diff --git a/docs/policy/oss.md b/docs/policy/oss.md
index 9e2f167..52ea487 100644
--- a/docs/policy/oss.md
+++ b/docs/policy/oss.md
@@ -2,7 +2,7 @@
 
 **Base Policy Version:** 1.8
 
-**Last Updated**: 2026-10-06
+**Last Updated**: 2026-10-07
 
 **Upstream Source:** [oss.md](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/oss.md)
 
@@ -37,9 +37,10 @@ instructions or unrelated code and documentation.
 
 The source project is [CommandKit](https://gitea.maximumdirect.net/eric/CommandKit).
 Concrete release-channel URLs and publication mechanics belong in the release
-procedure when it is implemented. Cobra and pflag have been selected as the
-initial backend, but are not yet incorporated dependencies. Add their notices
-and applicable license texts when actual versions are introduced.
+procedure when it is implemented. Incorporated dependency notices, including
+Cobra and pflag, are maintained in the [attribution document](../oss/attribution.md)
+with links to their applicable license texts. Dependency versions belong in the
+module declaration and attribution entries.
 
 ## Canonical Locations
 
diff --git a/docs/policy/testing.md b/docs/policy/testing.md
index a744ab1..d0f16c6 100644
--- a/docs/policy/testing.md
+++ b/docs/policy/testing.md
@@ -2,7 +2,7 @@
 
 **Base Policy Version:** 1.3
 
-**Last Updated**: 2026-10-06
+**Last Updated**: 2026-10-07
 
 **Upstream Source:** [testing.md](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/testing.md)
 
@@ -44,8 +44,8 @@ Examples of appropriate seams include clocks, randomness, subprocesses, remote A
 
 CommandKit is a library that defines CLI behavior. Its public consumer boundary
 is the root facade, and backend integration belongs behind the internal adapter.
-Select validation proportionate to the change. The developer guide owns concrete
-commands as implementation lands; there is currently no Go suite. Prose-only
+Select validation proportionate to the change. The [developer guide](../development.md)
+owns concrete validation commands for the implemented Go suite. Prose-only
 policy adoption requires document review, not new tests or checker code.
 
 Tests in the default suite must be deterministic, offline, and independent of real credentials. They must not invoke paid APIs or depend on mutable external services. Tests that require live infrastructure must be explicitly opt-in and clearly separated from the default suite.
diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md
index cef015e..50e8598 100644
--- a/docs/roadmap/remediation.md
+++ b/docs/roadmap/remediation.md
@@ -172,14 +172,16 @@ Owner: [cli.md](../cli.md).
 
 Owners: [testing.md](../policy/testing.md) and [oss.md](../policy/oss.md).
 
-- [ ] Remove the testing policy's claim that there is currently no Go suite.
+- [x] Remove the testing policy's claim that there is currently no Go suite.
   Keep concrete validation commands in the developer guide.
-- [ ] Remove the OSS policy's claim that Cobra/pflag are not incorporated and
+- [x] Remove the OSS policy's claim that Cobra/pflag are not incorporated and
   that their notices still await introduction. Link to existing attribution;
   keep version inventories out of the policy.
-- [ ] Preserve policy rules and upstream provenance while correcting local
+- [x] Preserve policy rules and upstream provenance while correcting local
   implementation status. This work does not add testing or licensing gates.
 
+**Completion:** Removed stale Go-suite and dependency-status claims while preserving policy rules, adopted versions, and upstream provenance.
+
 ## D-09: correct the internal bridge description
 
 Owner: [internal/overview.md](../internal/overview.md).