FALCONIUM BACKEND ARCHITECTURE

Duplicate RAPTOR agents. The chats app has its own RaptorAIAgent (raptor_chain.py) and the mcp_server app has two separate copies (mcr_internal_documents.py, mcr_external_documents.py). These are independent implementations of the same logic — changes to one don't propagate to the other. This will cause bugs as the system evolves.

Emails are an island. The mails app is fully stateless — it stores nothing locally and has zero connection to the AI pipeline. Emails can't be searched by Falconium's AI, can't be referenced in conversations, and aren't indexed in Weaviate. The AI can't help with email-related queries like "summarise my recent emails about Project X."

Meeting transcripts are an island. The meetings app stores transcripts as a TextField, but they're never indexed into Weaviate. The AI can't search meeting content, extract action items, or answer questions like "what did we discuss about the deadline?"

Dead code in chats — old AIAgent. The chats/ai_services/main.py contains the original AIAgent class with its own routing logic, alongside the newer RaptorAIAgent. The old LLMResponseView endpoint is commented out in urls.py. This dead code creates confusion about which pipeline is active.

FalconiumConfig type choices don't match usage. The model defines types like "frontend_model", "standard_files_retrieval", etc. But the chats AI code calls get_active_prompt() with keys like "routing", "format_retrival_query" — these don't appear in the defined type choices. The lookup relies on a generic query that works despite the mismatch, but it's fragile.

Two Weaviate schemas for essentially the same purpose. User files go into External_documents (with user_id) and system docs go into RAPTORNode (without user_id). The chats RAPTOR agent only searches RAPTORNode. The mcp_server has separate agents for each. This split means a user asking "search all documents" only sees one set.

n8n orchestration invisible to backend. The CLAUDE.md describes n8n as the MVP orchestration layer, but there's no n8n integration in the Django code. n8n presumably calls the API externally, but the backend has no awareness of multi-agent workflows, handoffs, or orchestration state.

Password reset emails go to ADMIN_EMAILS, not the user. In accounts/tasks.py, the reset link is sent to settings.ADMIN_EMAILS rather than the requesting user's email. Likely a development shortcut but will need fixing before any client deployment.

JWT access tokens valid for 70 days. ACCESS_TOKEN_LIFETIME = timedelta(days=70) is extremely long for a security-sensitive financial application. Industry standard is 15-60 minutes with refresh tokens handling re-authentication.

CORS allows all origins. CORS_ORIGIN_ALLOW_ALL = True is fine for development but must be restricted before any external deployment.

ElevenLabs voice synthesis not in backend. Referenced in architecture docs and the iPad app likely calls it directly, but there's no backend endpoint for voice generation. This may be intentional (client-side) but worth noting.