chore: remove the superseded Python backend

[chenyuan99]

Summary

Removes the Python Flask backend, which is unreachable from the running app and is the repository's single largest source of dependency risk.

57 files changed, 49 of them deletions under backend/.

Why it is dead

• firebase.json deploys only functions/
• The frontend calls Firebase callables and never referenced VITE_API_URL — the variable the Flask service was exposed under in docker-compose.yml
• backend/app.py did not import task_manager, tax_forms, or form_filler

This was established in #69, where the stale architecture description in CLAUDE.md had already misdirected planning twice.

Why it matters beyond cleanup

FOSSA attributes to backend/requirements.txt all 7 open license issues and roughly 34 of the 64 vulnerabilities:

Package	Vulnerabilities	License issues
pillow 10.4.0	17	1
cryptography 42.0.0	7	—
PyJWT 2.8.0	5	—
requests 2.32.0	2	—
reportlab 4.0.0	—	4
faiss-cpu 1.15.0	—	1
urllib3 2.2.2	—	1
idna, pytest, PyPDF2	3	—

Dependabot never surfaced any of these — it is only watching npm in this repo, which is why they went unnoticed while the npm alerts were being triaged in #70.

Removed

• backend/ — 49 files: Flask app, LangChain agents, parser, tax_forms, queue, embedding/FAISS index, RAG pipelines, prompts, samples
• docker/backend/Dockerfile, plus the backend service, its backend_data volume, and the frontend's depends_on in docker-compose.yml
• The now-unused VITE_API_URL build arg from docker-compose.yml and docker/frontend/Dockerfile
• .github/workflows/backend.yml, which only ran pytest against the deleted backend/parser/functions

Checks that nothing live depended on it

• functions/src contains no reference to backend
• The agent prompts in use are functions/prompts/{accountant,auditor}.md, loaded by functions/src/prompts.ts. The backend/agents/skills/*.md copies were the superseded originals.
• faiss-cpu had zero imports anywhere in the repository
• reportlab, Pillow/PIL, and pytesseract were imported only by backend/tax_forms/form_filler.py, backend/queue/task_processors.py, backend/src/chatbot.py, and backend/src/openai/rag_pipeline.py — all deleted
• urllib3 had no direct imports; it was pinned only as a version floor
• The remaining workflows (firebase-deploy.yml, frontend.yml, upgrade-docs.yml) contain no reference to backend, python, or pytest

Verification

• frontend: npm run build succeeds, 13/13 tests pass
• functions: npx tsc --noEmit clean, 60/60 tests pass
• docker compose config parses
• api-docs/openapi.yml parses (12 paths)

Docs updated

README.md, CLAUDE.md, and docker/README.md all described the Flask backend as current. Also corrected two stale references the deletion exposed: CLAUDE.md claimed extraction ran via parser.py (it runs via flows/extractor.ts), and api-docs/openapi.yml pointed /sample/{filename} at the deleted backend/sample directory.

Note

api-docs/openapi.yml documents several REST endpoints that have no implementation in functions/ — /sample/{filename} was one, served by the removed Flask dev server. I marked that one as not implemented rather than deleting the path, since reconciling the whole spec against the callable-function reality is a separate piece of work.

Everything here is recoverable from git history if any of it turns out to be wanted.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud