# LAI Coding Automation

This service turns explicitly queued Gitea issues into reviewed pull requests. It no longer reads the
Laravel production database and does not merge changes automatically.

## Workflow

1. LAI creates one unlabeled Gitea issue for a wrong-answer report.
2. An administrator reviews it and explicitly applies `ai:queued`, either through the LAI admin dashboard or directly in Gitea.
3. This worker replaces the label with `ai:running`, clones `main`, and creates `ai/issue-N`.
4. mini-SWE-agent 2.4.6 implements the issue in a credential-free, unprivileged command environment.
5. The worker rejects protected paths, symlinks, empty patches, and oversized diffs.
6. Deterministic setup and test commands run with isolated test database credentials.
7. A pull request containing `Fixes #N`, the original problem, changed files, and checks is opened.
8. The issue is labeled `ai:ready` or `ai:failed` and receives a status comment.

Normal reports are never selected automatically. The manual `ai:queued` label is the explicit approval and the only worker trigger.

Human review and merge are always required.

## Security boundary

- Gitea and model credentials exist only in the root worker process.
- Agent-issued commands receive a strict environment without inherited worker variables.
- The agent runs as the unprivileged `coder` user.
- Git metadata lives outside the writable worktree, and Git hooks are disabled for commits.
- The Docker socket is not mounted. Repository cloning and pushing use HTTPS with a temporary
  `GIT_ASKPASS` credential file that is deleted immediately.
- `.env`, CI, Docker/deployment files, dependencies, generated storage, and symlinks are rejected.

The container is the intended execution boundary. Do not run the worker directly on a developer host.

## Configuration

Copy `.env.example` to `.env` and set `GITEA_TOKEN` plus `MISTRAL_API_KEY`. Existing test database
settings can be retained. Commands are separated with `;;`. Laravel's default connection uses
`TEST_DB_NAME`, the ERP connection uses `TEST_CUSTOMER_DB`, and cross-schema cockpit fixtures use
`TEST_CONFIG_DB`. The worker enables database integration tests and supplies a non-secret
placeholder AI key so mocked provider-discovery tests execute deterministically. Real Gitea and
model credentials are never copied into the test or agent command environment.

Start the worker with Docker Compose. Use `lai-agent check` inside the image for configuration
validation, `lai-agent preflight` for clean-clone setup and tests without a model call, or
`lai-agent once` for a single polling cycle.

## Archived implementation

The previous database-polling Aider implementation is preserved unchanged in `old_2026-08-31/`.