This is a living architecture backlog. Status was reconciled with the implementation on 2026-07-31; completed items are called out so this document does not present old work as a current gap.

1. Areas of Improvement & Codebase Tweaks

High-Level Improvements

• Storage Subsystems — implemented for local inboxes: BadgerDB-backed inbox storage, optional at-rest encryption, inbox fetch, rooms, scripts, and message deduplication now exist. PostgreSQL/multi-node storage is still future work.
• Identity Sybil Protection — partial: identity.PoWManager exists and can gate registration when attached to the client server. The main binary does not currently configure it, so public registration is not beta-ready.
• Queueing Engine — partial: a persistent BadgerDB queue with retry/backoff exists. It cannot deliver external mail until Pipeline.OutboundDeliver is wired.
• Trusted delivery — implemented locally: SQLite-backed consent, reputation, and emergency deny controls are wired into all ingress transports. Recipient-facing request/approval APIs remain missing.

Low-Level / Protocol Tuning

• QUIC Stream Multiplexing: The quic_server currently spawns a goroutine per stream. We should implement a bounded worker pool for connection handling to prevent Out-Of-Memory (OOM) under DDOS conditions.
• Zero-Copy Serialization — partial: buffer pooling is used in signature paths; benchmark-driven profiling is still required before broader optimization.
• ECDH Shared Secret Caching: Diffie-Hellman operations are computationally expensive. Implementing an LRU Cache (e.g. hashicorp/golang-lru) for recent SharedSecrets paired with recipient X25519 keys will exponentially increase throughput to frequent relay targets.

2. Advanced Mail Routing & Mapping

To reach feature parity with deeply entrenched MTAs (Postfix/Exim), the AfterSMTP Core Router needs a comprehensive mapping facility.

Global & Administrative Maps

The SQLite-backed MappingEngine currently supports: - access_map: IP and CIDR based network blocking (e.g. 192.168.1.0/24 REJECT). - mx_record_map: Explicit routing overrides for specific domains, bypassing standard DNS/Ledger lookups. - spam_cat_acl: score-to-action lookup storage. No Rspamd/SpamAssassin ingestion or RCPT-time enforcement is wired yet. - relay_domains: A strict list of domains the node is cryptographically authorized to accept mail for, rejecting open-relay attempts early.

3. Address Rewriting & Translation Facility

Bridging internal AMP and external legacy SMTP requires dynamic address rewriting.

AMP to Legacy (Egress)

When an internal DID did:aftersmtp:msgs.global:ryan sends to a legacy user external@gmail.com, this remains a design target. The OffRamp exists but is not wired into the running pipeline: - The system must strip the AMP headers, decrypt the payload, and dynamically rewrite the From: header to a standard SMTP format: From: ryan@msgs.global. - A canonical_maps feature to define custom translations (e.g., did:aftersmtp:msgs.global:support-team rewrites to helpdesk@msgs.global).

Legacy to AMP (Ingress)

When external@gmail.com emails sales@msgs.global, the bridge currently: - The legacy Bridge hits a virtual_alias_maps lookup table to determine that sales@msgs.global routes to did:aftersmtp:msgs.global:alice and did:aftersmtp:msgs.global:bob. - The engine encrypts a discrete AMP message for each accepted recipient and stores it locally. Alias behavior depends on the SMTP rewriter configuration.

4. Administrative Message Resigning (ARC/DKIM)

A state-of-the-art capability for large organizations is centralizing trust. - Automated Re-Signing: If an email arrives from an internal legacy system (like an old printer), the AfterSMTP Gateway captures it. Before passing it to the internet, it attaches a strong DKIM signature covering the Date, From, To, Subject, and Body, validating the origin. - ARC Sealing: When operating as a mailing list server or authorized forwarder, AfterSMTP will validate the inbound DKIM/SPF, and attach an Authenticated Received Chain (ARC) signature. This preserves the original sender's reputation (e.g. Gmail) as it passes through the AfterSMTP node preventing DMARC failures down the line.

5. Other State-of-the-Art Features to Implement

• Time-Expiring Messages: Utilizing the Proof of Transit blockchain timestamps, messages can mathematically refuse to decrypt after a specific epoch time, effectively introducing Ephemeral Email protocols.
• Quantum-Resistant Cryptography: Abstracting the X25519/Ed25519 implementations to support hybrid Kyber/Dilithium key matrices to defend against "Harvest Now, Decrypt Later" attacks.
• MailScript Integration: Expose an embedded JS/Lua/CEL engine within the Delivery Routing pipeline. This allows administrators to write dynamic scripts (if headers.contains('urgent') { route_to_slack_webhook() }) directly inside the node's configuration.