Give the service a defined piece of work
AI Core can rank retrieved context and check generated answers without taking over the rest of the LMS. It's a separate Python 3.11+ package with FastAPI, Pydantic, Uvicorn, a container and tests. Each request supplies the material needed for that operation.
A rerank request carries a query, candidate chunks, retrieval scores and a result limit. A verification request carries a structured answer or study pack, supporting material and thresholds. Responses keep the trace ID and return counts, outcomes and supporting chunk IDs.
Laravel still discovers and stores lesson sources, limits retrieval to the learner's access, calls generation, embedding and transcription providers, and selects saved guides. Python doesn't proxy those provider calls or read enrollment records.
Authenticate the caller, then keep the application checks
Versioned routes require a shared bearer token. Missing configuration returns 503; a missing or wrong credential returns 401. Health remains public, and the default documentation and OpenAPI routes are disabled. These checks identify an authorized service caller, not an authorized learner.
Pydantic rejects unexpected top-level fields and constrains the main inputs. Reranking, for example, limits query length to 1,200 characters, candidates to 300 and returned items to 50. Candidate extras and some metadata remain flexible, so this isn't a complete request-size or resource limit.
Laravel must authorize the lesson material before it crosses the HTTP call and interpret the result afterward. Keeping that responsibility in the parent application is what makes the service narrow; a bearer token or a returned text field cannot replace it.