@@ -601,25 +601,38 @@ jobs:
 
       - name: Test release qualification summary
         run: mise run test:qualification-summary
-  go:
-    name: Go SDK
+  sdk-go-freeze:
+    # The Go SDK moved to ai-openshell/sdk-go (#5031). Its directory stays only
+    # until the final deprecated sdk/go tag exists, so PRs must not add or change
+    # files in it. Deleting files is allowed (the removal PR), and so are the
+    # moved notice and the deprecation comment in README.md and go.mod.
+    # Merge queue runs skip this job; the PR already passed it on its mirror.
+    name: Go SDK Freeze
     needs: pr_metadata
-    if: needs.pr_metadata.outputs.should_run == 'true'
-    runs-on: linux-amd64-cpu8
-    timeout-minutes: 30
-    container:
-      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
-      credentials:
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
+    if: needs.pr_metadata.outputs.should_run == 'true' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-      - name: Install tools
-        run: mise install --locked
-
-      - name: Lint, build, test, proto-check
-        run: mise run go:ci
+      - name: Reject changes to sdk/go
+        env:
+          BASE_SHA: ${{ needs.pr_metadata.outputs.base_sha }}
+        run: |
+          set -euo pipefail
+          changed=$(git diff --name-only --diff-filter=d "${BASE_SHA}...HEAD" -- \
+            sdk/go ':!sdk/go/README.md' ':!sdk/go/go.mod')
+          if [ -z "$changed" ]; then
+            echo "No added or changed files under sdk/go."
+            exit 0
+          fi
+          echo "::error title=Go SDK moved::The Go SDK moved to https://github.com/ai-openshell/sdk-go. Drop the sdk/go changes from this PR and open SDK changes there. Regenerated bindings are not needed here; sdk-go regenerates them from core releases."
+          echo "Changed files under sdk/go:"
+          echo "$changed"
+          exit 1
 
   markdown:
     name: Markdown
 
@@ -193,12 +193,8 @@ Follow `CONTRIBUTING.md` and `create-github-pr`. Authors without target-reposito
 
 ## Go SDK (`sdk/go/`)
 
-- The Go SDK lives in `sdk/go/` with module path `github.com/NVIDIA/OpenShell/sdk/go`.
-- Run `mise run go:ci` for the full SDK CI pipeline (lint, build, test, proto-check, docs-check).
-- Proto bindings are generated with `mise run go:proto:gen` from the `.proto` files in `proto/`.
-- Domain types in `sdk/go/openshell/v1/types/` must not import proto packages.
-- Converters in `sdk/go/openshell/v1/internal/converter/` deep-copy slices and maps at boundaries.
-- Tests use bufconn for in-process gRPC and testify for assertions.
+- The Go SDK moved to [ai-openshell/sdk-go](https://github.com/ai-openshell/sdk-go) (module `github.com/ai-openshell/sdk-go`). Open SDK changes there.
+- `sdk/go/` is frozen until it is removed; Branch Checks fails PRs that change it. Proto changes do not need regenerated Go bindings.
 
 ## TypeScript SDK (`sdk/typescript/`)