# LAI Coding Automation

This service turns explicitly queued Gitea issues into reviewed pull requests. It no longer reads the
Laravel production database and does not merge changes automatically.

## Workflow

1. LAI creates one unlabeled Gitea issue for a wrong-answer report.
2. An administrator reviews it and explicitly applies `ai:queued`, either through the LAI admin dashboard or directly in Gitea.
3. This worker replaces the label with `ai:running`, clones `main`, and creates `ai/issue-N`.
4. mini-SWE-agent 2.4.6 implements the issue in a credential-free, unprivileged command environment.
5. The worker deterministically removes trailing spaces from newly changed text, then rejects any
  remaining whitespace errors, protected paths, symlinks, empty patches, and oversized diffs.
6. Deterministic setup and test commands run with isolated test database credentials.
7. A pull request containing `Fixes #N`, the original problem, changed files, and checks is opened.
8. The issue is labeled `ai:ready` or `ai:failed` and receives a status comment.

Normal reports are never selected automatically. The manual `ai:queued` label is the explicit approval and the only worker trigger.

Human review and merge are always required.

## Security boundary

- Gitea and model credentials exist only in the root worker process.
- Agent-issued commands receive a strict environment without inherited worker variables.
- The agent runs as the unprivileged `coder` user.
- Git metadata lives outside the writable worktree, and Git hooks are disabled for commits.
- The Docker socket is not mounted. Repository cloning and pushing use HTTPS with a temporary
  `GIT_ASKPASS` credential file that is deleted immediately.
- `.env`, CI, Docker/deployment files, dependencies, generated storage, and symlinks are rejected.

The container is the intended execution boundary. Do not run the worker directly on a developer host.

## Configuration

Copy `.env.example` to `.env` and set `GITEA_TOKEN` plus `MISTRAL_API_KEY`. Existing test database
settings can be retained. Commands are separated with `;;`. Laravel's default connection uses
`TEST_DB_NAME`, the ERP connection uses `TEST_CUSTOMER_DB`, and cross-schema cockpit fixtures use
`TEST_CONFIG_DB`. The worker enables database integration tests and supplies a non-secret
placeholder AI key so mocked provider-discovery tests execute deterministically. Real Gitea and
model credentials are never copied into the test or agent command environment.

Start the worker with Docker Compose. Use `lai-agent check` inside the image for configuration
validation, `lai-agent preflight` for clean-clone setup and tests without a model call, or
`lai-agent once` for a single polling cycle.

Set `LOG_LEVEL=DEBUG` to include redacted output from setup and test commands. Agent runs always
log their model, configured limits, call count, cost, exit status, and trajectory path. `INFO` is
the default for normal operation.

`MAX_AGENT_ATTEMPTS` controls validation-driven self-repair. When an agent submission fails policy,
diff, or test validation, the worker preserves the workspace and gives the redacted failure output
to a fresh agent attempt. Only the final failed attempt marks the issue as `ai:failed` and removes
the workspace.

## Archived implementation

The previous database-polling Aider implementation is preserved unchanged in `old_2026-08-31/`.