Possible is a wide term.
I don’t think you want to try to accomplish it in Asterisk using any SIP messaging. I could envision someone writing a custom application on the phone that utilized DPMA as a transport to send messages out Asterisk’s AMI that could be captured by some backend app you write that could then initiate a transfer of the calling party to the phone that executed the phone of the custom application (https://wiki.asterisk.org/wiki/display/DIGIUM/Custom+Phone+Applications+with+Asterisk). It doesn’t have to go through DPMA, of course, because you could just have your own backend app interface with AMI; DPMA might be a convenience.
But that seems like a lot of work. It’d be simpler to configure the phone to SUBSCRIBE to the target and then have the phone execute a *-code dial (or something) when that party is in the ringing state (https://wiki.asterisk.org/wiki/display/DIGIUM/Smart+BLF#SmartBLF-CallPickup). Otherwise, when the user of the phone presses that key, you could just do regular dials to that party.
But, that won’t get you a screen-pop on your phone. To do that, we’d want to go back to the custom app idea. You’d want to riff on this one (https://wiki.asterisk.org/wiki/display/DIGIUM/Phone+API+Demos+-+Enhanced+Caller+ID) where when the target’s phone is ringing you use DPMA (or maybe you’ve written a long-polling app that’s already connected to your web service) to message the phone to fire the app into the foregrond w/ the caller’s information.
As an alternative, you could just have calls to the Boss phone also ring through to the Secretary phone, albeit with a different ringing behavior - use the Alert Info capability of the phone to play different tones on each one. The secretary still knows who’s calling and still knows it’s not their phone that’s being dialed directly.
The contacts application that exists on the phone today won’t give you information about who the watched party is talking to - back to dialog-info+xml, which we don’t do. You could solve that with, again, a custom app that loaded on long_press, instead of the contacts info, that retrieved that information from some backend service you provide, that’s able to extract those details from Asterisk.