Nuncio · backend roadmap
The plan to take the daemon, reference CLI, and gRPC API from today's working spine to a frozen, versioned contract that native front-ends can start consuming — with parity guaranteed by the API, not by discipline.
The daemon boots gRPC-only on loopback 127.0.0.1:9420 behind a keyring-minted
bearer token. IMAP → store → read → SMTP send runs end-to-end over gRPC, driven by the
nuncio-cli reference client, tested fully offline. The legacy JSON-RPC IPC is gone,
and nuncio.v1 is published with a byte-deterministic contract-stability golden.
Publish the calendar engine over the API: a Calendar gRPC service
(Sync / ListEvents / GetEvent — honest surface only) behind the auth interceptor, daemon wiring, CLI
commands replacing the stub, and recurrence (rrule) wired into the fetch/store path (today it's dead code).
Replace the fake CardDAV client (returns one hardcoded contact) with a real, wiremock-tested
client + vCard round-trip; persist through the daemon's store (the CLI currently writes a throwaway
in-memory DB); add a Contacts service, CLI, and offline E2E.
A real JMAP HTTP client (session, Email/query/get/set) with the camelCase wire fix, wired into
the same MailBackend fetch→store path as IMAP; wiremock-tested.
Today rules can be created, validated, and previewed as “MATCH” but never fire. Wire
FilterEngine::evaluate into the real sync path so matches trigger their action
(move/flag/delete/forward/webhook), fix the header + account-field bugs, and re-expose filter
edit/export/import/logs and bulk triage over the service.
Round out real account management: edit / delete / test-connection with TLS modes
(implicit / STARTTLS / plain) actually wired; explicit send-account selection; and incremental sync
(honor since_state instead of re-fetching the whole mailbox every time) with progress and stall timeouts.
Fail-closed everywhere: fix the silent empty-ciphertext data-loss path; a signature-verifying updater that refuses to apply without checksums; zeroize key material; validate vault key lengths; gRPC bind hardening with an interceptor guard; real CIDR-based SSRF checks; sandboxed HTML rendering.
Freeze nuncio.v1: every backend capability is represented, the contract-stability
golden covers the full surface, and the additive-only versioning policy is enforced by test. Verify
Swift / C# / TypeScript codegen with a “hello, daemon” per language. The CLI reference client exercises
every RPC in offline E2E — the proof the contract is complete and usable. Replace the gamed coverage gate;
CI green; tag an honest pre-alpha backend release.
Separate repositories consume the frozen API, parity guaranteed by the contract: nuncio-tui (Rust) · nuncio-gui-macos (Swift + grpc-swift) · nuncio-gui-windows (WinUI / C#) · nuncio-mcp (MCP ↔ gRPC bridge).
OpenPGP / S-MIME E2EE (#79), WASM / QuickJS plugins (#80), and local-LLM summarization (#81) remain honestly backlogged as stubs. They re-enter scope only as deliberate, scoped decisions after the backend is client-ready — never built as filler to clear a badge.
.proto files · a capability is done only when engine + proto + CLI + offline E2E exist and CI is green.
nunciod · nuncio.v1 · loopback 127.0.0.1:9420