Retire the mesh-public static test topology

The mesh-public profile ran in neither runner: ci-local's static suite
list carries only static-mesh and static-chain, and the GitHub matrix has
only mesh and chain. It also added no coverage over static-mesh.
ping-test.sh and iperf-test.sh branched mesh and mesh-public together and
exercised the same 20 directed pairs among node-a through node-e, and no
script referenced the external node at all. The convergence waits even
used mesh's peer counts rather than mesh-public's, so the extra link to
the public node was never counted, let alone asserted.

Running it would therefore have added a dependency on a live internet
host (test-us01.fips.network) in exchange for zero additional assertions.
Remove the topology, its five compose services, the script branches that
aliased it to mesh, and the documentation rows. An invocation using the
old profile name now fails on ping-test.sh's unknown-profile guard
instead of silently behaving as mesh.

The config generator's external-node support (external_ip,
is_external_node) stays. It has no consumer now, but it is woven into the
config path every remaining topology uses, so removing it would put the
gating suites at risk for no present gain.

testing/README.md

@@ -16,7 +16,6 @@ configurations.
 | ----------- | ----- | --------- | -------------------------------- |
 | mesh        | 5     | UDP       | Sparse mesh, 6 links, multi-hop  |
 | chain       | 5     | UDP       | Linear chain, max 4-hop paths    |
-| mesh-public | 5+1   | UDP       | Mesh with external public node   |
 | tcp-chain   | 3     | TCP       | Linear chain over TCP (port 8443) |
 | rekey       | 5     | UDP       | Rekey integration test topology  |
 

testing/static/README.md

@@ -119,15 +119,12 @@ testing/static/
 │   └── topologies/
 │       ├── mesh.yaml                   # Mesh topology definition
 │       ├── chain.yaml                  # Chain topology definition
-│       ├── mesh-public.yaml            # Mesh + external public node
 │       ├── tcp-chain.yaml             # TCP chain (3 nodes, port 8443)
 │       └── rekey.yaml                 # Rekey integration test (5 nodes)
 ├── generated-configs/                  # Auto-generated, run-scoped (gitignored)
 │   ├── npubs.env                       # NPUB_A=..., NPUB_B=..., etc.
 │   ├── mesh/
 │   │   ├── node-a.yaml ... node-e.yaml
-│   ├── mesh-public/
-│   │   ├── node-a.yaml ... node-e.yaml
 │   ├── chain/
 │   │   ├── node-a.yaml ... node-e.yaml
 │   └── tcp-chain/
@@ -219,7 +216,7 @@ each mesh needs unique node identities to avoid key conflicts. The optional
 
 # Or generate configs directly
 ./testing/static/scripts/generate-configs.sh mesh my-mesh-1
-./testing/static/scripts/generate-configs.sh mesh-public my-mesh-1
+./testing/static/scripts/generate-configs.sh chain my-mesh-1
 ```
 
 ### How It Works

testing/static/configs/topologies/mesh-public.yaml

@@ -1,51 +0,0 @@
-# Mesh Topology Definition
-# 
-# Five nodes with 6 bidirectional UDP links forming a sparse, fully connected
-# graph. Not all nodes are direct peers — non-adjacent pairs require
-# discovery-driven multi-hop routing to establish end-to-end sessions.
-
-nodes:
-  a:
-    nsec: "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20"
-    npub: "npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m"
-    docker_ip: "172.20.0.10"
-    peers: [d, e, pub]
-
-  b:
-    nsec: "b102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fb0"
-    npub: "npub1tdwa4vjrjl33pcjdpf2t4p027nl86xrx24g4d3avg4vwvayr3g8qhd84le"
-    docker_ip: "172.20.0.11"
-    peers: [c, pub]
-
-  c:
-    nsec: "c102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fc0"
-    npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6"
-    docker_ip: "172.20.0.12"
-    peers: [b, d, e, pub]
-
-  d:
-    nsec: "d102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fd0"
-    npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl"
-    docker_ip: "172.20.0.13"
-    peers: [a, c, e]
-
-  e:
-    nsec: "e102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fe0"
-    npub: "npub1wf8akf8lu2zdkjkmwhl75pqvven654mpv4sz2x2tprl5265mgrzq8nhak4"
-    docker_ip: "172.20.0.14"
-    peers: [a, c, d]
-
-  # External/public node (not a Docker container)
-  pub:
-    npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
-    external_ip: "test-us01.fips.network"
-    peers: [a, b, c]
-
-# Spanning Tree Structure (rooted at node A):
-# - A — D (tree edge, D's parent is A)
-# - A — E (tree edge, E's parent is A)
-# - C — D (tree edge, C's parent is D)
-# - B — C (tree edge, B's parent is C)
-# - D — E (non-tree link)
-# - C — E (non-tree link)
-

testing/static/docker-compose.yml

@@ -98,62 +98,6 @@ services:
     networks:
       fips-net:
 
-  # ── Mesh-public topology (mesh + external public node) ────────
-  pub-a:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-a${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-a
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-b:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-b${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-b
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-c:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-c${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-c
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-d:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-d${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-d
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-e:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-e${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-e
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
   # ── Chain topology (A-B-C-D-E) ────────────────────────────────
   chain-a:
     <<: *fips-common

testing/static/scripts/bench-multirun.sh

@@ -137,7 +137,7 @@ ping_path() {
 # steady state, which is what real-world FIPS deployments see. To
 # force on-wire multihop, isolate nodes on distinct docker networks.
 case "$PROFILE" in
-    mesh|mesh-public)
+    mesh)
         # Static-peer paths only — without mDNS / a Nostr relay in the
         # test container set, non-adjacent pairs (A↔B, A↔C) can't
         # establish direct UDP and the bench would either fail

testing/static/scripts/generate-configs.sh

@@ -2,7 +2,7 @@
 # Generate FIPS node configuration files from template and topology definition.
 #
 # Usage: ./generate-configs.sh <topology> [mesh-name]
-#   topology:  mesh, mesh-public, chain, etc.
+#   topology:  mesh, chain, etc.
 #   mesh-name: optional; when given, docker node identities are derived
 #              deterministically via sha256(mesh-name|node-id)
 

testing/static/scripts/iperf-test.sh

@@ -89,7 +89,7 @@ echo ""
 # nodes — labels DO NOT encode hop count, since peer discovery
 # converges every same-subnet pair onto a direct UDP path within a
 # few ticks regardless of the static `peers:` list.
-if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+if [ "$PROFILE" = "mesh" ]; then
     echo "Topology (static \`peers:\` from mesh.yaml):"
     echo "  A peers with: D, E"
     echo "  B peers with: C"
@@ -109,7 +109,7 @@ echo ""
 echo "Waiting ${SETTLE_SECONDS}s for mesh convergence..."
 sleep "$SETTLE_SECONDS"
 
-if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+if [ "$PROFILE" = "mesh" ]; then
     echo ""
     echo "Testing mesh topology paths:"
     iperf_test node-d node-a "$NPUB_D" "A→D"

testing/static/scripts/ping-test.sh

@@ -93,7 +93,7 @@ if [ "$PROFILE" = "chain" ]; then
     wait_for_peers fips-node-c${FIPS_CI_NAME_SUFFIX:-} 2 20 || true
     wait_for_peers fips-node-d${FIPS_CI_NAME_SUFFIX:-} 2 20 || true
     wait_for_peers fips-node-e${FIPS_CI_NAME_SUFFIX:-} 1 20 || true
-elif [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+elif [ "$PROFILE" = "mesh" ]; then
     # Mesh: check all nodes reach their configured peer counts
     wait_for_peers fips-node-a${FIPS_CI_NAME_SUFFIX:-} 2 20 || true
     wait_for_peers fips-node-b${FIPS_CI_NAME_SUFFIX:-} 1 20 || true
@@ -105,7 +105,7 @@ else
     # section below is guarded by these same profile names, so the script
     # ran no assertion at all and exited 0. A typo in the caller's profile
     # argument produced a green run that tested nothing.
-    echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh, mesh-public)" >&2
+    echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh)" >&2
     exit 2
 fi
 # Wait for full pairwise connectivity, progress-aware: the actual pings
@@ -119,7 +119,7 @@ wait_until_connected ping_all_quiet 45 15 || true
 PASSED=0
 FAILED=0
 
-if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+if [ "$PROFILE" = "mesh" ]; then
     # Sparse mesh topology: A-B, B-C, C-D, D-E, E-A, A-D
     # Test all 20 directed pairs (5 nodes × 4 targets each)
     echo ""