REQ5: A user sends to a person, not to a key

[filvecchiato]

Requirement for Release 2.

The problem

A user who wants to send something to someone they know has to handle that person's raw
key — pasting it, or scanning a QR code, every time. The contact list already on their
device is invisible to products, and it has to stay that way: a contact's name and account
are the user's own private map of who is who, and an alias differs per product context, so
handing a product that map hands it the user's social graph.

The product therefore cannot be given the recipient. It has to act on a person it never
learns anything about, which means something other than the product turns the person the
user picked into the account the action needs.

For items it is worse than inconvenient. Only the recipient's own host can derive their
purses, so a product can move an item only between accounts whose derivation is public.
Sending an item to a real person is not possible at all.

What has to be true for Release 2

Choosing a person

• A user picks someone from their contacts and the product learns nothing about them
• A product never receives the contact list, a name, or an account
• Only contacts the user saved can be picked
• The user picking is the consent; the pick itself asks nothing further of them

Acting on that person

• A product names the picked person as the target of an action without knowing who
  they are
• The host resolves that reference to the real recipient as it builds the action, and
  shows the user who they are acting on before they confirm
• A reference the host cannot resolve fails the action, rather than resolving to
  somebody else

Sending an item

• The sender learns at most one receiving account, and nothing else about what the
  recipient holds
• Sending works when the recipient is offline — delivery never needs both people
  online at once
• The item appears on the recipient's shelf with no manual setup on their side

Everywhere

• Same behaviour on every host that claims support

Explicitly out of scope

• Discovering people who are not already in the user's contacts.
• A product-rendered contact list or picker. The host draws it, which is what keeps names
  and accounts on the host side.
• Writing to the user's contacts.