Current line — v0.30 (2026)
Mid-August- Meet, the first working shape: real-time calls gain a server surface — a session anchored on a chat room, whose creation reaches every member of that room so a callee learns of the call without a dedicated notification type, plus a transient relay for the WebRTC handshake that is never persisted and never logged. Phase 1 is peer-to-peer with up to three active participants, and membership is a self-expiring heartbeat lease rather than a flag (Meet).
Email/getgains its tree:bodyStructureis emitted and recursive,fetchAllBodyValuesfinally reaches everytext/*leaf — thetext/calendarpart of an invitation included — and attachments carrypartId,charsetanddisposition. Per-part headers are served underbodyProperties, the only RFC route to the Content-Type parameters that tell an invitation from an attached.ics. Contract change: with nofetch*BodyValuesargument,bodyValuesnow comes back empty as RFC 8621 §4.2 requires, where it used to be populated unconditionally (the body tree).- Every
/getcloses its vocabulary, and the canon is published: an unknown property name isinvalidArgumentsnaming the offenders rather than a silently ignored word, and which properties are selectable — and which are computed per caller — is now emitted in machine form next to the generated types (the projection canon). - Shared mailboxes read and write correctly: the decryption key follows the effective account rather than the caller, so bodies in a shared mailbox open; and a message filed by a grantee is encrypted for the owner, closing the mirror of the same defect (encryption at rest).
Thread/getandThread/changesreturn to pure RFC 8621 clients, served under themailcapability where §3 puts them; a client declaring onlycore+mailused to be toldunknownCapabilityon a mandatory method (mail).- Tenant contact directories: an organization can publish shared contact sets that reach members as read-only cards in their own address book, with entries maintained by named principals and groups (contacts, ADR-133).
- Post-quantum key exchange is actually negotiated: X25519MLKEM768 is offered first, with classic X25519 as fallback, on 25, 465, 587, 993 and 443. The feature had been compiled in for months while the installed provider could not implement it, so every session silently fell back (TLS & ACME).
- Two years of upstream encryption: SQLCipher 4.5.7 to 4.14.0, SQLite 3.45.3 to 3.51.3, verified by running
PRAGMA cipher_versionrather than by reading a manifest — the engine’s own fixes only reach an encrypted database through a SQLCipher release. The shipped binary is now checked at deploy time to depend on no system crypto, TLS or SQLite library (the database). - Handshake logs stop crying wolf: the four TLS listeners separate a peer that hung up before negotiating from a real handshake failure, each branch carrying a stable
reasonfield. One production instance was emitting 480 harmless warnings a day from a single monitoring probe — and a real failure would have hidden inside them (operations). dkim=failsays why: the failure reason reaches theAuthentication-Resultsheader and the stored per-message result, so a post-mortem can separate an invalid signature from a body altered in transit, a missing key, or a signature dated in the future — which means the server’s own clock is behind (email authentication).- Operability:
oximail sqlroutes by the shape of the statement, so aWITH … SELECTreturns rows instead of reporting “0 rows affected”;blobs gcwill not collect an unreferenced blob younger than a 24-hour upload grace window (RFC 8620 §6.1); local rollback snapshots gained a retention policy the deploy path applies;doctorjudges clock health; and limits that were only announced became limits something enforces (CLI, operations). - Time zones: a tenant’s default time zone is readable, inherited and monitored, and a time zone supplied at provisioning now reaches the principal — an invalid one is refused before the first write instead of being accepted and ignored.
- Federation, first working shape: the bilateral out-of-band pairing ceremony (fingerprint over realm and key, node key per organization), a portable identity root distinct from the disposable working key on the box (rotation is revocation, by monotonic epoch), and the cross-organization grant model — realm-scoped, owner-written, self-expiring, widening the access axis only. Pairing revocation suspends access rather than destroying the record; erasure notices are stamped on the identity anchor and fail closed at delivery (ADR-124 to ADR-127).
- Read receipts, both surfaces. Mail gains the RFC 9007 MDN surface —
MDN/sendcomposes a receipt as an explicit user gesture,MDN/parsefinally makes the inbound receipts already linked to your sent mail readable. Chat read receipts now reach every member of a group or channel live instead of only a direct peer, with a per-channel visibility switch and a room-size ceiling on the live fan-out (chat). - Drive version history on the wire:
FileVersion/query,getandrestore, withmaxVersionsPerNodeadvertised and pruning driven by the same constant (files). - Sync honesty: a
Foo/changescursor older than the 90-day replay window is now refused withcannotCalculateChangesinstead of being told it is synced — one store-level chokepoint every consumer inherits, DAVsync-collectionincluded./changesalso collapses to one outcome per id per RFC 8620 §5.2, and an empty/setbatch no longer skips itsifInStatecheck (JMAP Core). - Streaming credentials: SSE streams open with a 60-second ephemeral ticket instead of the session token, so a 24-hour credential no longer travels in a URL that proxies log.
- Wire shapes corrected where they leaked storage: chat link previews are typed objects rather than an array of raw byte values; a
message/rfc822part is advertised as the attachment it is, instead of publishing the encapsulated message’s own attachments at the top level; four calendar storage internals left the wire. - IMAP:
FETCH RFC822,RFC822.HEADERandRFC822.TEXTreturned no payload — andRFC822marked the message\Seenanyway. Both fixed (legacy protocols). - Retention and backup integrity: per-organization backup no longer silently omits attachment blobs or the rows of tables missing from a hand-maintained list, and
verify-backupcan see the difference; the trash that expiring messages sweep into finally has a retention policy behind it; body-part blobs became the derived cache ADR-098 always described, re-derived and hash-verified on a download miss (operations). - Operability: eleven boot-time janitors no longer collide into
sqlite busyand a lost tick on every start;doctorstopped reporting the whole delivery queue as pending; a read-onlyspam checkverb asks the filter its current opinion of a stored message; inbound DSN and ARF now raise bounce and complaint events on the ingest path. - App-password scopes are enforced end to end: the scope rides the token and survives refresh, one capability matrix decides, and protocol access derives from the capability set — enforced at JMAP dispatch, IMAP login and DAV (ADR-129).
- Anti-spam: RCPT-time greylisting was retired as a defence — botnets retry, sender IP pools break the triple, and it taxed legitimate cold senders. Authentication enforcement and the scored pipeline carry that load (ADR-128, anti-spam).
- Setup: the wizard gained a smarthost profile as a third entry, recorded as an audited intent marker rather than a role (first boot).
- Envelope-sender domains: a platform sending through the MSA can use a technical
MAIL FROMon a DNS-proven domain — VERP forms included — while theFrom:header stays the human identity. The granted domain must share its organizational domain with an identity of the account, so SPF alignment under relaxed DMARC holds by construction (bulk sending).
- Compliance: per-organization mail journaling (inbound/outbound, mailbox or external archiver), and account erasure rebuilt as a durable, resumable phase machine with a reversal buffer, DSAR proof (
oximail erasure prove), and audit-log retention enforcement. - Performance: a measured load-test campaign roughly tripled read throughput (per-connection prepared-statement cache) and doubled saturated ingest (composite thread index); single-message ingest lost its fixed latency floor (search commits on quiescence); the WAL is bounded and observable.
- Delivery correctness: ingest delta-sync visibility became atomic with the message row; recipient Rules and vacation now run on local-to-local delivery (ADR-117); outbound hops mediate ESMTP extensions (SMTPUTF8/8BITMIME/SIZE) instead of silently bridging; DKIM oversigns From/To/Subject.
- Client interop wave (verified against Apple Calendar, Thunderbird, eM Client, Outlook invitations): DAV bootstrap at the server root, CDATA-safe XML, content-hash ETags, real
calendar-queryfilters, VTIMEZONE emission, VALARM modelling,EXPUNGE-correct IMAP announcements, and an eM Client preconfigured settings endpoint. - Auth: DPoP v2 — server nonce, per-request resource proofs, and the single-blob media token.
- Outbound smarthost relay (ADR-116): relay accounts with DNS-proven domains, one-time enrolment, recipient-per-day quotas with warm-up, ephemeral relay retention, DNSBL self-monitoring (outbound relay).
- Security batch: constant-work app-password verification, SSRF hardening on push and unfurl fetchers, fail-closed shared-account dispatch, submission
From:header authorization, token at-rest hashing. - Spam pipeline overhaul: Bayes corpus epochs and rebuild, authenticated-only trusted-reply whitelist, disposition spine (anti-spam).
- Drive and collaboration: rooted drive with per-viewer stars and server thumbnails, share-link accounting, conversation timeline, chat capacity caps and member-scoped typing.
- Wire conformance sweep: the
/querysilent-ignore class eliminated (unknown filters/sorts/arguments are errors), extension capabilities advertised truthfully inaccountCapabilities.