Contacts

Part of #591. Membership is carried by the Contact label and by this issue's sub-issues.

Absorbs the requirement previously stated as REQ5.

Scope

Host-rendered overlay: the host draws data the product never sees. Contacts is the first
consumer of that infrastructure, not the whole of it.

What has to be true

A user who wants to send something to someone they know does not handle that person's raw
key. The contact list on their device stays invisible to products — a contact's name and
account are the user's own private map of who is who, and an alias differs per product
context, so handing a product that map hands it the user's social graph. The product acts on
a person it never learns anything about.

• The host renders the picker; the user's choice is the consent.
• The product receives an opaque handle, never a list, a name or an account.
• One handle per contact across all products and hosts, resolved by the core.
• A recipient resolves without the sender learning the recipient's accounts.

Gap

Handle substitution at signing is unwired: a product can pick a contact, not yet pay one.