diff --git a/.gitea/workflows/verify.yml b/.gitea/workflows/verify.yml
index d4c93cc..9fefb1e 100644
--- a/.gitea/workflows/verify.yml
+++ b/.gitea/workflows/verify.yml
@@ -13,6 +13,31 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  module:
+    # This Linux job proves that private Gitea consumers can resolve the
+    # module identity and build the tagged Go package without a filesystem
+    # replacement. The full cross-language verifier remains macOS-bound.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.26.5"
+          cache: true
+          cache-dependency-path: go.mod
+      - name: Verify private module identity and Go packages
+        shell: bash
+        run: |
+          test "$(go list -m -f '{{.Path}}')" = 'git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol'
+          if grep -Eq '^[[:space:]]*replace[[:space:]]' go.mod; then
+            echo 'Protocol module must not use a replace directive' >&2
+            exit 1
+          fi
+          go mod verify
+          go build ./...
+          go test ./... -count=1
+
   verify:
     # The Phase 3A full verifier includes Swift type-checking. The owner must
     # provide a macOS runner with the pinned toolchain from the handoff.
diff --git a/AGENTS.md b/AGENTS.md
index f88da98..82456b7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,3 +36,14 @@ work from other owners. Do not push, merge, publish, or change release
 credentials unless the task separately authorizes it. A local immutable
 candidate tag is allowed only after matching Go/Rust/Swift fixture hashes and
 clean-checkout evidence; it is not a publication.
+
+## Private Go module identity
+
+- The canonical module path is
+  `git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol`.
+- Generated Protobuf `go_package` options and Go consumers must use that path;
+  do not restore a GitHub import path or add a filesystem `replace` in a
+  consumer checkout.
+- Consumers pin an exact immutable Protocol tag. The Protocol Gitea workflow
+  includes a Linux module job that verifies the module identity and builds all
+  Go packages; the macOS job remains the full Rust/Swift/conformance gate.
diff --git a/README.md b/README.md
index 0d67d07..a9ad097 100644
--- a/README.md
+++ b/README.md
@@ -25,3 +25,10 @@ Generated files under `gen/` are never edited by hand. `VERSION`,
 `compatibility.json`, and the content-addressed fixture manifest identify the
 release inputs. A Protocol release candidate is not valid until all consumers
 report the same fixture hash and clean-checkout regeneration evidence.
+
+## Private Go module
+
+The canonical Go module is
+`git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol`. Private consumers must
+resolve an exact Gitea tag and must not use a filesystem `replace`; the Gitea
+workflow verifies this module identity and builds the Go packages on Linux.
diff --git a/gen/protobuf/control-v1.pb b/gen/protobuf/control-v1.pb
index 887b790..1816067 100644
Binary files a/gen/protobuf/control-v1.pb and b/gen/protobuf/control-v1.pb differ
diff --git a/gen/protobuf/tunnel-v1.pb b/gen/protobuf/tunnel-v1.pb
index f9ef9c2..23d1177 100644
Binary files a/gen/protobuf/tunnel-v1.pb and b/gen/protobuf/tunnel-v1.pb differ
diff --git a/go.mod b/go.mod
index d339038..9e1200f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
-module github.com/sechmachine/VerseVDI-Protocol
+module git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol
 
 go 1.26
diff --git a/proto/versevdi/control/v1/control.proto b/proto/versevdi/control/v1/control.proto
index b48d45c..32502b9 100644
--- a/proto/versevdi/control/v1/control.proto
+++ b/proto/versevdi/control/v1/control.proto
@@ -4,7 +4,7 @@ package versevdi.control.v1;
 
 import "google/protobuf/timestamp.proto";
 
-option go_package = "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol";
+option go_package = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol";
 
 message VersionNegotiation {
   repeated string supported_versions = 1;
diff --git a/proto/versevdi/tunnel/v1/tunnel.proto b/proto/versevdi/tunnel/v1/tunnel.proto
index 5b2f66c..502869e 100644
--- a/proto/versevdi/tunnel/v1/tunnel.proto
+++ b/proto/versevdi/tunnel/v1/tunnel.proto
@@ -4,7 +4,7 @@ package versevdi.tunnel.v1;
 
 import "google/protobuf/timestamp.proto";
 
-option go_package = "github.com/sechmachine/VerseVDI-Protocol/gen/go/tunnel";
+option go_package = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/tunnel";
 
 message VersionNegotiation {
   repeated string supported_versions = 1;
diff --git a/tests/go/protocol_test.go b/tests/go/protocol_test.go
index 3977ec8..750ce6d 100644
--- a/tests/go/protocol_test.go
+++ b/tests/go/protocol_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	protocol "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol"
+	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
 )
 
 func TestManifestRejectsForbiddenAndUnknownFields(t *testing.T) {
diff --git a/tools/go-conformance/main.go b/tools/go-conformance/main.go
index 5134f09..fcbace4 100644
--- a/tools/go-conformance/main.go
+++ b/tools/go-conformance/main.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	protocol "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol"
+	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
 )
 
 const (