SEC-004: stop shipping pytest in the production image

[DoRmAmMu1997]

Found during the September 2026 tech-debt audit (see the register section in #118).

Problem

pytest is declared as a runtime dependency:

# requirements.txt:45-46
# Test runner.
pytest

Dockerfile:46-48 installs requirements.txt (with constraints.txt) and nothing else, so pytest and its transitive dependencies ship inside the production image — on the Render web service and the daily-scan cron alike.

It is already correctly listed in requirements-dev.txt:5, so this is a duplicate that buys nothing and only widens the production surface.

Fix

Remove the # Test runner. block from requirements.txt. pytest stays pinned in constraints.txt (which is fine — constraints only pin versions for whatever is actually being installed) and stays declared in requirements-dev.txt, so CI and local development are unaffected.

Watch out for

tests/test_supply_chain_policy.py:187-201 asserts that a list of names — including pytest — appears with an exact == pin in constraints.txt. That assertion is about constraints.txt, not requirements.txt, so it should keep passing untouched. Worth re-reading before editing, and worth confirming CI still installs pytest via -r requirements-dev.txt.

Acceptance

• pytest no longer appears in requirements.txt.
• docker build succeeds and pip show pytest inside the image fails.
• The full CI matrix still passes, including test_supply_chain_policy.py.

Related, but deliberately separate

requirements-optional.txt has its own problem — bare TA-Lib and pandas_ta with no pins, absent from constraints.txt, so pip_audit -r constraints.txt never audits them. Compounding it, no test ever exercises the accelerated branches they enable (backend/indicators.py:581,601,621,660,708,771,1016,1118), because CI never installs the packages. pandas_ta is also effectively unmaintained and known to break against numpy ≥ 2 while this repo pins numpy==2.4.6. That deserves its own ticket, including the question of whether the pandas_ta path should simply be deleted.

🤖 Generated with Claude Code