# Phase 5 — AI Analyst: apply cp -R phase5-ai/app/* ./app/ cp -R phase5-ai/config/* ./config/ cp -R phase5-ai/database/* ./database/ cp -R phase5-ai/resources/* ./resources/ cp -R phase5-ai/tests/* ./tests/ ## bootstrap/providers.php — register: App\AI\AIServiceProvider::class, ## routes/web.php — merge routes/ai-web.php; REMOVE the '/ai' stub from the stub loop. ## .env — add your LLM key (this is what makes it live): AI_PROVIDER=anthropic ANTHROPIC_API_KEY=sk-ant-... ANTHROPIC_MODEL=claude-sonnet-4-6 AI_DAILY_MESSAGE_LIMIT=200 ## CSRF meta tag — ensure resources/views/app.blade.php has: (The chat UI reads it for the fetch POST.) ## Migrate, build, test php artisan migrate --force php artisan test --filter=AiAnalyst node node_modules/vite/bin/vite.js build ## The safety model (why the AI can't lie or overreach) - The model's ONLY capabilities are the four tools in AnalystTools. No SQL, no DB handle. - Every number comes from query_metric -> MetricQueryService (governed, permission-checked). - Financial/advertising metrics are blocked per-user by the same gates dashboards use. - Every tool call is logged (ai_tool_calls) with args, row count, and permitted flag. - A tool-iteration guard and a per-org daily message limit cap runaway usage/cost. - The tests prove: real values not fabricated, financial block for unpermitted users, full tool-loop logging, and limit enforcement. ## Without an API key The UI works and stores messages, but /ai/ask will error at the provider call until ANTHROPIC_API_KEY is set. That's expected — add the key to go live.