docs: py7zip overhaul handoff (2026-10-11)

[aliasfoxkde]

Draft — docs-only handoff, no runtime changes. Do not merge until reviewed.

What this adds

docs/handoffs/2026-10-11-py7zip-overhaul.md (896 lines): execution plan for the requested overhaul — OS/CPU/libc detection, official upstream binary acquisition, integrity/authenticity verification, safe cache/install/update, API/CLI ergonomics, packaging, tests, CI/release, supply-chain and support policy.

Consumes the landed audit docs/handoffs/PLATFORM_ARCHITECTURE_PY7ZIP_2026-10-10.md (F1–F14 → OVH task IDs); adds newly verified evidence and a phased task ledger (OVH-01…29) with acceptance commands, rollback, risks, and decisions required.

Headline findings (all verified in the doc's evidence appendix)

• First production blocker: pip install py7zip serves 0.6.2 (2024-02-25) — the legacy shell=True runtime; every hardening line is unreleased (PyPI JSON).
• Bundled binaries identify as official-format "7-Zip (z) 24.00"; the "(z)" marker is official upstream branding (refuted the zstd-fork hypothesis by direct comparison with official 26.04), and no per-artifact provenance is recorded → OVH-02 ledger.
• Acquisition today pulls from this repo's mutable raw/main with self-pinned digests; the plan switches to github.com/ip7z/7zip release assets with dual-channel digest verification — proven live: local sha256 of 7z2604-linux-x64.tar.xz equals the GitHub API assets[].digest.
• Official Linux tarball ships statically linked 7zzs (removes the glibc/musl constraint) alongside dynamic 7zz (GLIBC ≤ 2.16), plus License.txt — fixes the redistribution requirement.
• Isolated python -m build passes, but older ambient setuptools rejects the classifiers ("Python :: 3 :: 9" is not a trove classifier) → OVH-01 is the bounded next task (metadata-only).
• Branch topology: audit line is 22 commits ahead of and diverged from main (duplicate commits); phase4 worktree dirty (7 binaries) — treated as read-only external work; PR fix: Feat: support local 7zip installations, instead of downloading and running unchecked binaries directly from this Git repo. #8 disposition folded into OVH-17.

Validation

• Offline suite: unshare -rn python3 -m pytest tests -p no:cacheprovider -q → 128 passed (CPython 3.13.5).
• Wheel build isolated: succeeds (py7zip-0.7.3-py3-none-any.whl, sha256 d1970a66…); wheel confirmed to ship no binaries.

🤖 Generated with Claude Code

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9a52dfdd-1403-416e-bd25-3300a9e51075

---

📥 Commits

Reviewing files that changed from the base of the PR and between 68721cf and 54b20b4.

---

📒 Files selected for processing (1)

• docs/handoffs/2026-10-11-py7zip-overhaul.md

---

 __________________________________________________________
< Your TODOs are evolving. Soon they'll achieve sentience. >
 ----------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}