chore(sdk/go)!: remove the Go SDK, now at github.com/ai-openshell/sdk-go

.agents/skills/build-openshell-mxc-windows/SKILL.md

@@ -312,10 +312,9 @@ compatibility under emulation is not part of these tasks. The aggregate
 commands above on an ARM64 host.
 
 The repository-wide `mise run pre-commit` task is also supported on Windows.
-Run `rust:lockfiles:check`, `sdk:ts:ci`, and `go:ci` through the Windows-aware
-tasks when validating those surfaces. Do not count the Go
-Windows ARM64 race-detector exclusion or POSIX permission-bit skips as security
-coverage. SDK test dependencies must remain at their lockfile versions.
+Run `rust:lockfiles:check` and `sdk:ts:ci` through the Windows-aware tasks
+when validating those surfaces. Do not count POSIX permission-bit skips as
+security coverage. SDK test dependencies must remain at their lockfile versions.
 Its Rust check, Clippy, and test dependencies enter the same MSVC environment
 for the native host target and use an inherited compiler wrapper when it is
 available. Linux glibc

.github/codeql/codeql-config.yml

@@ -6,7 +6,6 @@ name: OpenShell Rust and SDKs
 paths:
   - crates
   - examples
-  - sdk/go
   - sdk/typescript/src
   - python/openshell
 

.github/prompts/compatibility-review.md

@@ -113,8 +113,9 @@ needed.
 
 ## Required surfaces
 
-Account for every surface: `rust-sdk`, `python-sdk`, `go-sdk`, `typescript-sdk`,
-`api-behavior`, `cli`, `configuration`, `policy`, `helm`, and `state`.
+Account for every surface: `rust-sdk`, `python-sdk`, `typescript-sdk`,
+`api-behavior`, `cli`, `configuration`, `policy`, `helm`, and `state`. The Go
+SDK moved to ai-openshell/sdk-go and is not a surface of this repository.
 
 Scope `rust-sdk` to the public API reachable through `openshell-sdk`, including
 its `raw` module and transitive public re-exports. Trace the export path before
@@ -126,16 +127,6 @@ generated server-trait changes reachable through `raw::proto`, identifying
 mock/server implementers as affected consumers and distinguishing them from
 unaffected client callers.
 
-For `go-sdk`, adopt the [Go struct-literal compatibility convention](https://go.dev/doc/go1compat):
-adding fields to exported structs is additive when existing keyed literals remain
-valid and omitted fields preserve existing behavior. Do not report a break solely
-because unkeyed (positional) literals need updating, unless the baseline explicitly
-guarantees that construction form. Still inspect existing field names and types,
-zero-value behavior, comparability (equality and map keys), and serialization
-contracts; a field addition can break those independently. Follow the
-[Go module compatibility guidance](https://go.dev/blog/module-compatibility#maintaining-struct-compatibility)
-for these limits. This exception applies only to Go struct-field additions.
-
 Check exported signatures/types, generated and handwritten SDK behavior,
 serialization and error contracts, command flags and documented machine-readable
 output, config/default semantics, policy formats, chart values, and persisted

.github/workflows/branch-checks.yml

@@ -608,39 +608,6 @@ jobs:
 
       - name: Test release qualification summary
         run: mise run test:qualification-summary
-  sdk-go-freeze:
-    # The Go SDK moved to ai-openshell/sdk-go (#5031). Its directory stays only
-    # until the final deprecated sdk/go tag exists, so PRs must not add or change
-    # files in it. Deleting files is allowed (the removal PR), and so are the
-    # moved notice and the deprecation comment in README.md and go.mod.
-    # Merge queue runs skip this job; the PR already passed it on its mirror.
-    name: Go SDK Freeze
-    needs: pr_metadata
-    if: needs.pr_metadata.outputs.should_run == 'true' && github.event_name == 'push'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Reject changes to sdk/go
-        env:
-          BASE_SHA: ${{ needs.pr_metadata.outputs.base_sha }}
-        run: |
-          set -euo pipefail
-          changed=$(git diff --name-only --diff-filter=d "${BASE_SHA}...HEAD" -- \
-            sdk/go ':!sdk/go/README.md' ':!sdk/go/go.mod')
-          if [ -z "$changed" ]; then
-            echo "No added or changed files under sdk/go."
-            exit 0
-          fi
-          echo "::error title=Go SDK moved::The Go SDK moved to https://github.com/ai-openshell/sdk-go. Drop the sdk/go changes from this PR and open SDK changes there. Regenerated bindings are not needed here; sdk-go regenerates them from core releases."
-          echo "Changed files under sdk/go:"
-          echo "$changed"
-          exit 1
-
   python-sdk-freeze:
     # The Python SDK moved to ai-openshell/sdk-python (#5287), which imported it
     # at v0.1.7. Its files stay only until core removes them, so PRs must not

.github/workflows/codeql.yml

@@ -40,8 +40,6 @@ jobs:
         include:
           - language: rust
             build-mode: none
-          - language: go
-            build-mode: manual
           - language: python
             build-mode: none
           - language: javascript-typescript
@@ -53,25 +51,13 @@ jobs:
           ref: ${{ inputs.candidate_ref && format('refs/tags/{0}', inputs.candidate_ref) || '' }}
           persist-credentials: false
 
-      - name: Set up Go
-        if: matrix.language == 'go'
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: sdk/go/go.mod
-          cache-dependency-path: sdk/go/go.sum
-
       - name: Initialize CodeQL
         uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           config-file: ./.github/codeql/codeql-config.yml
 
-      - name: Build Go SDK
-        if: matrix.language == 'go'
-        working-directory: sdk/go
-        run: go build ./...
-
       - name: Analyze
         id: analyze
         uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3

.github/workflows/release-publish.yml

@@ -543,17 +543,6 @@ jobs:
       npm-version: ${{ inputs.npm-version }}
       make-latest: ${{ inputs.make-latest }}
 
-  tag-sdk-go:
-    name: Tag Go SDK
-    needs: release
-    if: ${{ !inputs.is-prerelease }}
-    permissions:
-      contents: write
-    uses: ./.github/workflows/sdk-go-tag.yml
-    with:
-      version: ${{ inputs.semver }}
-      source-sha: ${{ inputs.source-sha }}
-
   # GitHub treats skipped jobs as passing, so a publisher that never ran would
   # leave the run green. Fail when any publisher expected for this release kind
   # did not succeed, so callers' failure notifications fire.
@@ -567,7 +556,6 @@ jobs:
       - publish-snap
       - publish-prerelease-snap
       - publish-sdk-typescript
-      - tag-sdk-go
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 2
@@ -583,7 +571,7 @@ jobs:
           if [[ "${IS_PRERELEASE}" == "true" ]]; then
             expected+=(publish-prerelease-snap)
           else
-            expected+=(publish-sdk-typescript tag-sdk-go)
+            expected+=(publish-sdk-typescript)
             if [[ "${MAKE_LATEST}" == "true" ]]; then
               expected+=(publish-snap)
             fi

AGENTS.md

@@ -196,10 +196,9 @@ Follow `CONTRIBUTING.md` and `create-github-pr`. Authors without target-reposito
 - Sign off on each commit for DCO compliance. Use the `--signoff` option to `git commit` to add the `Signed-off-by` footer to ensure the user's configured email address is used.
 - Never mention Claude or any AI agent in commits, PR descriptions, or issues (no author attribution, no Co-Authored-By, no "Generated with" footers)
 
-## Go SDK (`sdk/go/`)
+## Go SDK
 
-- The Go SDK moved to [ai-openshell/sdk-go](https://github.com/ai-openshell/sdk-go) (module `github.com/ai-openshell/sdk-go`). Open SDK changes there.
-- `sdk/go/` is frozen until it is removed; Branch Checks fails PRs that change it. Proto changes do not need regenerated Go bindings.
+- The Go SDK lives in [ai-openshell/sdk-go](https://github.com/ai-openshell/sdk-go) (module `github.com/ai-openshell/sdk-go`). Open SDK changes, including dependency and security updates, there; proto changes here need no Go bindings.
 
 ## Python SDK (`python/openshell/`)
 

CI.md

@@ -94,8 +94,8 @@ qualification. Branch checks compare the prospective merge tree with its target,
 using workflow-revision review tooling and the target's tag-derived train policy.
 Release qualification reviews the cumulative diff from the previous reachable
 stable release to the exact candidate commit, using the same tag-derived
-patch/minor policy as the protobuf check. It reviews public Rust, Python, Go,
-and TypeScript SDKs, API behavior, CLI contracts, configuration, policy, Helm,
+patch/minor policy as the protobuf check. It reviews public Rust, Python, and
+TypeScript SDKs, API behavior, CLI contracts, configuration, policy, Helm,
 and persisted state.
 Both Codex workflows share the `codex-release-review` concurrency group with
 `queue: max`, so only one review runs at a time and up to 100 pending reviews
@@ -245,7 +245,7 @@ scanners upload results directly:
   warn-only mode. A preflight turns an unavailable GitHub Dependency Graph into
   a warning, so the workflow remains neutral until the repository feature is
   available.
-- `CodeQL` analyzes product Rust code, examples, and the Go, Python, and
+- `CodeQL` analyzes product Rust code, examples, and the Python and
   TypeScript SDKs. Rust `cfg(test)` blocks, Rust integration-test targets, and
   E2E test code are excluded. It runs nightly on `main`, remains manually
   dispatchable for diagnostics, uploads results to Code Scanning, and retains
@@ -707,7 +707,7 @@ The bot's full administrator documentation is internal to NVIDIA. The only comma
 | `.github/workflows/e2e-label-help.yml` | When a `test:e2e*` label is applied, posts a PR comment telling the maintainer the next manual step (re-run an existing workflow run, or `/ok to test <SHA>` to refresh the mirror). |
 | `.github/workflows/workflow-security.yml` | Runs informational Actionlint and High-severity Zizmor reports on GitHub-hosted runners. |
 | `.github/workflows/dependency-review.yml` | Reports dependency changes when GitHub Dependency Graph is available; otherwise publishes a neutral warning. |
-| `.github/workflows/codeql.yml` | Runs nightly informational CodeQL analysis on `main` for Rust and the Go, Python, and TypeScript SDKs and retains SARIF artifacts. |
+| `.github/workflows/codeql.yml` | Runs nightly informational CodeQL analysis on `main` for Rust and the Python and TypeScript SDKs and retains SARIF artifacts. |
 | `.github/workflows/codex-security.yml` | Advisory scan during prerelease qualification; scans the stable-to-candidate diff and publishes train-scoped SARIF on `main`. |
 | `.github/workflows/codex-compatibility.yml` | Reviews branch and cumulative tagged-release compatibility with Codex and retains advisory findings, PR acknowledgements, and coverage; it does not gate merging or publication. |
 | `.github/workflows/trivy-changes.yml` | Blocks pull requests and merge groups that introduce new High or Critical Helm or Dockerfile misconfigurations. |
@@ -726,13 +726,12 @@ Each step that publishes to an external registry, store, or site lives in its ow
 | `.github/workflows/release-auto-tag.yml` | Weekdays at 14:00 Europe/Zurich, tags the next `-pre.N` on `main` when commits landed since the latest one, then dispatches Pre-release. It skips when the train has no `-pre.1` or its version is already stable, so push each train's `-pre.1` tag by hand. |
 | `.github/workflows/release-prerelease.yml` | Pre-release orchestrator, triggered by prerelease tag pushes or dispatched by Release Auto-Tag or manually. A tagless dispatch creates the next candidate on its branch; explicit tags select existing candidates. Builds, then publishes and qualifies in parallel. Qualification failure fails the run and sends the failure notification; published artifacts remain available. |
 | `.github/workflows/release-build.yml` | Shared version computation, binary and image builds, and package builds. Validates that the tag matches the caller's release kind. |
-| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required) and GitHub Releases, and call the snap, npm, and Go SDK publishers. The Python SDK is released from [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python), so no GitHub Release carries a wheel. |
+| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required) and GitHub Releases, and call the snap and npm publishers. The Python SDK is released from [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python), so no GitHub Release carries a wheel. |
 | `.github/workflows/release-notes.yml` | Shared prompt-driven release notes generation through Inference Hub, used by prerelease previews, notes-only previews, and stable releases. Stable releases reuse the promoted prerelease's preview when available. |
 | `.github/workflows/release-qualification.yml` | Reusable qualification suites and result aggregation. Runs security scans, conformance and feature integration, Docker and VM E2E, protobuf compatibility, and advisory compatibility review. |
 | `.github/workflows/snap-package.yml` | Builds snap and component artifacts for Release Dev, Release, and Pre-release without Store credentials or publication. |
 | `.github/workflows/snap-publish.yml` | Uploads existing snap and component artifacts directly to a Store channel without rebuilding. Release Dev uses `latest/edge`, Pre-release uses `latest/beta`, and Release uses `latest/stable` for the stable rebuild. Uploads queue per channel and architecture, so tagged beta and stable jobs recheck repository tags after earlier publication finishes and before updating their floating channels. Manual dispatch uploads the `snap-linux-*` artifacts from `artifact-run-id`. |
 | `.github/workflows/sdk-typescript-publish.yml` | Publishes the TypeScript SDK to GitHub Packages. Called by stable Release; manual dispatch publishes a given tag and npm version. |
-| `.github/workflows/sdk-go-tag.yml` | Creates the `sdk/go/vX.Y.Z` tag and asks the Go module proxy to fetch it. Called by stable Release; manual dispatch tags a given version and commit. |
 | `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts in the `macos`, `ubuntu-deb`, `ubuntu-snap-system-docker`, `fedora`, and `kubernetes` (kind + Helm) jobs. Each job reaches its gateway and creates, exercises, and deletes a sandbox. The `ubuntu-snap-system-docker` job verifies a compatible system Docker lifecycle, while `ubuntu-snap-docker-preflight` tests fail-fast behavior when Docker is absent or supplied by the Docker snap. The positive snap lane also runs a local policy containment check with the packaged prover. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |
 
 ## Required status contexts

CONTRIBUTING.md

@@ -383,7 +383,6 @@ These are the primary `mise` tasks for day-to-day development:
 | `crates/openshell-policy-schema/` | Canonical authored policy DTOs and bounded YAML/JSON parser |
 | `crates/openshell-prover-cli/` | Standalone local policy boundary checker |
 | `python/`       | Python SDK (frozen, moved to ai-openshell/sdk-python) |
-| `sdk/go/`       | Go SDK (types, gRPC clients, converters)      |
 | `sdk/typescript/` | TypeScript SDK (Connect client and generated protobuf bindings) |
 | `proto/`        | Protocol buffer definitions and [public API conventions](proto/README.md) |
 | `tasks/`        | `mise` task definitions and build scripts     |

README.md

@@ -74,7 +74,7 @@ SDKs connect applications to an OpenShell gateway. They do not install the CLI.
 |---|---|---|
 | Python | `uv add openshell` | [README](python/openshell/) |
 | TypeScript | `npm install @nvidia/openshell-sdk` (GitHub Packages) | [README](sdk/typescript/README.md) |
-| Go | `go get github.com/NVIDIA/OpenShell/sdk/go@latest` | [README](sdk/go/README.md) |
+| Go | `go get github.com/ai-openshell/sdk-go@vX.Y.Z` | [ai-openshell/sdk-go](https://github.com/ai-openshell/sdk-go) |
 | Rust | `cargo add openshell-sdk --git https://github.com/NVIDIA/OpenShell --tag <release-tag>` | [Installation and usage](docs/sdk/rust.mdx) |
 
 ## Community

TESTING.md

@@ -124,8 +124,7 @@ plugin through its Windows `.cmd` launcher, and installs the matching locked
 ARM64 Rolldown binding when Node itself is ARM64. The helper preserves lockfile
 resolution; it must not upgrade unrelated test dependencies.
 
-`mise run --skip-tools go:ci` retains race detection except on Windows ARM64,
-where Go does not support it. Windows token-file tests explicitly skip POSIX
+Windows token-file tests explicitly skip POSIX
 mode-bit assertions; those skips do not establish Windows ACL protection.
 Use a checkout with LF text files when running Unix-shell fixture checks.
 

buf.yaml

@@ -3,9 +3,9 @@
 
 # Repo-level buf workspace. Declares public and storage modules so buf generate,
 # buf lint, buf breaking, and the editor LSP all resolve imports the same way.
-# Code generation lives with each consumer (see sdk/go/buf.gen.yaml,
-# sdk/typescript/buf.gen.yaml); this file owns the module boundaries and proto
-# validation policy.
+# Code generation lives with each consumer (see sdk/typescript/buf.gen.yaml;
+# the Go SDK in ai-openshell/sdk-go generates from a release tag); this file
+# owns the module boundaries and proto validation policy.
 version: v2
 modules:
   - path: proto