iamdoubz
692dd59552
Spec 11 §4: contacts.provider and contacts.contrack (local address only, company token write-only), each person's own token (users.contrack_token_enc, migration 0010) in My settings, books read from Contrack with a 5-minute cache, Add to contacts and accepted shares created in Contrack, the company account on desk phones. Setup wizard step 8 Contacts. deploy/contrack (2.0.2, pinned), Caddy/nginx blocks, decision 0003, admin guide Contacts. Tested against a fake and a real Contrack 2.0.2 (contrack-live.test.ts).
1.2 KiB
0003 — Contrack for "Robust" contacts
Owner, 2026-10-23: contacts come in two kinds (spec 11), and the robust one is
Contrack, a self-hosted contact and relationship manager.
It already does what a phonebook would take years to grow into: notes, timelines, reminders,
relationship tracking, duplicate merging, search, imports from Google, Apple and LinkedIn, and
CardDAV sync. It's allowed because it is open source (AGPL-3.0-only) and runs as its own
program (deploy/contrack/compose.yml, image pinned to 2.0.2) that SelfPhoneNG talks to over
HTTP on 127.0.0.1: none of its code is in our dependency tree, and there is no license mixing.
The risk is a young project with one maintainer: we use seven of its routes (/healthz,
/api/contacts list and create, and in C5 the timeline routes), pin the version, and
apps/api/test/contrack.test.ts keeps a fake of exactly those routes, and
apps/api/test/contrack-live.test.ts runs the same flows against a real Contrack
(CONTRACK_LIVE_URL, a fresh container; passed against 2.0.2 on 2026-10-23). A new Contrack
version is a deliberate update: read its CHANGELOG, run the live test against it, bump the tag.