fix: remediate 2026-10-03 code review (F1-F8)

[libre-7]

Summary

Remediation of the 2026-10-03 code review of main @ 82c8882 (v1.3.0). Eight findings: two High, three Medium, three Low.

No image behaviour change for a correctly-configured deployment. The point of F1/F2/F3 is that three failure modes stop being silent and start being loud.

Fixes the review of f3117dd (2026-09-29) landed are all still intact — this builds on PRs #28–#31 rather than reverting them.

The two High findings

F1 — install-websockets.sh installed websockets where the gateway cannot import it.

The script used bare pip / python3 via docker exec. The gateway runs /app/venv/bin/python3, in a venv created with include-system-site-packages = false:

$ cat /app/venv/pyvenv.cfg
include-system-site-packages = false
'/usr/local/lib/python3.12/site-packages' in sys.path   ->  False

So the dependency landed in the system interpreter (or ~/.local) — neither is on the venv's sys.path — and the script then "verified" it with the same wrong interpreter, printed success, and left the platform unable to load. The documented happy path (README tells users to re-run this after every rebuild) could not work.

The same defect made the adapter lookup fail: import plugins... under the wrong interpreter raises, then find /app/venv -path '*/simplex/adapter.py' returns nothing on a current Hermes layout (the plugin lives in /app/hermes-agent-src). The script printed ⚠ skipping DM send verification and exited 0 — so the verification PR #28 added as its headline fix never ran.

Now: resolves the venv explicitly (HERMES_VENV, default /app/venv) for install and verification, pins websockets==17.0.1 to match the image, widens the find, and warns loudly if the venv is missing instead of silently falling back.

F2 — both readiness gates matched any port containing the number.

ss -tln | grep -q :5225     # also matches 15225, 52250, 52251…

Under network_mode: host — which this project requires, so the containers share loopback — ss lists the entire host's listening sockets. An unrelated host service on a port containing 5225 would satisfy the startup gate and report the WebSocket API ready while simplex-chat was still starting or already dead. The socat gate had the same exposure.

Replaced with a shared port_listening() helper that anchors on the exact port. Both code paths anchor deliberately: the sport = :PORT filter is also re-verified with awk rather than trusted via grep -q ., because an ss that doesn't understand the filter prints the whole socket table and grep -q . would match any line. (That second bug was in my first attempt at this fix — the mutation test caught it.)

Medium and Low

#	Fix
F3	/_address_settings 1 … used a literal 1. The daemon's contract is /_address_settings <userId> <json(settings)> (verified in bots/api/COMMANDS.md @ v7.0.2), so the id now comes from the /user activeUser response, with userContactLinkCreated / usersList fallbacks. Success was detected by searching any event for the substring userContactLinkUpdated; it now correlates the corrId the daemon echoes (Server.hs wraps every response as {corrId, resp}). Skips with a warning when no id is determinable, rather than applying settings to a guessed profile.
F4	README.md:196 still described the removed sed -i adapter patching, fourteen lines below the note saying it was removed.
F5	base-refresh.yml called skopeo, which isn't on ubuntu-latest and had no install step — and with no set -e the empty result was silent. Now uses preinstalled docker buildx imagetools inspect, set -euo pipefail, and fails loudly on an empty digest.
F6	Unraid template floated :latest while compose pinned a digest, so Unraid's Update button could silently jump versions. Pinned to v1.3.0.
F7	README.md:238 said "v1.2.0" directly above a # v1.3.0 digest.
F8	Added SECURITY.md — private reporting path plus an explicit threat-model statement (unauthenticated API, loopback default, socat opt-in removes that protection).

Tests

No Docker or network needed — bash tests/run-all.sh:

• test-port-gate.sh — creates real TCP listeners and asserts port_listening() matches an exact port: decoy-port case, the awk fallback for old iproute2, empty socket table, and fail-closed when ss is absent. The function body is extracted from entrypoint.sh at runtime so the test can't drift from what ships.
• test-installer-interpreter.sh — stubs docker and pip, asserts the installer uses only absolute venv paths, pins the version, finds an adapter outside the venv, and fails on an unrecognised adapter. Skips (exit 77) where no Hermes install exists.
• test-setup-userid.py — drives the real setup block from entrypoint.sh against a fake WebSocket daemon, including a wrong-corrId decoy that the old substring match would have accepted as success.
• check-docs.py — pin/version agreement across README, compose, and the template; documented env vars exist in code; installer executes no sed -i.

Wired into the lint CI job so a regression fails the build rather than surfacing at runtime.

Verification

Gate	Result
bash tests/run-all.sh	all gates passed
shellcheck entrypoint.sh install-websockets.sh tests/*.sh	clean, 0 findings
py_compile (healthcheck + tests)	OK
YAML / XML parse	OK
Mutation testing	each behavioural suite re-run against a deliberately re-introduced version of its bug → failed as expected, then green again on restore

Not verified: no container was built or booted (no Docker CLI in the review environment). Socat bridge startup, first-run setup against live SMP servers, and real-silicon ARM64 remain covered only by the existing CI smoke matrix — which will exercise the reworked port_listening() on both amd64 and emulated arm64.

Upstream CLI flags used by the entrypoint were re-verified against simplex-chat v7.0.2 source (-p chat-server-port, -y yes-migrate, -r mark-read, -x SOCKS5 :9050, --create-bot-*), as was the -d file-prefix DB behaviour.