Merge branch 'maint'

The static compose's mixed-profile services are next-only, so the floating
subnet arrived without them: four services kept ipv4_address pins on a
network that no longer declares a subnet, which docker rejects outright at
`up`. They now float with the rest, take the per-run config directory, and
carry the run name suffix their container_name was missing.

Phase 3 of the admission-cap test conflicted for a real reason rather than a
textual one. This line asserts size-agnostically — sustained inbound from
each denied peer plus "was never promoted" — because the XX handshake
message sizes differ from IK and may change again. That assertion is kept;
what comes across from maint is the address handling underneath it, which
matters here for the same reason: with the subnet floating, a restarted
container can change address, and matching on a single one silently
under-counts the very evidence the assertion rests on.

testing/ci-local.sh

@@ -306,9 +306,12 @@ CI_CLEANED=0
 
 # Best-effort, BOUNDED teardown of every docker resource THIS run may have
 # created. Idempotent (guarded), so the signal and EXIT paths don't double-run.
+# Takes the run's exit status; defaults to non-zero, which is the conservative
+# reading for the signal path.
 ci_teardown() {
     [[ $CI_CLEANED -eq 1 ]] && return 0
     CI_CLEANED=1
+    local run_status="${1:-1}"
 
     # 1. Propagate to parallel chaos children and reap them (bounded).
     if [[ ${#CI_CHAOS_PIDS[@]} -gt 0 ]]; then
@@ -343,6 +346,17 @@ ci_teardown() {
         --project-prefix "$CI_PROJECT_PREFIX" \
         --images "$CI_IMAGE_TEST $CI_IMAGE_APP" \
         --veth-suffixes "${_suffixes[*]}" >/dev/null || true
+
+    # 3. The static suite's generated configs are per-run (a shared directory
+    #    would let concurrent runs overwrite each other's node configs), so
+    #    they are this run's to remove. Only on a green run: after a failure
+    #    they are the evidence of what the failing nodes were actually
+    #    configured with. Guarded on a non-empty suffix too, since without one
+    #    the path is the unscoped working directory a developer uses by hand,
+    #    which is not ours to delete.
+    if [[ $run_status -eq 0 && -n "${CI_RUN_NAME_SUFFIX:-}" ]]; then
+        rm -rf "$SCRIPT_DIR/static/generated-configs${CI_RUN_NAME_SUFFIX}"
+    fi
 }
 
 on_signal() {
@@ -359,7 +373,7 @@ on_signal() {
 on_exit() {
     local code=$?
     trap '' TERM INT EXIT
-    ci_teardown
+    ci_teardown "$code"
     exit "$code"
 }
 

testing/static/.gitignore

@@ -1,4 +1,4 @@
 fips
 fipsctl
 fipstop
-generated-configs
+generated-configs*

testing/static/README.md

@@ -122,7 +122,7 @@ testing/static/
 │       ├── mesh-public.yaml            # Mesh + external public node
 │       ├── tcp-chain.yaml             # TCP chain (3 nodes, port 8443)
 │       └── rekey.yaml                 # Rekey integration test (5 nodes)
-├── generated-configs/                  # Auto-generated (gitignored)
+├── generated-configs/                  # Auto-generated, run-scoped (gitignored)
 │   ├── npubs.env                       # NPUB_A=..., NPUB_B=..., etc.
 │   ├── mesh/
 │   │   ├── node-a.yaml ... node-e.yaml
@@ -151,6 +151,16 @@ Each topology file in `configs/topologies/` defines:
 - **Addresses**: `docker_ip` for Docker-managed nodes, `external_ip` for
   remote nodes not managed by Docker
 - **Peer connections**: which nodes peer with each other
+- **`docker_host`** (optional): the compose `hostname:` this node answers to,
+  when that is not `node-<id>`. Only the gateway topology needs it
+
+Generated peer addresses use the **docker hostname**, not `docker_ip`.
+`fips-net` requests no subnet, so docker assigns one from its own pool and two
+concurrent CI runs can bring the topology up at the same time instead of one
+of them failing with `Pool overlaps`. `docker_ip` is retained as documentation
+of the topology's shape and as the internal/external discriminator; an
+external node keeps its `external_ip` in peer blocks, its address not being
+ours to assign.
 
 Example entry:
 
@@ -178,6 +188,11 @@ This reads the topology definition and generates:
 1. Per-node YAML config files in `generated-configs/<topology>/`
 2. `generated-configs/npubs.env` with all node npubs as environment variables
 
+Under `ci-local.sh` the directory is `generated-configs-<run-id>`, so
+concurrent runs cannot overwrite each other's node configs; the compose file
+and every test script read the same `FIPS_CI_NAME_SUFFIX` and follow it. A
+bare invocation leaves the suffix unset and writes the plain path.
+
 The `npubs.env` file is sourced by the test scripts and injected into
 Docker containers via `env_file` in `docker-compose.yml`.
 

testing/static/configs/topologies/gateway.yaml

@@ -12,16 +12,23 @@
 # A non-FIPS client container connects via the gateway's LAN interface.
 #
 # Uses deterministic key derivation (mesh-name: gateway-test).
+#
+# docker_host is the compose service's `hostname:`, which is what peers dial.
+# This is the one static topology whose hostnames are not node-<id>, so it is
+# the one that has to declare them.
 
 nodes:
   a:
     docker_ip: "172.20.0.10"
+    docker_host: "gw-gateway"
     peers: [b, c]
 
   b:
     docker_ip: "172.20.0.11"
+    docker_host: "gw-server"
     peers: [a]
 
   c:
     docker_ip: "172.20.0.12"
+    docker_host: "gw-server-2"
     peers: [a]

testing/static/docker-chain-topology.svg

@@ -33,7 +33,7 @@
 
   <!-- Docker network boundary -->
   <rect x="30" y="65" width="640" height="175" class="net-box"/>
-  <text x="40" y="82" class="net-label">172.20.0.0/24  (docker: fips-net)</text>
+  <text x="40" y="82" class="net-label">auto-assigned subnet  (docker: fips-net)</text>
 
   <!--
     Horizontal chain layout:

testing/static/docker-compose.yml

@@ -1,11 +1,13 @@
 networks:
+  # No subnet is requested: docker assigns one from the daemon's address pool,
+  # which is what lets two concurrent CI runs bring this topology up at the
+  # same time. A fixed request is honoured verbatim, so two runs asking for the
+  # same range collide on "Pool overlaps" — the whole reason mesh nodes now
+  # peer by docker hostname rather than by address.
   fips-net:
     driver: bridge
     labels:
       - "com.corganlabs.fips-ci=1"
-    ipam:
-      config:
-        - subnet: 172.20.0.0/24
   gateway-lan:
     driver: bridge
     labels:
@@ -26,7 +28,7 @@ x-fips-common: &fips-common
     - net.ipv6.conf.all.disable_ipv6=0
   restart: "no"
   env_file:
-    - ./generated-configs/npubs.env
+    - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env
   environment:
     - RUST_LOG=info
     # Passthrough for A/B benchmarking — set on the host shell before
@@ -45,10 +47,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   node-b:
     <<: *fips-common
@@ -57,10 +58,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   node-c:
     <<: *fips-common
@@ -71,10 +71,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   node-d:
     <<: *fips-common
@@ -83,10 +82,9 @@ services:
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   node-e:
     <<: *fips-common
@@ -95,10 +93,9 @@ services:
     hostname: node-e
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Mesh-public topology (mesh + external public node) ────────
   pub-a:
@@ -108,10 +105,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   pub-b:
     <<: *fips-common
@@ -120,10 +116,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   pub-c:
     <<: *fips-common
@@ -132,10 +127,9 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   pub-d:
     <<: *fips-common
@@ -144,10 +138,9 @@ services:
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   pub-e:
     <<: *fips-common
@@ -156,10 +149,9 @@ services:
     hostname: node-e
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Chain topology (A-B-C-D-E) ────────────────────────────────
   chain-a:
@@ -169,10 +161,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   chain-b:
     <<: *fips-common
@@ -181,10 +172,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   chain-c:
     <<: *fips-common
@@ -193,10 +183,9 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   chain-d:
     <<: *fips-common
@@ -205,10 +194,9 @@ services:
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   chain-e:
     <<: *fips-common
@@ -217,10 +205,9 @@ services:
     hostname: node-e
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Rekey integration test (mesh + aggressive rekey timers) ──
   rekey-a:
@@ -232,10 +219,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   rekey-b:
     <<: *fips-common
@@ -246,10 +232,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   rekey-c:
     <<: *fips-common
@@ -260,10 +245,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   rekey-d:
     <<: *fips-common
@@ -274,10 +258,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   rekey-e:
     <<: *fips-common
@@ -288,10 +271,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Rekey + accept_connections=false on node b ──────────────────
   # Exercises the auto_connect-initiator-with-accept-off regression
@@ -307,10 +289,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   rekey-accept-off-b:
     <<: *fips-common
@@ -321,10 +302,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   rekey-accept-off-c:
     <<: *fips-common
@@ -335,10 +315,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   rekey-accept-off-d:
     <<: *fips-common
@@ -349,10 +328,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   rekey-accept-off-e:
     <<: *fips-common
@@ -363,10 +341,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Rekey topology with udp.outbound_only=true on node b ────
   # Exercises the udp.outbound_only rekey-msg1 admission regression
@@ -387,10 +364,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   rekey-outbound-only-b:
     <<: *fips-common
@@ -401,10 +377,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   rekey-outbound-only-c:
     <<: *fips-common
@@ -415,10 +390,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   rekey-outbound-only-d:
     <<: *fips-common
@@ -429,10 +403,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   rekey-outbound-only-e:
     <<: *fips-common
@@ -443,10 +416,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── TCP chain topology (A-B-C) ───────────────────────────────
   tcp-a:
@@ -456,10 +428,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   tcp-b:
     <<: *fips-common
@@ -468,10 +439,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   tcp-c:
     <<: *fips-common
@@ -480,60 +450,55 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   # ── Mixed-profile topology ─────────────────────────────────────────
   # A (Full) + B (Full) + C (NonRouting) + D (Leaf)
   mixed-a:
     <<: *fips-common
     profiles: ["mixed-profile"]
-    container_name: fips-node-a
+    container_name: fips-node-a${FIPS_CI_NAME_SUFFIX:-}
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mixed-profile/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mixed-profile/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   mixed-b:
     <<: *fips-common
     profiles: ["mixed-profile"]
-    container_name: fips-node-b
+    container_name: fips-node-b${FIPS_CI_NAME_SUFFIX:-}
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mixed-profile/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mixed-profile/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   mixed-c:
     <<: *fips-common
     profiles: ["mixed-profile"]
-    container_name: fips-node-c
+    container_name: fips-node-c${FIPS_CI_NAME_SUFFIX:-}
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mixed-profile/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mixed-profile/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   mixed-d:
     <<: *fips-common
     profiles: ["mixed-profile"]
-    container_name: fips-node-d
+    container_name: fips-node-d${FIPS_CI_NAME_SUFFIX:-}
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mixed-profile/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mixed-profile/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   # ── Gateway integration test (gateway + server + non-FIPS client) ─
   gw-gateway:
@@ -554,10 +519,9 @@ services:
       - net.ipv6.conf.all.proxy_ndp=1
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/gateway/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
       gateway-lan:
         ipv4_address: 172.20.1.10
         ipv6_address: fd02::10
@@ -569,10 +533,9 @@ services:
     hostname: gw-server
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/gateway/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   # Second mesh destination — gives gw-client-2 a distinct npub to target
   # so the gateway allocates a separate virtual-IP mapping per LAN client.
@@ -584,10 +547,9 @@ services:
     hostname: gw-server-2
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/gateway/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   gw-client:
     image: ${FIPS_TEST_APP_IMAGE:-fips-test-app:latest}
@@ -606,7 +568,7 @@ services:
         ipv6_address: fd02::20
     restart: "no"
     env_file:
-      - ./generated-configs/npubs.env
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env
 
   # Second LAN client — exercises concurrent multi-client mappings.
   # Same image and gateway-lan attachment as
@@ -628,4 +590,4 @@ services:
         ipv6_address: fd02::21
     restart: "no"
     env_file:
-      - ./generated-configs/npubs.env
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env

testing/static/docker-mesh-topology.svg

@@ -35,7 +35,7 @@
 
   <!-- Docker network boundary -->
   <rect x="40" y="62" width="620" height="310" class="net-box"/>
-  <text x="52" y="78" class="net-label">172.20.0.0/24  (docker: fips-net)</text>
+  <text x="52" y="78" class="net-label">auto-assigned subnet  (docker: fips-net)</text>
 
   <!--
     Pentagon layout (centered at 350,225):

testing/static/scripts/admission-cap-test.sh

@@ -39,7 +39,7 @@ TOPO_FILE="$SCRIPT_DIR/../configs/topologies/$TOPOLOGY.yaml"
 # before building Docker images.
 if [ "${1:-}" = "inject-config" ]; then
     echo "Injecting node.limits.max_peers: $MAX_PEERS into node-$CAP_NODE ($TOPOLOGY topology)..."
-    cfg="$SCRIPT_DIR/../generated-configs/$TOPOLOGY/node-$CAP_NODE.yaml"
+    cfg="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/$TOPOLOGY/node-$CAP_NODE.yaml"
     if [ ! -f "$cfg" ]; then
         echo "  Error: $cfg not found (run generate-configs.sh $TOPOLOGY first)" >&2
         exit 1
@@ -67,11 +67,22 @@ info() { echo "[$(stamp)] $*"; }
 fail() { echo "[$(stamp)] FAIL: $*"; exit 1; }
 pass() { echo "[$(stamp)] PASS: $*"; }
 
-# Extract docker_ip for a node from the topology file
+# A node's docker address, read from the running container.
+#
+# NOT from the topology file's docker_ip: fips-net requests no subnet, so that
+# two concurrent CI runs cannot collide on one fixed range, and docker assigns
+# the addresses at `up`. A topology literal would no longer match anything on
+# the wire, and the phase-3 tcpdump assertions are built from these addresses
+# — a stale one turns "no Msg2 leaked" into a check that cannot fail.
+# Takes the first attachment only: these nodes have one, and concatenating two
+# would yield a string that is not an address at all. The `|| true` keeps a
+# missing container from killing the script under `set -e` before the caller
+# can say which container it was.
 node_ip() {
-    grep -A 5 "^  $1:" "$TOPO_FILE" \
-        | grep -m1 'docker_ip:' \
-        | sed 's/.*: *"*\([^"]*\)".*/\1/'
+    docker inspect \
+        -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' \
+        "fips-node-${1}${FIPS_CI_NAME_SUFFIX:-}" 2>/dev/null \
+        | awk '{print $1}' || true
 }
 
 # Extract npub for a node from the topology file
@@ -91,7 +102,7 @@ node_peers() {
 }
 
 CAP_IP=$(node_ip "$CAP_NODE")
-[ -n "$CAP_IP" ] || fail "could not resolve docker_ip for node-$CAP_NODE in $TOPO_FILE"
+[ -n "$CAP_IP" ] || fail "could not read the docker address of container fips-node-${CAP_NODE}${FIPS_CI_NAME_SUFFIX:-}"
 info "cap'd node: node-$CAP_NODE (ip $CAP_IP, max_peers=$MAX_PEERS)"
 
 # Read the cap'd node's peer_count, or the empty string if it did not answer.
@@ -138,6 +149,32 @@ info "denied (sustained-retry): ${DENIED:-<none>}"
 [ -n "$DENIED" ] \
     || fail "no denied peers — test setup wrong (cap=$MAX_PEERS too high vs configured peers)"
 
+# Every address a denied peer holds during the capture, one "node ip" line per
+# observation.
+#
+# It is not one address per node. `fips-net` requests no subnet so that
+# concurrent CI runs cannot collide on one, and the load driver below restarts
+# these containers repeatedly — docker frees the address on stop and may hand
+# back a different one, which was impossible while the compose pinned
+# ipv4_address. Observed live: node-d went 10.128.2.4 → 10.128.2.6 mid-window.
+# Phase 3 matches against the union, because an address that held for only part
+# of the window under-counts Msg1 and, worse, satisfies the expect-zero Msg2
+# assertion for the wrong reason.
+ADDR_FILE=$(mktemp /tmp/admission-cap-addrs.XXXXXX)
+record_denied_addrs() {
+    local n n_ip
+    for n in $DENIED; do
+        n_ip=$(node_ip "$n")
+        [ -n "$n_ip" ] || continue
+        grep -qxF "$n $n_ip" "$ADDR_FILE" 2>/dev/null || echo "$n $n_ip" >> "$ADDR_FILE"
+    done
+}
+record_denied_addrs
+for n in $DENIED; do
+    grep -q "^$n " "$ADDR_FILE" \
+        || fail "could not read the docker address of denied peer node-$n"
+done
+
 # ── Phase 2: capture wire traffic for CAPTURE_SECS seconds ───────────
 # Drives sustained load by restarting denied peer containers on a cadence
 # during the capture window. Each restart resets the auto-reconnect
@@ -156,10 +193,18 @@ HELPER_IMAGE=$(docker inspect -f '{{.Config.Image}}' "fips-node-${CAP_NODE}${FIP
     while [ $elapsed -lt $((CAPTURE_SECS - 5)) ]; do
         sleep 15
         elapsed=$((elapsed + 15))
+        # ONE AT A TIME, deliberately. Restarting them together frees both
+        # addresses at once and docker reallocates in completion order, so the
+        # two peers SWAP — observed live, and it destroys per-peer attribution
+        # because both then match the same address set. Restarted singly, a
+        # container frees its address and immediately reclaims it as the
+        # lowest free one, so each keeps its own.
         for n in $DENIED; do
-            docker restart "fips-node-${n}${FIPS_CI_NAME_SUFFIX:-}" >/dev/null 2>&1 &
+            docker restart "fips-node-${n}${FIPS_CI_NAME_SUFFIX:-}" >/dev/null 2>&1 || true
         done
-        wait
+        # Belt and braces: a restart may still move an address, so re-read
+        # rather than assuming the pre-capture snapshot still holds.
+        record_denied_addrs
         info "  [load-driver] restarted denied peers ($DENIED) at t+${elapsed}s"
     done
 ) &
@@ -185,17 +230,44 @@ info "captured $captured tcpdump lines → $CAP_FILE"
 info "phase 3: per-denied-peer assertion (sustained inbound retries > 0, not promoted)"
 OVERALL=0
 TOTAL_IN=0
+# One last observation: the final restart round may have moved an address after
+# the driver's own record.
+record_denied_addrs
+
+# The cap'd node is never restarted, so its address must not have moved. If it
+# did, every pattern below covers only part of the window and the counts mean
+# nothing — that is a harness failure, not a cap regression.
+cap_ip_now=$(node_ip "$CAP_NODE")
+[ "$cap_ip_now" = "$CAP_IP" ] \
+    || fail "cap'd node address moved during the capture ($CAP_IP → ${cap_ip_now:-<unreadable>}) though it was never restarted"
+cap_re=$(printf '%s' "$CAP_IP" | sed 's/\./\\./g')
+
+# Two denied peers must never have held the same address, or the per-peer
+# counts below are not per-peer: each would match the other's traffic and the
+# "this peer is sustained-retrying" assertion could be satisfied entirely by
+# its neighbour. Serialized restarts above are what prevent it; this is the
+# check that says so out loud if they ever stop working.
+dup=$(awk '{ if (seen[$2] != "" && seen[$2] != $1) print $2; seen[$2] = $1 }' "$ADDR_FILE" | sort -u)
+[ -z "$dup" ] \
+    || fail "denied peers shared an address during the capture ($(echo "$dup" | paste -sd, -)); per-peer attribution is not possible"
+
 FINAL_PEERS=$(docker exec "fips-node-${CAP_NODE}${FIPS_CI_NAME_SUFFIX:-}" fipsctl show peers 2>/dev/null \
     | grep -oE 'npub1[a-z0-9]+' | sort -u || true)
 for n in $DENIED; do
-    n_ip=$(node_ip "$n")
+    # Match every address this peer held during the window, not just its last:
+    # a restart can move it, and grepping for one of several under-counts the
+    # inbound evidence this assertion rests on.
+    n_re=$(awk -v n="$n" '$1 == n { gsub(/\./, "\\.", $2); printf "%s%s", (c++ ? "|" : ""), $2 }' "$ADDR_FILE")
+    [ -n "$n_re" ] \
+        || fail "no docker address was ever recorded for denied peer node-$n"
+    n_seen=$(awk -v n="$n" '$1 == n {print $2}' "$ADDR_FILE" | paste -sd, -)
     n_npub=$(node_npub "$n")
     # Sustained retry: any inbound UDP from the denied peer to the cap'd
     # node, regardless of handshake message size.
-    in_count=$(grep -cE "IP $n_ip\.[0-9]+ > $CAP_IP\.2121:" "$CAP_FILE" || true)
+    in_count=$(grep -cE "IP ($n_re)\.[0-9]+ > $cap_re\.2121:" "$CAP_FILE" || true)
     promoted="no"
     if echo "$FINAL_PEERS" | grep -q "$n_npub"; then promoted="yes"; fi
-    info "  node-$n ($n_ip): inbound packets = $in_count, promoted = $promoted"
+    info "  node-$n ($n_seen): inbound packets = $in_count, promoted = $promoted"
     TOTAL_IN=$((TOTAL_IN + in_count))
     if [ "$in_count" -eq 0 ]; then
         info "    FAIL: no inbound from denied peer (peer not sustained-retrying?)"

testing/static/scripts/bench-multirun.sh

@@ -31,7 +31,7 @@ if ! [[ "$RUNS" =~ ^[1-9][0-9]*$ ]] || [ "$RUNS" -lt 1 ]; then
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1

testing/static/scripts/gateway-test.sh

@@ -17,7 +17,7 @@ trap 'echo ""; echo "Test interrupted"; exit 130' INT
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../../lib/wait-converge.sh"
 
-GENERATED_DIR="$SCRIPT_DIR/../generated-configs"
+GENERATED_DIR="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 ENV_FILE="$GENERATED_DIR/npubs.env"
 
 GATEWAY="fips-gw-gateway${FIPS_CI_NAME_SUFFIX:-}"

testing/static/scripts/generate-configs.sh

@@ -10,25 +10,47 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONFIG_DIR="$SCRIPT_DIR/../configs"
-GENERATED_DIR="$SCRIPT_DIR/../generated-configs"
+# Scoped by the CI run suffix so two concurrent runs cannot overwrite each
+# other's generated configs or npubs.env. Unset (a bare invocation) renders
+# the historical unscoped path.
+GENERATED_DIR="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 TEMPLATE_FILE="$CONFIG_DIR/node.template.yaml"
 DERIVE_KEYS="$SCRIPT_DIR/../../lib/derive_keys.py"
 
+# Every line belonging to one node, from its key to the next node key.
+#
+# Bounded by the block rather than by a fixed number of lines: a node that
+# omits an attribute would otherwise read the NEXT node's value for it, which
+# is silent and wrong in both directions — an external node followed by an
+# internal one would be classified as internal, and a node without docker_host
+# would dial the following node's container.
+node_block() {
+    local topology_file="$1"
+    local node_id="$2"
+    awk -v id="$node_id" '
+        $0 ~ "^  " id ":" { inblock = 1; next }
+        inblock && /^  [a-zA-Z]/ { exit }
+        inblock { print }
+    ' "$topology_file"
+}
+
 # Parse topology YAML to extract node attributes
 # Usage: get_node_attr <topology_file> <node_id> <attr_name>
 get_node_attr() {
     local topology_file="$1"
     local node_id="$2"
     local attr="$3"
+    local block
+    block=$(node_block "$topology_file" "$node_id")
     # Handle both docker_ip and external_ip as "address"
     if [ "$attr" = "address" ]; then
-        local ip=$(grep -A 10 "^  $node_id:" "$topology_file" | grep "docker_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
+        local ip=$(echo "$block" | grep "docker_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
         if [ -z "$ip" ]; then
-            ip=$(grep -A 10 "^  $node_id:" "$topology_file" | grep "external_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
+            ip=$(echo "$block" | grep "external_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
         fi
         echo "$ip"
     else
-        grep -A 10 "^  $node_id:" "$topology_file" | grep "${attr}:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/'
+        echo "$block" | grep "${attr}:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/'
     fi
 }
 
@@ -36,10 +58,24 @@ get_node_attr() {
 is_external_node() {
     local topology_file="$1"
     local node_id="$2"
-    local docker_ip=$(grep -A 10 "^  $node_id:" "$topology_file" | grep "docker_ip:" | head -1)
+    local docker_ip
+    docker_ip=$(node_block "$topology_file" "$node_id" | grep "docker_ip:" | head -1)
     [ -z "$docker_ip" ]
 }
 
+# Docker hostname of an internal node. Peers address each other by name so the
+# compose network can be auto-assigned, which is what makes two concurrent runs
+# safe: with no fixed subnet requested there is nothing for them to contend
+# for. Defaults to node-<id>, the compose `hostname:` every static profile
+# uses; a topology whose services are named otherwise declares docker_host.
+docker_host_name() {
+    local topology_file="$1"
+    local node_id="$2"
+    local host
+    host=$(get_node_attr "$topology_file" "$node_id" "docker_host")
+    echo "${host:-node-$node_id}"
+}
+
 # Get peers list from topology
 get_peers() {
     local topology_file="$1"
@@ -98,7 +134,14 @@ generate_peer_block() {
     local peer_id="$2"
 
     local peer_npub="$(get_key RESOLVED_NPUB "$peer_id")"
-    local peer_ip=$(get_node_attr "$topology_file" "$peer_id" "address")
+    local peer_addr
+    if is_external_node "$topology_file" "$peer_id"; then
+        # An external peer is not ours to name — use the address the
+        # topology gives it.
+        peer_addr=$(get_node_attr "$topology_file" "$peer_id" "address")
+    else
+        peer_addr=$(docker_host_name "$topology_file" "$peer_id")
+    fi
     local transport=$(get_default_transport "$topology_file")
     local port=$(transport_port "$transport")
 
@@ -107,7 +150,7 @@ generate_peer_block() {
     alias: "node-$peer_id"
     addresses:
       - transport: $transport
-        addr: "$peer_ip:$port"
+        addr: "$peer_addr:$port"
     connect_policy: auto_connect
 EOF
 }

testing/static/scripts/iperf-test.sh

@@ -27,7 +27,7 @@ FAILED=0
 
 # Node identities (from generated env file)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1

testing/static/scripts/mixed-profile-test.sh

@@ -27,7 +27,7 @@ if [ "${1:-}" = "inject-config" ]; then
     echo "Injecting mixed-profile config overrides..."
 
     # Node C: non-routing
-    cfg="$SCRIPT_DIR/../generated-configs/$TOPOLOGY/node-c.yaml"
+    cfg="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/$TOPOLOGY/node-c.yaml"
     if [ ! -f "$cfg" ]; then
         echo "  Error: $cfg not found" >&2
         exit 1
@@ -43,7 +43,7 @@ with open('$cfg', 'w') as f:
     echo "  ✓ node-c (disable_routing: true)"
 
     # Node D: leaf
-    cfg="$SCRIPT_DIR/../generated-configs/$TOPOLOGY/node-d.yaml"
+    cfg="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/$TOPOLOGY/node-d.yaml"
     if [ ! -f "$cfg" ]; then
         echo "  Error: $cfg not found" >&2
         exit 1
@@ -64,7 +64,7 @@ fi
 
 # ── Full test ─────────────────────────────────────────────────────────
 source "$SCRIPT_DIR/../../lib/wait-converge.sh"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1
@@ -102,10 +102,10 @@ echo "Phase 1: Link convergence"
 # B: peers with A, C → 2 links
 # C (NonRouting): peers with A, B → 2 links
 # D (Leaf): peers with A → 1 link
-wait_for_peers fips-node-a 3 30 || true
-wait_for_peers fips-node-b 2 30 || true
-wait_for_peers fips-node-c 2 30 || true
-wait_for_peers fips-node-d 1 30 || true
+wait_for_peers fips-node-a${FIPS_CI_NAME_SUFFIX:-} 3 30 || true
+wait_for_peers fips-node-b${FIPS_CI_NAME_SUFFIX:-} 2 30 || true
+wait_for_peers fips-node-c${FIPS_CI_NAME_SUFFIX:-} 2 30 || true
+wait_for_peers fips-node-d${FIPS_CI_NAME_SUFFIX:-} 1 30 || true
 
 # Phase 2: Verify link counts (already validated by wait_for_peers above)
 echo ""

testing/static/scripts/ping-test.sh

@@ -19,7 +19,7 @@ FAILED=0
 # Node identities (from generated env file)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../../lib/wait-converge.sh"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1

testing/static/scripts/rekey-test.sh

@@ -33,13 +33,16 @@ NODES="a b c d e"
 REKEY_ACCEPT_OFF_NODES="${REKEY_ACCEPT_OFF_NODES:-}"
 
 # Comma-separated list of node IDs to set udp.outbound_only=true on
-# during inject-config. For each such node, peer addresses are also
-# rewritten from numeric docker IPs to docker hostnames (e.g.
-# 172.20.0.12:2121 → node-c:2121). This reproduces the production
-# scenario where peer configs carry hostnames so the `addr_to_link`
-# key is hostname-form while inbound packet source addrs are numeric,
-# making the should_admit_msg1 carve-out's `addr_to_link.contains_key`
-# check miss.
+# during inject-config.
+#
+# The other half of this scenario — peer addresses in hostname form
+# (`node-c:2121`) rather than numeric — is no longer injected here. The
+# generator now emits a docker hostname for every internal peer in every
+# static topology, so the condition holds for all nodes unconditionally and a
+# rewrite step here would match nothing. What it reproduces is unchanged: the
+# `addr_to_link` key is hostname-form while inbound packet source addrs are
+# numeric, so the should_admit_msg1 carve-out's `addr_to_link.contains_key`
+# check misses.
 REKEY_OUTBOUND_ONLY_NODES="${REKEY_OUTBOUND_ONLY_NODES:-}"
 
 # Rekey timing configuration
@@ -54,10 +57,10 @@ if [ "${1:-}" = "inject-config" ]; then
         echo "  Setting udp.accept_connections=false on nodes: $REKEY_ACCEPT_OFF_NODES"
     fi
     if [ -n "$REKEY_OUTBOUND_ONLY_NODES" ]; then
-        echo "  Setting udp.outbound_only=true + rewriting peer addrs to docker hostnames on nodes: $REKEY_OUTBOUND_ONLY_NODES"
+        echo "  Setting udp.outbound_only=true (peer addrs already hostname-form) on nodes: $REKEY_OUTBOUND_ONLY_NODES"
     fi
     for node in $NODES; do
-        cfg="$SCRIPT_DIR/../generated-configs/$TOPOLOGY/node-$node.yaml"
+        cfg="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/$TOPOLOGY/node-$node.yaml"
         if [ ! -f "$cfg" ]; then
             echo "  Error: $cfg not found" >&2
             exit 1
@@ -79,6 +82,7 @@ if [ "${1:-}" = "inject-config" ]; then
             done
         fi
         python3 -c "
+import re
 import yaml
 with open('$cfg') as f:
     cfg = yaml.safe_load(f)
@@ -103,29 +107,26 @@ if '$outbound_only' == 'true':
         transports['udp'] = udp
     if isinstance(udp, dict):
         udp['outbound_only'] = True
-    # Rewrite peer addrs to docker hostnames so the addr_to_link key
-    # is hostname-form (mirroring production peer configs that carry
-    # hostnames). Without this, peer addrs are numeric and the
-    # carve-out's addr_to_link lookup matches inbound numeric source
-    # addrs, masking the bug.
-    ip_to_host = {
-        '172.20.0.10': 'node-a',
-        '172.20.0.11': 'node-b',
-        '172.20.0.12': 'node-c',
-        '172.20.0.13': 'node-d',
-        '172.20.0.14': 'node-e',
-    }
+    # Assert, rather than create, the hostname-form peer addrs this
+    # scenario depends on: the addr_to_link key must be a name so the
+    # carve-out's lookup misses the numeric inbound source addr. The
+    # generator emits hostnames for every internal peer, so a numeric addr
+    # here means the generator regressed and the suite would otherwise go
+    # on passing while testing nothing.
     for peer in cfg.get('peers', []) or []:
         for addr in peer.get('addresses', []) or []:
             t = addr.get('transport')
             if t is not None and t != 'udp':
                 continue
             a = addr.get('addr', '')
-            for ip, host in ip_to_host.items():
-                if a.startswith(ip + ':'):
-                    port = a.split(':', 1)[1]
-                    addr['addr'] = f'{host}:{port}'
-                    break
+            host = a.rsplit(':', 1)[0]
+            # A bracketed IPv6 literal is numeric too, and rsplit leaves the
+            # brackets on, so it would not match the v4 pattern.
+            if host.startswith('[') or re.fullmatch(r'[0-9.]+', host):
+                raise SystemExit(
+                    'outbound_only premise broken on node-$node: peer addr '
+                    + a + ' is numeric, expected a docker hostname'
+                )
 with open('$cfg', 'w') as f:
     yaml.dump(cfg, f, default_flow_style=False, sort_keys=False)
 "
@@ -134,7 +135,7 @@ with open('$cfg', 'w') as f:
             suffix=" (accept_connections=false)"
         fi
         if [ "$outbound_only" = "true" ]; then
-            suffix=" (outbound_only=true, hostname peer addrs)"
+            suffix=" (outbound_only=true, hostname peer addrs verified)"
         fi
         echo "  ✓ node-$node$suffix"
     done
@@ -197,7 +198,7 @@ TOTAL_PASSED=0
 TOTAL_FAILED=0
 
 # Node identities
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1