ci: restore complete gateway verification

.gitea/workflows/verify.yml

@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   gateway:
-    runs-on: ubuntu-latest-arm-on-mac
+    runs-on: ubuntu-latest-on-demand-xhigh-performance
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -26,12 +26,8 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.13"
-      - name: Verify Go and OpenSpec baseline
-        run: |
-          make OPENSPEC='bunx --bun @fission-ai/openspec@1.5.0' format-check module-verify build vet openspec
-          # The registered shared runners cannot sustain the reviewed 20/50/80 Mbps
-          # gates. Those unchanged gates run in make verify and frozen qualification.
-          go test ./... -count=1 -skip '^(TestQualificationShortProcessingSubprocessCoversFixedProfiles|TestQualificationZeroLossBaselinesAreAttributedAtNormativeScale|TestQualificationLossAndSteppedThroughputBounds|TestQualificationUsesPublicQUICAndProductionPacer)$'
+      - name: Verify Go and OpenSpec
+        run: make OPENSPEC='bunx --bun @fission-ai/openspec@1.5.0' verify
       - name: Build and inspect reproducible Linux gateway artifacts
         run: |
           make gateway-linux DIST_DIR=dist

openspec/changes/correct-gateway-qualification-evidence/design.md

@@ -29,4 +29,4 @@ The qualification driver already reaches the production Apollo-to-QUIC path, but
 - [Ordered release suppresses some delivered jitter] → Retain both the applied fixed-seed delay distribution and the separately observed ordered-traversal jitter.
 - [Stage attribution double-counts a unit] → Record one terminal outcome per source sequence and validate accounting equality.
 - [Process sampling perturbs qualification] → Use bounded low-rate samples and include the sampling method in evidence.
-- [Shared private runners cannot sustain the reviewed 20/50/80 Mbps gates] → CI skips exactly the four host-capacity assertions while retaining functional traversal/resource checks; unchanged full `make verify` and frozen qualification remain mandatory on the qualification host.
+- [Shared private runners cannot sustain the reviewed 20/50/80 Mbps gates] → Run the complete verifier on the registered on-demand xhigh runner; the frozen qualification remains authoritative for the normative duration.

openspec/changes/correct-gateway-qualification-evidence/tasks.md

@@ -19,5 +19,5 @@
 
 - [x] 4.1 Run focused production-path, race, fuzz, cancellation, slow-reader, amplification, parser-resource, and bounded soak checks
 - [x] 4.2 Run strict OpenSpec validation, normal-module verification, and reproducible Linux artifact inspection
-- [ ] 4.3 Freeze all executable inputs and run the corrected normative Section 7 qualification once for the candidate
+- [x] 4.3 Freeze all executable inputs and run the corrected normative Section 7 qualification once for the candidate
 - [ ] 4.4 Preserve failed attempts and append superseding evidence and ledger rows without rewriting RC8