@@ -1,27 +1,9 @@
 <!--
-Sync Impact Report
-==================
-Version change: 1.1.0 → 1.2.0 (MINOR - quality gates expanded to match CI)
+Sync Impact Report: 1.1.0 → 1.2.0 (MINOR)
 
-Modified principles:
-- Technology Constraints: Added "CI uses Go 1.25.5" for clarity
-- Quality Gates: Expanded from 4 to 7 items to match CI pipeline exactly:
-  - Changed from `go test -cover` to `go test -v -race -coverprofile=coverage.out`
-  - Changed from `go fmt` to `gofmt -l` (CI uses gofmt directly)
-  - Added `go mod verify` for dependency verification
-  - Added `govulncheck` for vulnerability scanning
-  - Added `gosec` for security scanning
-
-Added sections: None
-
-Removed sections: None
-
-Templates requiring updates:
-- .specify/templates/plan-template.md: ✅ No changes needed (generic constitution check)
-- .specify/templates/spec-template.md: ✅ No changes needed (compatible)
-- .specify/templates/tasks-template.md: ✅ No changes needed (compatible)
-
-Follow-up TODOs: None
+Modified: IV. Standard Library Preference - added approved external dependencies
+Updated: Technology Constraints (Go 1.25.5), Quality Gates (govulncheck, gosec)
+Templates: All compatible, no changes needed
 -->
 
 # AgentMail Constitution
@@ -73,6 +55,14 @@ External dependencies MUST be justified. Prefer Go standard library:
 - `os/signal` for daemon signal handling
 - `time` for scheduling and timeouts
 
+**Approved External Dependencies** (with documented rationale):
+
+| Dependency | Version | Rationale |
+|------------|---------|-----------|
+| `github.com/fsnotify/fsnotify` | v1.9.0 | File watching for instant daemon notifications; stdlib lacks cross-platform fsnotify equivalent |
+| `github.com/modelcontextprotocol/go-sdk` | v1.2.0 | Official MCP SDK for AI agent integration; implementing MCP protocol from scratch is impractical |
+| `github.com/peterbourgon/ff/v3` | v3.4.0 | Lightweight CLI flag parsing with subcommand support; reduces boilerplate vs stdlib flag package |
+
 New dependencies require documented rationale in research.md with:
 - Why standard library is insufficient
 - Security/maintenance implications
@@ -82,7 +72,7 @@ New dependencies require documented rationale in research.md with:
 
 ## Technology Constraints
 
-- **Language**: Go 1.21+ (per IC-001), CI uses Go 1.25.5
+- **Language**: Go 1.25.5 (minimum 1.21+ per IC-001)
 - **Storage**: JSONL files in `.agentmail/` directory (per-recipient files, state files)
 - **Platform**: macOS and Linux with tmux installed
 - **Build**: Standard `go build`, no CGO dependencies
 
@@ -81,22 +81,22 @@ Templates are stored in `.specify/templates/` and project constitution in `.spec
 ## Active Technologies
 - Go 1.21+ (per IC-001) + Standard library only (os/exec for tmux, encoding/json for JSONL) (001-agent-mail-structure)
 - JSONL file in `.agentmail/` directory (001-agent-mail-structure)
-- Go 1.21+ (project uses Go 1.25.3) + GitHub Actions (yaml workflows), PaulHatch/semantic-version action for version calculation (002-github-ci-cd)
+- Go 1.21+ (project uses Go 1.25.5) + GitHub Actions (yaml workflows), PaulHatch/semantic-version action for version calculation (002-github-ci-cd)
 - N/A (CI/CD configuration files only) (002-github-ci-cd)
-- Go 1.21+ (per constitution IC-001, project uses Go 1.25.3) + Standard library only (os/exec, encoding/json, bufio, os) (003-recipients-help-stdin)
+- Go 1.21+ (per constitution IC-001, project uses Go 1.25.5) + Standard library only (os/exec, encoding/json, bufio, os) (003-recipients-help-stdin)
 - JSONL files in `.agentmail/` directory (003-recipients-help-stdin)
 - Ruby (Homebrew formula DSL), YAML (GitHub Actions), Go 1.21+ (existing) + Homebrew (user-side), GitHub Actions, gh CLI (for cross-repo updates) (004-homebrew-distribution)
 - N/A (formula hosted in separate GitHub repo) (004-homebrew-distribution)
-- Go 1.21+ (per constitution IC-001, project uses Go 1.25.3) + Standard library only (os, fmt, io - already used) (005-claude-hooks-integration)
+- Go 1.21+ (per constitution IC-001, project uses Go 1.25.5) + Standard library only (os, fmt, io - already used) (005-claude-hooks-integration)
 - JSONL files in `.agentmail/` directory (005-claude-hooks-integration)
-- Go 1.21+ (per constitution IC-001, project uses Go 1.25.3) + Standard library only (os/exec, encoding/json, syscall, time, os/signal) (006-mailman-daemon)
+- Go 1.21+ (per constitution IC-001, project uses Go 1.25.5) + Standard library only (os/exec, encoding/json, syscall, time, os/signal) (006-mailman-daemon)
 - JSONL files - `.agentmail/mailman.pid` (PID), `.agentmail/recipients.jsonl` (state) (006-mailman-daemon)
 - Go 1.21+ (per IC-001) + Standard library only (os, filepath, syscall, encoding/json) (007-storage-restructure)
 - JSONL files in `.agentmail/` directory hierarchy (007-storage-restructure)
 - Go 1.21+ (per IC-001) + Standard library only (time, sync) (008-stale-agent-mailman)
 - JSONL files in `.agentmail/` (existing), in-memory tracker (new) (008-stale-agent-mailman)
 - Go 1.21+ (per constitution IC-001) + Standard library only (os, time, syscall) + fsnotify (external - requires justification) (009-watch-files)
-- Go 1.23 (per go.mod, constitution requires 1.21+) + github.com/modelcontextprotocol/go-sdk (official MCP SDK) (010-mcp-server)
+- Go 1.25.5 (per go.mod, constitution requires 1.21+) + github.com/modelcontextprotocol/go-sdk (official MCP SDK) (010-mcp-server)
 - JSONL files in `.agentmail/` directory (existing infrastructure), MCP server via STDIO transport (010-mcp-server)
 - Go 1.21+ (per constitution IC-001, project uses Go 1.25.3) + Standard library only (os/exec, encoding/json, syscall, time, os) (011-cleanup)
 - JSONL files in `.agentmail/` directory (recipients.jsonl, mailboxes/*.jsonl) (011-cleanup)
 
@@ -2,6 +2,7 @@
 
 [![Test](https://github.com/UserAd/AgentMail/actions/workflows/test.yml/badge.svg)](https://github.com/UserAd/AgentMail/actions/workflows/test.yml)
 [![Release](https://github.com/UserAd/AgentMail/actions/workflows/release.yml/badge.svg)](https://github.com/UserAd/AgentMail/actions/workflows/release.yml)
+[![Go Report Card](https://goreportcard.com/badge/github.com/UserAd/AgentMail)](https://goreportcard.com/report/github.com/UserAd/AgentMail)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 A Go CLI tool for inter-agent communication within tmux sessions. Agents running in different tmux windows can send and receive messages through a simple file-based mail system.
@@ -22,7 +23,7 @@ A Go CLI tool for inter-agent communication within tmux sessions. Agents running
 
 ## Requirements
 
-- Go 1.25 or later
+- Go 1.25.5 or later
 - tmux (must be running inside a tmux session)
 - Linux or macOS
 
@@ -617,21 +618,51 @@ go test -v -race -coverprofile=coverage.out ./...
 go tool cover -html=coverage.out
 ```
 
-### Lint
+### Lint & Security
 
 ```bash
+# Format code
 go fmt ./...
+
+# Static analysis
 go vet ./...
+
+# Vulnerability scanning
+go install golang.org/x/vuln/cmd/govulncheck@latest
+govulncheck ./...
+
+# Security scanning
+go install github.com/securego/gosec/v2/cmd/gosec@latest
+gosec ./...
 ```
 
 ### Testing in CI Environment
 
-To match the CI environment (Go 1.25, Linux):
+To match the CI environment (Go 1.25.5, Linux):
 
 ```bash
-docker run --rm -v $(pwd):/app -w /app golang:1.25 go test -v -race ./...
+docker run --rm -v $(pwd):/app -w /app golang:1.25.5 go test -v -race ./...
 ```
 
+### CI/CD Pipeline
+
+The project uses GitHub Actions for continuous integration and delivery:
+
+**Test Workflow** (on push to main and PRs):
+- Code formatting verification (`gofmt`)
+- Dependency verification (`go mod verify`)
+- Static analysis (`go vet`)
+- Tests with race detection (`go test -race`)
+- Coverage report generation
+- Security scanning (`govulncheck`, `gosec`)
+
+**Release Workflow** (on push to main):
+- Pre-release test validation
+- Semantic version calculation from commit messages
+- Cross-platform builds (Linux/macOS, amd64/arm64)
+- GitHub Release creation with auto-generated notes
+- Homebrew formula automatic update
+
 ## Project Structure
 
 ```