Master Capability Directory
Full Feature Matrix
Every capability Nuncio is building toward, each tagged with its real status. No invented benchmarks — just what's shipped, what's in progress, and what's planned.
Core Email Engine & Inbox Power Tools
| Feature / Capability | Scope | Description | Status |
|---|---|---|---|
| Multi-Account IMAP / SMTP Sync | Mail Engine | Unify multiple IMAP/SMTP accounts into a single local SQLite inbox, tested against mock servers. | Available now |
| JMAP Protocol Support | JMAP Driver | A second mail backend alongside IMAP/SMTP, targeting session discovery and JSON-RPC batching per RFC 8620/8621. | Planned |
| SQLite FTS5 Full-Text Search | Search Engine | Local full-text search over synced mail, backed by SQLite FTS5 — no cloud index required. | Available now |
| Vim-Style Triage Motions | TUI & GUI | Single-key triage chords for fast keyboard-driven inbox processing, once the TUI and GUI clients exist. | Planned |
| Rich HTML & Inline Image Rendering | Reader Engine | HTML-to-text formatting for terminal display, with sandboxed HTML rendering as the target for the desktop GUI. | Planned |
| Portable Data Export (MBOX / EML / JSON) | Export Engine | Export synced mail to standard, portable formats — no lock-in. Real and working today. | Available now |
| Tracking Beacon Neutralization | Reader Engine | Stripping 1x1 tracking pixels and remote CSS triggers before rendering, part of the HTML sanitization milestone. | Planned |
Calendar & Contacts Management
| Feature / Capability | Scope | Description | Status |
|---|---|---|---|
| Natural-Language Event Booking | Calendar NLP | Create calendar events from plain text ('coffee with Bob next Tuesday at 2pm'), a target once CalDAV lands. | Planned |
| Local Contacts Store | Contacts Engine | A dedicated local SQLite contacts database with search and vCard support is under active development. | In progress |
| CardDAV Contacts Sync | CardDAV Protocol | Sync address books from Google, iCloud, Fastmail, and Nextcloud over CardDAV. | Planned |
| Automated Contact Harvesting | Mail / Contacts | Extract name/email pairs from mail traffic and update interaction metrics automatically. | Planned |
| CalDAV Calendar Sync | Calendar Engine | Calendar sync exposed end-to-end over the API; the transport exists in the engine but isn't wired up yet. | Planned |
| OAuth 2.0 PKCE for Google Calendar/Contacts | Auth Engine | Loopback OAuth with refresh tokens stored in the OS keyring, once Calendar/Contacts protocols ship. | Planned |
NSQL Server-Side Filter Engine
| Feature / Capability | Scope | Description | Status |
|---|---|---|---|
| NSQL Parser & Compiler | Core Engine | Compiles human-readable NSQL text into a typed Rust AST with multi-pass validation. Real and testable today. | In progress |
| ON ACCOUNT & Domain Matching | NSQL / Rules | Match rules against specific accounts, exact addresses, or domain wildcards. | In progress |
| Dry-Run Rule Tester | CLI (today) | Test a rule against a sample message without touching your database or network state. Works today via the CLI. | In progress |
| Rules Firing on Synced Mail | nunciod Daemon | Running validated rules automatically during the live IMAP sync loop — the next milestone on the roadmap. | Planned |
| Signed Outbound Webhooks | Webhooks | HMAC-SHA256 signed webhook dispatch with redirect blocking and private-IP defenses — implemented in the engine, not yet wired to live sync. | In progress |
| WASM / QuickJS Plugin Runtime | Plugin Runtime | Sandboxed custom automation scripts with declared capability manifests. | Planned |
Four Presentation Shells
| Feature / Capability | Scope | Description | Status |
|---|---|---|---|
| POSIX Reference CLI | CLI | Pipeable JSON output (--json), the E2E driver for the engine, and the only client that exists today. | Available now |
| Native Desktop GUI | GUI | A visual workspace, split panes, sandboxed HTML viewer, and drag-and-drop rule builder — planned as a separate client repo. | Planned |
| Terminal TUI | TUI | Vim motions, single-key triage chords, and a split-view previewer for keyboard-first users. | Planned |
| MCP AI Client | MCP | Exposes mail, calendar, and rule tools to LLM agents through a governed gateway. | Planned |
Model Context Protocol (MCP) AI Integration
| Feature / Capability | Scope | Description | Status |
|---|---|---|---|
| Local LLM Summarization & Triage | Local AI | Offline thread summarization, action-item extraction, and smart replies — a future capability once the MCP client exists. | Planned |
| Claude Desktop & MCP Client Integration | MCP Protocol | Connect AI agents to local mail and calendar data over stdio through a policy gateway. | Planned |
| RBAC Capability Gateway | MCP Security | Fine-grained capability flags, folder whitelists, and audit logging for every agent tool call. | Planned |
| Automatic PII Redaction | MCP Enclave | Masking sensitive identifiers before payloads reach an LLM context window. | Planned |
Privacy, Security & Storage
| Feature / Capability | Scope | Description | Status |
|---|---|---|---|
| OS Keyring Credential Vault | Security | Passwords and OAuth tokens stored exclusively in the native OS credential store — real and enforced today. | Available now |
| WORM Audit Hash Chain | Compliance | Immutable, HMAC-SHA256 hash-chained audit ledger for filter and account mutations — real and verifiable today. | Available now |
| At-Rest Body Encryption | Storage | Column-level encryption for email bodies and subject lines. Not implemented yet — bodies are currently stored unencrypted in the local database. | Planned |
| Attachment Stream Encryption | Storage | Large binary attachments encrypted with a modern stream cipher before being written to disk. | Planned |
| Key & Secret Zeroization | Core Vault | Explicit zeroing of secret memory buffers on drop. In progress; not verified complete across the codebase. | In progress |
| Untrusted HTML Sanitization | GUI / TUI | Sandboxed rendering with JS execution disabled, for whichever client renders HTML email. | Planned |
| Fail-Closed, Signature-Verified Updater | Distribution | An updater that refuses to install anything it can't verify — tracked as a hardening milestone before any packaged release. | Planned |
| Self-Healing Storage Recovery | Storage Engine | Startup integrity checks and corruption recovery for the local SQLite database. | In progress |