protocol: migrate module identity to private Gitea

.gitea/workflows/verify.yml

@@ -13,6 +13,31 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  module:
+    # This Linux job proves that private Gitea consumers can resolve the
+    # module identity and build the tagged Go package without a filesystem
+    # replacement. The full cross-language verifier remains macOS-bound.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.26.5"
+          cache: true
+          cache-dependency-path: go.mod
+      - name: Verify private module identity and Go packages
+        shell: bash
+        run: |
+          test "$(go list -m -f '{{.Path}}')" = 'git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol'
+          if grep -Eq '^[[:space:]]*replace[[:space:]]' go.mod; then
+            echo 'Protocol module must not use a replace directive' >&2
+            exit 1
+          fi
+          go mod verify
+          go build ./...
+          go test ./... -count=1
+
   verify:
     # The Phase 3A full verifier includes Swift type-checking. The owner must
     # provide a macOS runner with the pinned toolchain from the handoff.

AGENTS.md

@@ -36,3 +36,14 @@ work from other owners. Do not push, merge, publish, or change release
 credentials unless the task separately authorizes it. A local immutable
 candidate tag is allowed only after matching Go/Rust/Swift fixture hashes and
 clean-checkout evidence; it is not a publication.
+
+## Private Go module identity
+
+- The canonical module path is
+  `git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol`.
+- Generated Protobuf `go_package` options and Go consumers must use that path;
+  do not restore a GitHub import path or add a filesystem `replace` in a
+  consumer checkout.
+- Consumers pin an exact immutable Protocol tag. The Protocol Gitea workflow
+  includes a Linux module job that verifies the module identity and builds all
+  Go packages; the macOS job remains the full Rust/Swift/conformance gate.

README.md

@@ -25,3 +25,10 @@ Generated files under `gen/` are never edited by hand. `VERSION`,
 `compatibility.json`, and the content-addressed fixture manifest identify the
 release inputs. A Protocol release candidate is not valid until all consumers
 report the same fixture hash and clean-checkout regeneration evidence.
+
+## Private Go module
+
+The canonical Go module is
+`git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol`. Private consumers must
+resolve an exact Gitea tag and must not use a filesystem `replace`; the Gitea
+workflow verifies this module identity and builds the Go packages on Linux.

go.mod

@@ -1,3 +1,3 @@
-module github.com/sechmachine/VerseVDI-Protocol
+module git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol
 
 go 1.26

proto/versevdi/control/v1/control.proto

@@ -4,7 +4,7 @@ package versevdi.control.v1;
 
 import "google/protobuf/timestamp.proto";
 
-option go_package = "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol";
+option go_package = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol";
 
 message VersionNegotiation {
   repeated string supported_versions = 1;

proto/versevdi/tunnel/v1/tunnel.proto

@@ -4,7 +4,7 @@ package versevdi.tunnel.v1;
 
 import "google/protobuf/timestamp.proto";
 
-option go_package = "github.com/sechmachine/VerseVDI-Protocol/gen/go/tunnel";
+option go_package = "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/tunnel";
 
 message VersionNegotiation {
   repeated string supported_versions = 1;

tests/go/protocol_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	protocol "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol"
+	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
 )
 
 func TestManifestRejectsForbiddenAndUnknownFields(t *testing.T) {

tools/go-conformance/main.go

@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	protocol "github.com/sechmachine/VerseVDI-Protocol/gen/go/protocol"
+	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
 )
 
 const (