Nuncio · backend roadmap
The plan to take the daemon, reference CLI, and gRPC API from today's working spine to a frozen, versioned contract that native front-ends can start consuming — with parity guaranteed by the API, not by discipline.
The daemon boots gRPC-only on loopback 127.0.0.1:9420 behind a keyring-minted
bearer token. IMAP → store → read → SMTP send runs end-to-end over gRPC, driven by the
nuncio-cli reference client, tested fully offline. The legacy JSON-RPC IPC is gone,
and nuncio.v1 is published with a byte-deterministic contract-stability golden.
Milestones M1–M5 are now complete on dev (M1–M4 already promoted to
main): Calendar, Contacts, JMAP, live Filters, and mail lifecycle + incremental
sync are all real, wired, and API-complete. Next up: M6 (security &
release hardening).
The calendar engine is published over the API: a Calendar gRPC service
(Sync / ListEvents / GetEvent — honest surface only) behind the auth interceptor, daemon wiring, CLI
commands replacing the stub, and recurrence (rrule) wired into the fetch/store path.
The fake CardDAV client (returned one hardcoded contact) is replaced with a real, wiremock-tested
client + vCard round-trip; contacts persist through the daemon's store (the CLI previously wrote a throwaway
in-memory DB); a Contacts service, CLI, and offline E2E are in place.
A real JMAP HTTP client (session, Email/query/get/set) with the camelCase wire fix is wired into
the same MailBackend fetch→store path as IMAP; wiremock-tested.
Rules could previously be created, validated, and previewed as “MATCH” but never fired.
FilterEngine::evaluate is now wired into the real sync path so matches trigger their action
(move/flag/delete/forward/webhook), the header + account-field bugs are fixed, and filter
edit/export/import/logs plus bulk triage are re-exposed over the service.
Account lifecycle (edit / delete / test-connection) is real over gRPC, with TLS modes
(implicit / STARTTLS / plain) persisted and actually driving the IMAP/SMTP connection. Sync is now
genuinely incremental via a per-folder {uidvalidity}:{uidnext} checkpoint (a UIDVALIDITY
change forces a safe full re-fetch — no silent mail loss), with a per-item FETCH timeout and
SyncProgress events. SendMessage takes an explicit account id (honest
AccountNotFound, no silent wrong-account fallback), and a failed AddAccount
rolls back its orphaned keyring secret.
Fail-closed everywhere: fix the silent empty-ciphertext data-loss path; a signature-verifying updater that refuses to apply without checksums; zeroize key material; validate vault key lengths; gRPC bind hardening with an interceptor guard; real CIDR-based SSRF checks; sandboxed HTML rendering.
Freeze nuncio.v1: every backend capability is represented, the contract-stability
golden covers the full surface, and the additive-only versioning policy is enforced by test. Verify
Swift / C# / TypeScript codegen with a “hello, daemon” per language. The CLI reference client exercises
every RPC in offline E2E — the proof the contract is complete and usable. Replace the gamed coverage gate;
CI green; tag an honest pre-alpha backend release.
Separate repositories consume the frozen API, parity guaranteed by the contract: nuncio-tui (Rust) · nuncio-gui-macos (Swift + grpc-swift) · nuncio-gui-windows (WinUI / C#) · nuncio-mcp (MCP ↔ gRPC bridge).
OpenPGP / S-MIME E2EE (#79), WASM / QuickJS plugins (#80), and local-LLM summarization (#81) remain honestly backlogged as stubs. They re-enter scope only as deliberate, scoped decisions after the backend is client-ready — never built as filler to clear a badge.
.proto files · a capability is done only when engine + proto + CLI + offline E2E exist and CI is green.
nunciod · nuncio.v1 · loopback 127.0.0.1:9420