_DB_NAME, the ERP connection uses TEST_CUSTOMER_DB, and cross-schema cockpit fixtures use TEST_CONFIG_DB. The worker enables database integration tests and supplies a non-secret placeholder AI key so mocked provider-discovery tests execute deterministically. Real Gitea and model credentials are never copied into the test or agent command environment.

Start the worker with Docker Compose. Use lai-agent check inside the image for configuration validation, lai-agent preflight for clean-clone setup and tests without a model call, or lai-agent once for a single polling cycle.

Set LOG_LEVEL=DEBUG to include redacted output from setup and test commands. Agent runs always log their model, configured limits, call count, cost, exit status, and trajectory path. INFO is the default for normal operation.

MAX_AGENT_ATTEMPTS controls validation-driven self-repair. When an agent submission fails policy, diff, or test validation, the worker preserves the workspace and gives the redacted failure output to a fresh agent attempt. Only the final failed attempt marks the issue as ai:failed and removes the workspace.

Archived implementation

The previous database-polling Aider implementation is preserved unchanged in old_2026-08-31/.