diff --git a/github_test.go b/github_test.go
index 4d515b7..2e4f72d 100644
--- a/github_test.go
+++ b/github_test.go
@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"testing"
 
+	// Note: Borg encryption library; awaiting canonical dappco.re/go/borg publication.
 	"github.com/Snider/Borg/pkg/mocks"
 )
 
diff --git a/go.mod b/go.mod
index 06dbc83..1d4e44e 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	dappco.re/go/cli v0.8.0-alpha.1
 	dappco.re/go/io v0.8.0-alpha.1
 	dappco.re/go/log v0.8.0-alpha.1
-	github.com/Snider/Borg v0.2.0 // Note: HTTP client mocks for GitHub API tests; no core equivalent
+	github.com/Snider/Borg v0.2.0 // TODO(#763): replace with dappco.re/go/borg once published.
 	github.com/minio/selfupdate v0.6.0 // Note: in-place binary self-update and rollback support; no core equivalent
 	github.com/spf13/cobra v1.10.2 // Note: CLI command and flag wiring; no core equivalent
 	golang.org/x/mod v0.34.0 // Note: semantic version comparison for update checks; no core equivalent
diff --git a/go.sum b/go.sum
index 5551def..6cfc2fe 100644
--- a/go.sum
+++ b/go.sum
@@ -1,6 +1,8 @@
 aead.dev/minisign v0.2.0/go.mod h1:zdq6LdSd9TbuSxchxwhpA9zEb9YXcVGoE8JakuiGaIQ=
 aead.dev/minisign v0.3.0 h1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=
 aead.dev/minisign v0.3.0/go.mod h1:NLvG3Uoq3skkRMDuc3YHpWUTMTrSExqm+Ij73W13F6Y=
+dappco.re/go/core v0.3.1 h1:2W2nj5Yx2rmuNBH+Puz2MZh2721edGlNCCJHmGVoM1c=
+dappco.re/go/core v0.3.1/go.mod h1:gE6c8h+PJ2287qNhVUJ5SOe1kopEwHEquvinstpuyJc=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 forge.lthn.ai/core/cli v0.3.6 h1:qYAn+6iMd2py7Wu2CYgXCRQvin1/QG72lH8skR7kqsE=