Where to go next

You built a complete system, and it is worth saying out loud what that covered. A client brief turned into an evaluation contract. Two Azure services provisioned from the CLI and tested in isolation. A hybrid extraction pipeline with auditable provenance. A finance policy in pure Python. A FastAPI and SQLite backend measured before it existed as HTTP. A React portal that adds presentation and no rules. And a real deployment on Azure Container Apps, torn down with one command.

More useful than any single technology is the shape. Understand the problem, understand the data, test the models in isolation, write deterministic policy, build the pipeline, measure it, then wrap it in an application. That order transfers to nearly every applied AI project.

The honest limits

This is local teaching software that happens to deploy, not a production accounts-payable system. Saying exactly where the line sits is part of the lesson:

• No identity. Anyone with the URL can use the deployed app
• SQLite on a file share instead of a managed database with migrations
• Synchronous processing, no job queue, no retry policy beyond the request
• No malware scanning on uploads, no audit events, no retention policy
• No monitoring beyond log streaming, no private networking
• VAT numbers are validated structurally, not against live VIES registration
• The correction email is drafted, never sent, and there is no accounting-system integration

Every one of these is a deliberate scope decision, and every one is visible rather than hidden behind a framework.

Extension points worth owning

If you want to keep building, these extend the skeleton without fighting it:

• Swap SQLite for Azure Database for PostgreSQL and add migrations, the repository layer is the only code that should notice
• Replace the API keys with managed identity, the backend already supports Entra authentication
• Put authentication in front of the app, Container Apps has built-in auth providers that require no code
• Add live VIES registration checks behind the same ValidationIssue shape, with the availability caveats handled explicitly
• Ingest documents from a mailbox instead of an upload button, which forces the async-jobs conversation
• Push approved documents into a real accounting system, and discover what idempotency means in practice

Pick the one that scares you slightly. That is where the learning is.

Keep building

Keep going