lai_automatisierung/README.md

LAI Coding Automation

This service turns explicitly queued Gitea issues into reviewed pull requests. It no longer reads the Laravel production database and does not merge changes automatically.

Workflow

1. LAI creates one unlabeled Gitea issue for a wrong-answer report.
2. An administrator reviews it and explicitly applies ai:queued, either through the LAI admin dashboard or directly in Gitea.
3. This worker replaces the label with ai:running, clones main, and creates ai/issue-N.
4. mini-SWE-agent 2.4.6 implements the issue in a credential-free, unprivileged command environment.
5. The worker rejects protected paths, symlinks, empty patches, and oversized diffs.
6. Deterministic setup and test commands run with isolated test database credentials.
7. A pull request containing Fixes #N, the original problem, changed files, and checks is opened.
8. The issue is labeled ai:ready or ai:failed and receives a status comment.

Normal reports are never selected automatically. The manual ai:queued label is the explicit approval and the only worker trigger.

Human review and merge are always required.

Security boundary

• Gitea and model credentials exist only in the root worker process.
• Agent-issued commands receive a strict environment without inherited worker variables.
• The agent runs as the unprivileged coder user.
• Git metadata lives outside the writable worktree, and Git hooks are disabled for commits.
• The Docker socket is not mounted. Repository cloning and pushing use HTTPS with a temporary GIT_ASKPASS credential file that is deleted immediately.
• .env, CI, Docker/deployment files, dependencies, generated storage, and symlinks are rejected.

The container is the intended execution boundary. Do not run the worker directly on a developer host.

Configuration

Copy .env.example to .env and set GITEA_TOKEN plus MISTRAL_API_KEY. Existing test database settings can be retained. Commands are separated with ;;. Laravel's default connection uses TEST_DB_NAME, the ERP connection uses TEST_CUSTOMER_DB, and cross-schema cockpit fixtures use TEST_CONFIG_DB. The worker enables database integration tests and supplies a non-secret placeholder AI key so mocked provider-discovery tests execute deterministically. Real Gitea and model credentials are never copied into the test or agent command environment.

Start the worker with Docker Compose. Use lai-agent check inside the image for configuration validation, lai-agent preflight for clean-clone setup and tests without a model call, or lai-agent once for a single polling cycle.

Archived implementation

The previous database-polling Aider implementation is preserved unchanged in old_2026-08-31/.