Merge branch 'maint'

testing/ci-local.sh

@@ -302,9 +302,12 @@ CI_CLEANED=0
 
 # Best-effort, BOUNDED teardown of every docker resource THIS run may have
 # created. Idempotent (guarded), so the signal and EXIT paths don't double-run.
+# Takes the run's exit status; defaults to non-zero, which is the conservative
+# reading for the signal path.
 ci_teardown() {
     [[ $CI_CLEANED -eq 1 ]] && return 0
     CI_CLEANED=1
+    local run_status="${1:-1}"
 
     # 1. Propagate to parallel chaos children and reap them (bounded).
     if [[ ${#CI_CHAOS_PIDS[@]} -gt 0 ]]; then
@@ -339,6 +342,17 @@ ci_teardown() {
         --project-prefix "$CI_PROJECT_PREFIX" \
         --images "$CI_IMAGE_TEST $CI_IMAGE_APP" \
         --veth-suffixes "${_suffixes[*]}" >/dev/null || true
+
+    # 3. The static suite's generated configs are per-run (a shared directory
+    #    would let concurrent runs overwrite each other's node configs), so
+    #    they are this run's to remove. Only on a green run: after a failure
+    #    they are the evidence of what the failing nodes were actually
+    #    configured with. Guarded on a non-empty suffix too, since without one
+    #    the path is the unscoped working directory a developer uses by hand,
+    #    which is not ours to delete.
+    if [[ $run_status -eq 0 && -n "${CI_RUN_NAME_SUFFIX:-}" ]]; then
+        rm -rf "$SCRIPT_DIR/static/generated-configs${CI_RUN_NAME_SUFFIX}"
+    fi
 }
 
 on_signal() {
@@ -355,7 +369,7 @@ on_signal() {
 on_exit() {
     local code=$?
     trap '' TERM INT EXIT
-    ci_teardown
+    ci_teardown "$code"
     exit "$code"
 }
 

testing/static/.gitignore

@@ -1,4 +1,4 @@
 fips
 fipsctl
 fipstop
-generated-configs
+generated-configs*

testing/static/README.md

@@ -122,7 +122,7 @@ testing/static/
 │       ├── mesh-public.yaml            # Mesh + external public node
 │       ├── tcp-chain.yaml             # TCP chain (3 nodes, port 8443)
 │       └── rekey.yaml                 # Rekey integration test (5 nodes)
-├── generated-configs/                  # Auto-generated (gitignored)
+├── generated-configs/                  # Auto-generated, run-scoped (gitignored)
 │   ├── npubs.env                       # NPUB_A=..., NPUB_B=..., etc.
 │   ├── mesh/
 │   │   ├── node-a.yaml ... node-e.yaml
@@ -151,6 +151,16 @@ Each topology file in `configs/topologies/` defines:
 - **Addresses**: `docker_ip` for Docker-managed nodes, `external_ip` for
   remote nodes not managed by Docker
 - **Peer connections**: which nodes peer with each other
+- **`docker_host`** (optional): the compose `hostname:` this node answers to,
+  when that is not `node-<id>`. Only the gateway topology needs it
+
+Generated peer addresses use the **docker hostname**, not `docker_ip`.
+`fips-net` requests no subnet, so docker assigns one from its own pool and two
+concurrent CI runs can bring the topology up at the same time instead of one
+of them failing with `Pool overlaps`. `docker_ip` is retained as documentation
+of the topology's shape and as the internal/external discriminator; an
+external node keeps its `external_ip` in peer blocks, its address not being
+ours to assign.
 
 Example entry:
 
@@ -178,6 +188,11 @@ This reads the topology definition and generates:
 1. Per-node YAML config files in `generated-configs/<topology>/`
 2. `generated-configs/npubs.env` with all node npubs as environment variables
 
+Under `ci-local.sh` the directory is `generated-configs-<run-id>`, so
+concurrent runs cannot overwrite each other's node configs; the compose file
+and every test script read the same `FIPS_CI_NAME_SUFFIX` and follow it. A
+bare invocation leaves the suffix unset and writes the plain path.
+
 The `npubs.env` file is sourced by the test scripts and injected into
 Docker containers via `env_file` in `docker-compose.yml`.
 

testing/static/configs/topologies/gateway.yaml

@@ -12,16 +12,23 @@
 # A non-FIPS client container connects via the gateway's LAN interface.
 #
 # Uses deterministic key derivation (mesh-name: gateway-test).
+#
+# docker_host is the compose service's `hostname:`, which is what peers dial.
+# This is the one static topology whose hostnames are not node-<id>, so it is
+# the one that has to declare them.
 
 nodes:
   a:
     docker_ip: "172.20.0.10"
+    docker_host: "gw-gateway"
     peers: [b, c]
 
   b:
     docker_ip: "172.20.0.11"
+    docker_host: "gw-server"
     peers: [a]
 
   c:
     docker_ip: "172.20.0.12"
+    docker_host: "gw-server-2"
     peers: [a]

testing/static/docker-chain-topology.svg

@@ -33,7 +33,7 @@
 
   <!-- Docker network boundary -->
   <rect x="30" y="65" width="640" height="175" class="net-box"/>
-  <text x="40" y="82" class="net-label">172.20.0.0/24  (docker: fips-net)</text>
+  <text x="40" y="82" class="net-label">auto-assigned subnet  (docker: fips-net)</text>
 
   <!--
     Horizontal chain layout:

testing/static/docker-compose.yml

@@ -1,11 +1,13 @@
 networks:
+  # No subnet is requested: docker assigns one from the daemon's address pool,
+  # which is what lets two concurrent CI runs bring this topology up at the
+  # same time. A fixed request is honoured verbatim, so two runs asking for the
+  # same range collide on "Pool overlaps" — the whole reason mesh nodes now
+  # peer by docker hostname rather than by address.
   fips-net:
     driver: bridge
     labels:
       - "com.corganlabs.fips-ci=1"
-    ipam:
-      config:
-        - subnet: 172.20.0.0/24
   gateway-lan:
     driver: bridge
     labels:
@@ -26,7 +28,7 @@ x-fips-common: &fips-common
     - net.ipv6.conf.all.disable_ipv6=0
   restart: "no"
   env_file:
-    - ./generated-configs/npubs.env
+    - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env
   environment:
     - RUST_LOG=info
     # Passthrough for A/B benchmarking — set on the host shell before
@@ -45,10 +47,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   node-b:
     <<: *fips-common
@@ -57,10 +58,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   node-c:
     <<: *fips-common
@@ -69,10 +69,9 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   node-d:
     <<: *fips-common
@@ -81,10 +80,9 @@ services:
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   node-e:
     <<: *fips-common
@@ -93,10 +91,9 @@ services:
     hostname: node-e
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Mesh-public topology (mesh + external public node) ────────
   pub-a:
@@ -106,10 +103,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   pub-b:
     <<: *fips-common
@@ -118,10 +114,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   pub-c:
     <<: *fips-common
@@ -130,10 +125,9 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   pub-d:
     <<: *fips-common
@@ -142,10 +136,9 @@ services:
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   pub-e:
     <<: *fips-common
@@ -154,10 +147,9 @@ services:
     hostname: node-e
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Chain topology (A-B-C-D-E) ────────────────────────────────
   chain-a:
@@ -167,10 +159,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   chain-b:
     <<: *fips-common
@@ -179,10 +170,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   chain-c:
     <<: *fips-common
@@ -191,10 +181,9 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   chain-d:
     <<: *fips-common
@@ -203,10 +192,9 @@ services:
     hostname: node-d
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   chain-e:
     <<: *fips-common
@@ -215,10 +203,9 @@ services:
     hostname: node-e
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/chain/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/chain/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Rekey integration test (mesh + aggressive rekey timers) ──
   rekey-a:
@@ -230,10 +217,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   rekey-b:
     <<: *fips-common
@@ -244,10 +230,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   rekey-c:
     <<: *fips-common
@@ -258,10 +243,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   rekey-d:
     <<: *fips-common
@@ -272,10 +256,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   rekey-e:
     <<: *fips-common
@@ -286,10 +269,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Rekey + accept_connections=false on node b ──────────────────
   # Exercises the auto_connect-initiator-with-accept-off regression
@@ -305,10 +287,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   rekey-accept-off-b:
     <<: *fips-common
@@ -319,10 +300,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   rekey-accept-off-c:
     <<: *fips-common
@@ -333,10 +313,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   rekey-accept-off-d:
     <<: *fips-common
@@ -347,10 +326,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   rekey-accept-off-e:
     <<: *fips-common
@@ -361,10 +339,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-accept-off/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-accept-off/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── Rekey topology with udp.outbound_only=true on node b ────
   # Exercises the udp.outbound_only rekey-msg1 admission regression
@@ -385,10 +362,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   rekey-outbound-only-b:
     <<: *fips-common
@@ -399,10 +375,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   rekey-outbound-only-c:
     <<: *fips-common
@@ -413,10 +388,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   rekey-outbound-only-d:
     <<: *fips-common
@@ -427,10 +401,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-d.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-d.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.13
 
   rekey-outbound-only-e:
     <<: *fips-common
@@ -441,10 +414,9 @@ services:
       - RUST_LOG=info,fips::node::handlers::rekey=debug,fips::node::handlers::handshake=debug
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/rekey-outbound-only/node-e.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/rekey-outbound-only/node-e.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.14
 
   # ── TCP chain topology (A-B-C) ───────────────────────────────
   tcp-a:
@@ -454,10 +426,9 @@ services:
     hostname: node-a
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/tcp-chain/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
 
   tcp-b:
     <<: *fips-common
@@ -466,10 +437,9 @@ services:
     hostname: node-b
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/tcp-chain/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   tcp-c:
     <<: *fips-common
@@ -478,10 +448,9 @@ services:
     hostname: node-c
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/tcp-chain/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   # ── Gateway integration test (gateway + server + non-FIPS client) ─
   gw-gateway:
@@ -502,10 +471,9 @@ services:
       - net.ipv6.conf.all.proxy_ndp=1
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/gateway/node-a.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/node-a.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.10
       gateway-lan:
         ipv4_address: 172.20.1.10
         ipv6_address: fd02::10
@@ -517,10 +485,9 @@ services:
     hostname: gw-server
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/gateway/node-b.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/node-b.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.11
 
   # Second mesh destination — gives gw-client-2 a distinct npub to target
   # so the gateway allocates a separate virtual-IP mapping per LAN client.
@@ -532,10 +499,9 @@ services:
     hostname: gw-server-2
     volumes:
       - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs/gateway/node-c.yaml:/etc/fips/fips.yaml:ro
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/gateway/node-c.yaml:/etc/fips/fips.yaml:ro
     networks:
       fips-net:
-        ipv4_address: 172.20.0.12
 
   gw-client:
     image: ${FIPS_TEST_APP_IMAGE:-fips-test-app:latest}
@@ -554,7 +520,7 @@ services:
         ipv6_address: fd02::20
     restart: "no"
     env_file:
-      - ./generated-configs/npubs.env
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env
 
   # Second LAN client — exercises concurrent multi-client mappings.
   # Same image and gateway-lan attachment as
@@ -576,4 +542,4 @@ services:
         ipv6_address: fd02::21
     restart: "no"
     env_file:
-      - ./generated-configs/npubs.env
+      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env

testing/static/docker-mesh-topology.svg

@@ -35,7 +35,7 @@
 
   <!-- Docker network boundary -->
   <rect x="40" y="62" width="620" height="310" class="net-box"/>
-  <text x="52" y="78" class="net-label">172.20.0.0/24  (docker: fips-net)</text>
+  <text x="52" y="78" class="net-label">auto-assigned subnet  (docker: fips-net)</text>
 
   <!--
     Pentagon layout (centered at 350,225):

testing/static/scripts/admission-cap-test.sh

@@ -32,7 +32,7 @@ TOPO_FILE="$SCRIPT_DIR/../configs/topologies/$TOPOLOGY.yaml"
 # before building Docker images.
 if [ "${1:-}" = "inject-config" ]; then
     echo "Injecting node.limits.max_peers: $MAX_PEERS into node-$CAP_NODE ($TOPOLOGY topology)..."
-    cfg="$SCRIPT_DIR/../generated-configs/$TOPOLOGY/node-$CAP_NODE.yaml"
+    cfg="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/$TOPOLOGY/node-$CAP_NODE.yaml"
     if [ ! -f "$cfg" ]; then
         echo "  Error: $cfg not found (run generate-configs.sh $TOPOLOGY first)" >&2
         exit 1
@@ -60,11 +60,22 @@ info() { echo "[$(stamp)] $*"; }
 fail() { echo "[$(stamp)] FAIL: $*"; exit 1; }
 pass() { echo "[$(stamp)] PASS: $*"; }
 
-# Extract docker_ip for a node from the topology file
+# A node's docker address, read from the running container.
+#
+# NOT from the topology file's docker_ip: fips-net requests no subnet, so that
+# two concurrent CI runs cannot collide on one fixed range, and docker assigns
+# the addresses at `up`. A topology literal would no longer match anything on
+# the wire, and the phase-3 tcpdump assertions are built from these addresses
+# — a stale one turns "no Msg2 leaked" into a check that cannot fail.
+# Takes the first attachment only: these nodes have one, and concatenating two
+# would yield a string that is not an address at all. The `|| true` keeps a
+# missing container from killing the script under `set -e` before the caller
+# can say which container it was.
 node_ip() {
-    grep -A 5 "^  $1:" "$TOPO_FILE" \
+    docker inspect \
-        | grep -m1 'docker_ip:' \
+        -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' \
-        | sed 's/.*: *"*\([^"]*\)".*/\1/'
+        "fips-node-${1}${FIPS_CI_NAME_SUFFIX:-}" 2>/dev/null \
+        | awk '{print $1}' || true
 }
 
 # Extract npub for a node from the topology file
@@ -84,7 +95,7 @@ node_peers() {
 }
 
 CAP_IP=$(node_ip "$CAP_NODE")
-[ -n "$CAP_IP" ] || fail "could not resolve docker_ip for node-$CAP_NODE in $TOPO_FILE"
+[ -n "$CAP_IP" ] || fail "could not read the docker address of container fips-node-${CAP_NODE}${FIPS_CI_NAME_SUFFIX:-}"
 info "cap'd node: node-$CAP_NODE (ip $CAP_IP, max_peers=$MAX_PEERS)"
 
 # Read the cap'd node's peer_count, or the empty string if it did not answer.
@@ -131,6 +142,32 @@ info "denied (sustained-retry): ${DENIED:-<none>}"
 [ -n "$DENIED" ] \
     || fail "no denied peers — test setup wrong (cap=$MAX_PEERS too high vs configured peers)"
 
+# Every address a denied peer holds during the capture, one "node ip" line per
+# observation.
+#
+# It is not one address per node. `fips-net` requests no subnet so that
+# concurrent CI runs cannot collide on one, and the load driver below restarts
+# these containers repeatedly — docker frees the address on stop and may hand
+# back a different one, which was impossible while the compose pinned
+# ipv4_address. Observed live: node-d went 10.128.2.4 → 10.128.2.6 mid-window.
+# Phase 3 matches against the union, because an address that held for only part
+# of the window under-counts Msg1 and, worse, satisfies the expect-zero Msg2
+# assertion for the wrong reason.
+ADDR_FILE=$(mktemp /tmp/admission-cap-addrs.XXXXXX)
+record_denied_addrs() {
+    local n n_ip
+    for n in $DENIED; do
+        n_ip=$(node_ip "$n")
+        [ -n "$n_ip" ] || continue
+        grep -qxF "$n $n_ip" "$ADDR_FILE" 2>/dev/null || echo "$n $n_ip" >> "$ADDR_FILE"
+    done
+}
+record_denied_addrs
+for n in $DENIED; do
+    grep -q "^$n " "$ADDR_FILE" \
+        || fail "could not read the docker address of denied peer node-$n"
+done
+
 # ── Phase 2: capture wire traffic for CAPTURE_SECS seconds ───────────
 # Drives sustained load by restarting denied peer containers on a cadence
 # during the capture window. Each restart resets the auto-reconnect
@@ -149,10 +186,18 @@ HELPER_IMAGE=$(docker inspect -f '{{.Config.Image}}' "fips-node-${CAP_NODE}${FIP
     while [ $elapsed -lt $((CAPTURE_SECS - 5)) ]; do
         sleep 15
         elapsed=$((elapsed + 15))
+        # ONE AT A TIME, deliberately. Restarting them together frees both
+        # addresses at once and docker reallocates in completion order, so the
+        # two peers SWAP — observed live, and it destroys per-peer attribution
+        # because both then match the same address set. Restarted singly, a
+        # container frees its address and immediately reclaims it as the
+        # lowest free one, so each keeps its own.
         for n in $DENIED; do
-            docker restart "fips-node-${n}${FIPS_CI_NAME_SUFFIX:-}" >/dev/null 2>&1 &
+            docker restart "fips-node-${n}${FIPS_CI_NAME_SUFFIX:-}" >/dev/null 2>&1 || true
         done
-        wait
+        # Belt and braces: a restart may still move an address, so re-read
+        # rather than assuming the pre-capture snapshot still holds.
+        record_denied_addrs
         info "  [load-driver] restarted denied peers ($DENIED) at t+${elapsed}s"
     done
 ) &
@@ -176,13 +221,41 @@ info "phase 3: per-denied-peer assertion (inbound Msg1 > 0, outbound Msg2 == 0)"
 OVERALL=0
 TOTAL_MSG1_IN=0
 TOTAL_MSG2_OUT=0
+# One last observation: the final restart round may have moved an address after
+# the driver's own record.
+record_denied_addrs
+
+# The cap'd node is never restarted, so its address must not have moved. If it
+# did, every pattern below covers only part of the window and the counts mean
+# nothing — that is a harness failure, not a cap regression.
+cap_ip_now=$(node_ip "$CAP_NODE")
+[ "$cap_ip_now" = "$CAP_IP" ] \
+    || fail "cap'd node address moved during the capture ($CAP_IP → ${cap_ip_now:-<unreadable>}) though it was never restarted"
+cap_re=$(printf '%s' "$CAP_IP" | sed 's/\./\\./g')
+
+# Two denied peers must never have held the same address, or the per-peer
+# counts below are not per-peer: each would match the other's traffic and the
+# "this peer is sustained-retrying" assertion could be satisfied entirely by
+# its neighbour. Serialized restarts above are what prevent it; this is the
+# check that says so out loud if they ever stop working.
+dup=$(awk '{ if (seen[$2] != "" && seen[$2] != $1) print $2; seen[$2] = $1 }' "$ADDR_FILE" | sort -u)
+[ -z "$dup" ] \
+    || fail "denied peers shared an address during the capture ($(echo "$dup" | paste -sd, -)); per-peer attribution is not possible"
+
 for n in $DENIED; do
-    n_ip=$(node_ip "$n")
+    # Match every address this peer held during the window, not just its last:
+    # a restart can move it, and grepping for one of several under-counts Msg1
+    # and leaves the expect-zero Msg2 assertion unable to see a leak sent to
+    # the addresses it no longer holds.
+    n_re=$(awk -v n="$n" '$1 == n { gsub(/\./, "\\.", $2); printf "%s%s", (c++ ? "|" : ""), $2 }' "$ADDR_FILE")
+    [ -n "$n_re" ] \
+        || fail "no docker address was ever recorded for denied peer node-$n"
+    n_seen=$(awk -v n="$n" '$1 == n {print $2}' "$ADDR_FILE" | paste -sd, -)
     # Inbound: src=n_ip:* → dst=cap_ip:2121; FMP-IK Msg1 wire size = 84 B
-    msg1_in=$(grep -cE "IP $n_ip\.[0-9]+ > $CAP_IP\.2121: UDP, length 84" "$CAP_FILE" || true)
+    msg1_in=$(grep -cE "IP ($n_re)\.[0-9]+ > $cap_re\.2121: UDP, length 84" "$CAP_FILE" || true)
     # Outbound: src=cap_ip:2121 → dst=n_ip:*; FMP-IK Msg2 wire size = 104 B
-    msg2_out=$(grep -cE "IP $CAP_IP\.2121 > $n_ip\.[0-9]+: UDP, length 104" "$CAP_FILE" || true)
+    msg2_out=$(grep -cE "IP $cap_re\.2121 > ($n_re)\.[0-9]+: UDP, length 104" "$CAP_FILE" || true)
-    info "  node-$n ($n_ip): inbound Msg1 (len 84) = $msg1_in, outbound Msg2 (len 104) = $msg2_out"
+    info "  node-$n ($n_seen): inbound Msg1 (len 84) = $msg1_in, outbound Msg2 (len 104) = $msg2_out"
     TOTAL_MSG1_IN=$((TOTAL_MSG1_IN + msg1_in))
     TOTAL_MSG2_OUT=$((TOTAL_MSG2_OUT + msg2_out))
     if [ "$msg1_in" -eq 0 ]; then

testing/static/scripts/bench-multirun.sh

@@ -31,7 +31,7 @@ if ! [[ "$RUNS" =~ ^[1-9][0-9]*$ ]] || [ "$RUNS" -lt 1 ]; then
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1

testing/static/scripts/gateway-test.sh

@@ -17,7 +17,7 @@ trap 'echo ""; echo "Test interrupted"; exit 130' INT
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../../lib/wait-converge.sh"
 
-GENERATED_DIR="$SCRIPT_DIR/../generated-configs"
+GENERATED_DIR="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 ENV_FILE="$GENERATED_DIR/npubs.env"
 
 GATEWAY="fips-gw-gateway${FIPS_CI_NAME_SUFFIX:-}"

testing/static/scripts/generate-configs.sh

@@ -10,25 +10,47 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONFIG_DIR="$SCRIPT_DIR/../configs"
-GENERATED_DIR="$SCRIPT_DIR/../generated-configs"
+# Scoped by the CI run suffix so two concurrent runs cannot overwrite each
+# other's generated configs or npubs.env. Unset (a bare invocation) renders
+# the historical unscoped path.
+GENERATED_DIR="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}"
 TEMPLATE_FILE="$CONFIG_DIR/node.template.yaml"
 DERIVE_KEYS="$SCRIPT_DIR/../../lib/derive_keys.py"
 
+# Every line belonging to one node, from its key to the next node key.
+#
+# Bounded by the block rather than by a fixed number of lines: a node that
+# omits an attribute would otherwise read the NEXT node's value for it, which
+# is silent and wrong in both directions — an external node followed by an
+# internal one would be classified as internal, and a node without docker_host
+# would dial the following node's container.
+node_block() {
+    local topology_file="$1"
+    local node_id="$2"
+    awk -v id="$node_id" '
+        $0 ~ "^  " id ":" { inblock = 1; next }
+        inblock && /^  [a-zA-Z]/ { exit }
+        inblock { print }
+    ' "$topology_file"
+}
+
 # Parse topology YAML to extract node attributes
 # Usage: get_node_attr <topology_file> <node_id> <attr_name>
 get_node_attr() {
     local topology_file="$1"
     local node_id="$2"
     local attr="$3"
+    local block
+    block=$(node_block "$topology_file" "$node_id")
     # Handle both docker_ip and external_ip as "address"
     if [ "$attr" = "address" ]; then
-        local ip=$(grep -A 10 "^  $node_id:" "$topology_file" | grep "docker_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
+        local ip=$(echo "$block" | grep "docker_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
         if [ -z "$ip" ]; then
-            ip=$(grep -A 10 "^  $node_id:" "$topology_file" | grep "external_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
+            ip=$(echo "$block" | grep "external_ip:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/')
         fi
         echo "$ip"
     else
-        grep -A 10 "^  $node_id:" "$topology_file" | grep "${attr}:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/'
+        echo "$block" | grep "${attr}:" | head -1 | sed 's/.*: *"*\([^"]*\)".*/\1/'
     fi
 }
 
@@ -36,10 +58,24 @@ get_node_attr() {
 is_external_node() {
     local topology_file="$1"
     local node_id="$2"
-    local docker_ip=$(grep -A 10 "^  $node_id:" "$topology_file" | grep "docker_ip:" | head -1)
+    local docker_ip
+    docker_ip=$(node_block "$topology_file" "$node_id" | grep "docker_ip:" | head -1)
     [ -z "$docker_ip" ]
 }
 
+# Docker hostname of an internal node. Peers address each other by name so the
+# compose network can be auto-assigned, which is what makes two concurrent runs
+# safe: with no fixed subnet requested there is nothing for them to contend
+# for. Defaults to node-<id>, the compose `hostname:` every static profile
+# uses; a topology whose services are named otherwise declares docker_host.
+docker_host_name() {
+    local topology_file="$1"
+    local node_id="$2"
+    local host
+    host=$(get_node_attr "$topology_file" "$node_id" "docker_host")
+    echo "${host:-node-$node_id}"
+}
+
 # Get peers list from topology
 get_peers() {
     local topology_file="$1"
@@ -98,7 +134,14 @@ generate_peer_block() {
     local peer_id="$2"
 
     local peer_npub="$(get_key RESOLVED_NPUB "$peer_id")"
-    local peer_ip=$(get_node_attr "$topology_file" "$peer_id" "address")
+    local peer_addr
+    if is_external_node "$topology_file" "$peer_id"; then
+        # An external peer is not ours to name — use the address the
+        # topology gives it.
+        peer_addr=$(get_node_attr "$topology_file" "$peer_id" "address")
+    else
+        peer_addr=$(docker_host_name "$topology_file" "$peer_id")
+    fi
     local transport=$(get_default_transport "$topology_file")
     local port=$(transport_port "$transport")
 
@@ -107,7 +150,7 @@ generate_peer_block() {
     alias: "node-$peer_id"
     addresses:
       - transport: $transport
-        addr: "$peer_ip:$port"
+        addr: "$peer_addr:$port"
     connect_policy: auto_connect
 EOF
 }

testing/static/scripts/iperf-test.sh

@@ -27,7 +27,7 @@ FAILED=0
 
 # Node identities (from generated env file)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1

testing/static/scripts/ping-test.sh

@@ -19,7 +19,7 @@ FAILED=0
 # Node identities (from generated env file)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../../lib/wait-converge.sh"
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1

testing/static/scripts/rekey-test.sh

@@ -33,13 +33,16 @@ NODES="a b c d e"
 REKEY_ACCEPT_OFF_NODES="${REKEY_ACCEPT_OFF_NODES:-}"
 
 # Comma-separated list of node IDs to set udp.outbound_only=true on
-# during inject-config. For each such node, peer addresses are also
+# during inject-config.
-# rewritten from numeric docker IPs to docker hostnames (e.g.
+#
-# 172.20.0.12:2121 → node-c:2121). This reproduces the production
+# The other half of this scenario — peer addresses in hostname form
-# scenario where peer configs carry hostnames so the `addr_to_link`
+# (`node-c:2121`) rather than numeric — is no longer injected here. The
-# key is hostname-form while inbound packet source addrs are numeric,
+# generator now emits a docker hostname for every internal peer in every
-# making the should_admit_msg1 carve-out's `addr_to_link.contains_key`
+# static topology, so the condition holds for all nodes unconditionally and a
-# check miss.
+# rewrite step here would match nothing. What it reproduces is unchanged: the
+# `addr_to_link` key is hostname-form while inbound packet source addrs are
+# numeric, so the should_admit_msg1 carve-out's `addr_to_link.contains_key`
+# check misses.
 REKEY_OUTBOUND_ONLY_NODES="${REKEY_OUTBOUND_ONLY_NODES:-}"
 
 # Rekey timing configuration
@@ -54,10 +57,10 @@ if [ "${1:-}" = "inject-config" ]; then
         echo "  Setting udp.accept_connections=false on nodes: $REKEY_ACCEPT_OFF_NODES"
     fi
     if [ -n "$REKEY_OUTBOUND_ONLY_NODES" ]; then
-        echo "  Setting udp.outbound_only=true + rewriting peer addrs to docker hostnames on nodes: $REKEY_OUTBOUND_ONLY_NODES"
+        echo "  Setting udp.outbound_only=true (peer addrs already hostname-form) on nodes: $REKEY_OUTBOUND_ONLY_NODES"
     fi
     for node in $NODES; do
-        cfg="$SCRIPT_DIR/../generated-configs/$TOPOLOGY/node-$node.yaml"
+        cfg="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/$TOPOLOGY/node-$node.yaml"
         if [ ! -f "$cfg" ]; then
             echo "  Error: $cfg not found" >&2
             exit 1
@@ -79,6 +82,7 @@ if [ "${1:-}" = "inject-config" ]; then
             done
         fi
         python3 -c "
+import re
 import yaml
 with open('$cfg') as f:
     cfg = yaml.safe_load(f)
@@ -103,29 +107,26 @@ if '$outbound_only' == 'true':
         transports['udp'] = udp
     if isinstance(udp, dict):
         udp['outbound_only'] = True
-    # Rewrite peer addrs to docker hostnames so the addr_to_link key
+    # Assert, rather than create, the hostname-form peer addrs this
-    # is hostname-form (mirroring production peer configs that carry
+    # scenario depends on: the addr_to_link key must be a name so the
-    # hostnames). Without this, peer addrs are numeric and the
+    # carve-out's lookup misses the numeric inbound source addr. The
-    # carve-out's addr_to_link lookup matches inbound numeric source
+    # generator emits hostnames for every internal peer, so a numeric addr
-    # addrs, masking the bug.
+    # here means the generator regressed and the suite would otherwise go
-    ip_to_host = {
+    # on passing while testing nothing.
-        '172.20.0.10': 'node-a',
-        '172.20.0.11': 'node-b',
-        '172.20.0.12': 'node-c',
-        '172.20.0.13': 'node-d',
-        '172.20.0.14': 'node-e',
-    }
     for peer in cfg.get('peers', []) or []:
         for addr in peer.get('addresses', []) or []:
             t = addr.get('transport')
             if t is not None and t != 'udp':
                 continue
             a = addr.get('addr', '')
-            for ip, host in ip_to_host.items():
+            host = a.rsplit(':', 1)[0]
-                if a.startswith(ip + ':'):
+            # A bracketed IPv6 literal is numeric too, and rsplit leaves the
-                    port = a.split(':', 1)[1]
+            # brackets on, so it would not match the v4 pattern.
-                    addr['addr'] = f'{host}:{port}'
+            if host.startswith('[') or re.fullmatch(r'[0-9.]+', host):
-                    break
+                raise SystemExit(
+                    'outbound_only premise broken on node-$node: peer addr '
+                    + a + ' is numeric, expected a docker hostname'
+                )
 with open('$cfg', 'w') as f:
     yaml.dump(cfg, f, default_flow_style=False, sort_keys=False)
 "
@@ -134,7 +135,7 @@ with open('$cfg', 'w') as f:
             suffix=" (accept_connections=false)"
         fi
         if [ "$outbound_only" = "true" ]; then
-            suffix=" (outbound_only=true, hostname peer addrs)"
+            suffix=" (outbound_only=true, hostname peer addrs verified)"
         fi
         echo "  ✓ node-$node$suffix"
     done
@@ -197,7 +198,7 @@ TOTAL_PASSED=0
 TOTAL_FAILED=0
 
 # Node identities
-ENV_FILE="$SCRIPT_DIR/../generated-configs/npubs.env"
+ENV_FILE="$SCRIPT_DIR/../generated-configs${FIPS_CI_NAME_SUFFIX:-}/npubs.env"
 if [ ! -f "$ENV_FILE" ]; then
     echo "Error: $ENV_FILE not found. Run generate-configs.sh first." >&2
     exit 1