Update kit dependencies and licensing references

docs/roadmap/policy.md

@@ -2,7 +2,7 @@
 
 ## Purpose
 
-Align Notarius with the upstream licensing-documentation standards while
+Adopt the licensing-documentation conventions defined below while
 preserving its deliberate policy adaptations, existing project grant, and
 source-only release process. This is a documentation and policy work set, not
 a relicensing, runtime, or release-automation project.
@@ -12,22 +12,20 @@ not implement the policy or authorize release publication.
 
 ## Reviewed Baseline
 
-Reviewed on 2026-09-26 against upstream `policy` commit
-`dafa823981004d4d58a5eb1b59a84ffebbd979da`, available in `../policy`.
-Notarius's existing policies record upstream baseline
-`45591a79004c6811950f14dca554f6ff69b7f58e`.
+Reviewed on 2026-09-26 against Notarius's current policy documents and pinned
+dependencies. The table records the selected policy-version targets; repository
+documentation must remain self-contained.
 
-| Policy | Current Notarius baseline | Target upstream baseline | Required change |
+| Policy | Current Notarius baseline | Target version | Required change |
 | --- | --- | --- | --- |
 | `docs/policy/oss.md` | Absent | 1.2 | Adopt the licensing and attribution policy with Notarius-specific adaptation. |
 | `docs/policy/documentation.md` | 1.3 | 1.5 | Merge licensing ownership and discoverability rules. |
 | `docs/policy/release.md` | 1.1 | 1.2 | Add prospective release-footer guidance without new publication gates. |
-| Agents, architecture, testing | 1.1 | 1.1 | Retain; these upstream templates have not changed since the recorded baseline. |
+| Agents, architecture, testing | 1.1 | 1.1 | Retain existing substantive rules. |
 
 `COPYRIGHT` already identifies Notarius, its copyright statement, and the
 `GPL-3.0-or-later` grant, including the warranty disclaimer and third-party
-material statement. `LICENSE` contains the matching GPLv3 text. Comparison with
-upstream's reference text found only a missing final newline; no substantive
+material statement. `LICENSE` contains the matching GPLv3 text. No substantive
 license-text change is required.
 
 Current gaps are the absent `docs/oss/` attribution materials, missing README
@@ -40,14 +38,12 @@ inventory.
 
 ### Policy Alignment Without Policy Replacement
 
-Adopt the upstream OSS House Format and maintenance rules in
-`docs/policy/oss.md`. Remove template-adoption instructions and adapt or replace
-template-only example/reference links so the adopted document has no broken
-links or dependencies on an adjacent checkout. There is no need to import the
-template's example project directories.
+Adopt the OSS House Format and maintenance rules defined below in
+`docs/policy/oss.md`, adapted to Notarius. All links must resolve within this
+repository or to public authoritative sources; no adjacent checkout is required.
 
 Identify Notarius as an application with its already selected
-`GPL-3.0-or-later` grant. Preserve the upstream distinction between licensing
+`GPL-3.0-or-later` grant. Preserve the distinction between licensing
 defaults and explicit author choices: adopting the policy does not change
 existing grants, infer different licenses for internal packages, automatically
 advance copyright years, or assume ownership of third-party contributions.
@@ -59,10 +55,9 @@ Preserve subprocess-consumer ownership, prospective/current documentation
 boundaries, immutable accepted ADRs, and the distinction between descriptive
 implementation details and adopted policy.
 
-Changed or newly adopted policies must record their actual upstream template
-version, the upstream commit above, and the actual adoption date. Unchanged
-policies need no version or date churn merely because the upstream repository
-has advanced.
+Changed or newly adopted policies must record their base policy version and
+actual adoption date. Do not add private provenance headers, links, or attribution
+entries. Unchanged policies need no version or date churn.
 
 ### Canonical Licensing Documentation
 
@@ -90,12 +85,12 @@ tools do not automatically require entries merely because maintainers use them.
 
 The current module declarations identify these starting points:
 
-- ConfigKit v0.4.0 and PromptKit v0.11.0;
+- ConfigKit v0.4.1 and PromptKit v0.11.1;
 - `github.com/santhosh-tekuri/jsonschema/v6` v6.0.2;
 - `golang.org/x/text` v0.40.0;
 - `gopkg.in/yaml.v3` v3.0.1 and `go.yaml.in/yaml/v4` v4.0.0-rc.6;
 - PromptKit's OpenRouter and Rakestrawhome backend catalogs at their pinned
-  v2.20260922.1 and v2.20260922.0 revisions, respectively.
+  v2.20260926.0 revisions (now MIT licensed).
 
 This list is an inspection starting point, not a pre-approved license inventory.
 Verify each relevant component's terms, notices, and exact source revision at
@@ -110,8 +105,8 @@ Each attribution entry follows the five-field House Format:
 4. License and notice links.
 5. Corresponding source repository link.
 
-Copy only applicable standard license texts from the upstream reference
-collection, or an authoritative source if the collection lacks a needed text.
+Copy only applicable standard license texts from public authoritative sources,
+such as the license publisher or the verified dependency release.
 Preserve them verbatim and keep explanations outside the texts. Shared standard
 texts may serve multiple entries. Include directly reachable companion texts;
 for example, an LGPLv3 entry must link to both LGPLv3 and GPLv3 texts.
@@ -122,8 +117,8 @@ authoritative module/VCS metadata; do not guess them. Classify upstream files
 by their contents: `LICENSE` or `COPYING` can contain project-specific statements
 as well as standard wording.
 
-Follow upstream's adopted interpretation that direct links to project-specific
-notices satisfy its notice-reproduction convention. Do not add local copies or
+Use the selected convention that direct links to project-specific
+notices satisfy the notice-reproduction format. Do not add local copies or
 repeated approval requirements solely because license language refers to
 reproduction or inclusion. Preserve notices already present in incorporated
 source. Concrete obligations or unresolved rights questions outside this
@@ -164,7 +159,7 @@ source during preparation; an unpublished tag need not resolve remotely yet.
 
 Notarius continues publishing source through lightweight Git tags and checked-in
 release notes. It has no hosted release objects or separate download pages, so
-the upstream hosted-page provision is currently inapplicable. Do not create
+hosted-page guidance is currently inapplicable. Do not create
 another publication channel to satisfy it. Preserve branch-before-tag order,
 the existing validation command, and successful tag push as release completion.
 
@@ -189,8 +184,9 @@ not by changing published history.
 
 - The adopted OSS policy, documentation policy 1.5, and release policy 1.2 agree
   on canonical ownership and preserve Notarius's deliberate adaptations.
-- Policy metadata identifies the reviewed upstream baseline and actual adoption
-  date; unchanged policies retain their existing metadata.
+- Policy metadata identifies the base policy version and actual adoption
+  date, without private provenance; unchanged policies retain their existing
+  metadata.
 - Project licensing statements remain consistent with `GPL-3.0-or-later`.
 - Attribution covers the relevant incorporated components identified by the
   inventory, including applicable transitive dependencies and copied material.