@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/__tests__/non-member-access-request.test.ts

@@ -9,6 +9,8 @@
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { sql } from "drizzle-orm";
+
 // ---------------------------------------------------------------------------
 // Test isolation: in-memory SQLite via temp directory
 // ---------------------------------------------------------------------------
@@ -94,12 +96,17 @@ function seedGatewayGuardian(
 }
 
 import {
+  createCanonicalGuardianRequest,
   listCanonicalGuardianDeliveries,
   listCanonicalGuardianRequests,
+  resolveCanonicalGuardianRequest,
 } from "../contacts/canonical-guardian-store.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
-import { notifyGuardianOfAccessRequest } from "../runtime/access-request-helper.js";
+import {
+  isAccessRequestDenied,
+  notifyGuardianOfAccessRequest,
+} from "../runtime/access-request-helper.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
@@ -304,6 +311,74 @@ describe("non-member access request notification", () => {
     expect(pending.length).toBe(1);
   });
 
+  // After the guardian denies an access request, subsequent DMs from the same
+  // sender do not re-prompt the guardian. Drives the real inbound path for both
+  // messages so the deny-dedup matches the exact assistant-scoped
+  // conversationId the notify path derives — a hand-crafted fixture could mask
+  // a mismatch.
+  test("a denied sender's subsequent DM does not re-prompt the guardian", async () => {
+    seedGatewayGuardian({
+      channelType: "telegram",
+      address: "guardian-user-789",
+      externalChatId: "guardian-chat-789",
+      principalId: anchorPrincipalId,
+    });
+    createGuardianBinding({
+      channel: "telegram",
+      guardianExternalUserId: "guardian-user-789",
+      guardianDeliveryChatId: "guardian-chat-789",
+      guardianPrincipalId: anchorPrincipalId,
+      verifiedVia: "test",
+    });
+
+    // 1) First DM from the unknown sender → guardian is prompted once.
+    await handleChannelInbound(
+      buildInboundRequest(),
+      undefined,
+      TEST_BEARER_TOKEN,
+    );
+    expect(emitSignalCalls.length).toBe(1);
+
+    const created = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "user-unknown-456",
+      sourceChannel: "telegram",
+      kind: "access_request",
+    });
+    expect(created.length).toBe(1);
+
+    // 2) Guardian denies — resolve the *real* request (same CAS transition the
+    // deny primitive performs), preserving its conversationId.
+    const denied = resolveCanonicalGuardianRequest(created[0].id, "pending", {
+      status: "denied",
+      decidedByExternalUserId: "guardian-user-789",
+    });
+    expect(denied?.status).toBe("denied");
+
+    // 3) Same sender DMs again → still denied, but NO new guardian prompt.
+    const resp2 = await handleChannelInbound(
+      buildInboundRequest({
+        externalMessageId: `msg-after-deny-${Date.now()}`,
+      }),
+      undefined,
+      TEST_BEARER_TOKEN,
+    );
+    const json2 = (await resp2.json()) as Record<string, unknown>;
+    expect(json2.denied).toBe(true);
+
+    // No additional access-request signal was emitted (still just the first).
+    expect(emitSignalCalls.length).toBe(1);
+
+    // And no fresh pending request was created for the denied sender.
+    const pendingAfter = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "user-unknown-456",
+      sourceChannel: "telegram",
+      kind: "access_request",
+    });
+    expect(pendingAfter.length).toBe(0);
+  });
+
   test("access request is created with self-healed principal even without same-channel guardian binding", async () => {
     // No guardian binding on any channel — self-heal creates a vellum binding
     // so the access_request (now decisionable) has a guardianPrincipalId.
@@ -749,7 +824,9 @@ describe("access-request-helper unit tests", () => {
     });
 
     expect(result.notified).toBe(true);
-    if (!result.notified) return;
+    if (!result.notified) {
+      return;
+    }
 
     await flushAsyncAccessRequestBookkeeping();
 
@@ -810,7 +887,9 @@ describe("access-request-helper unit tests", () => {
     });
 
     expect(result.notified).toBe(true);
-    if (!result.notified) return;
+    if (!result.notified) {
+      return;
+    }
 
     await flushAsyncAccessRequestBookkeeping();
 
@@ -826,4 +905,271 @@ describe("access-request-helper unit tests", () => {
     expect(telegram!.destinationChatId).toBe("guardian-chat-456");
     expect(telegram!.status).toBe("sent");
   });
+
+  test("notifyGuardianOfAccessRequest is suppressed after a prior deny for the same sender", async () => {
+    // Simulate a previously-denied access request for this sender on this
+    // channel/assistant. The conversationId must match the assistant-scoped
+    // key the helper derives: access-req-<assistantId>-<channel>-<actor>.
+    createCanonicalGuardianRequest({
+      id: `denied-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-denied-user",
+      requesterExternalUserId: "denied-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "denied",
+    });
+
+    const result = await notifyGuardianOfAccessRequest({
+      canonicalAssistantId: "self",
+      sourceChannel: "telegram",
+      conversationExternalId: "chat-denied",
+      actorExternalId: "denied-user",
+      actorDisplayName: "Denied User",
+    });
+
+    // Suppressed: no new prompt, no signal, no new pending request.
+    expect(result.notified).toBe(false);
+    if (!result.notified) {
+      expect(result.reason).toBe("already_denied");
+    }
+    expect(emitSignalCalls.length).toBe(0);
+
+    const pending = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "denied-user",
+      kind: "access_request",
+    });
+    expect(pending.length).toBe(0);
+  });
+
+  // LUM-2673: inside the post-approval verification window, inbound from the
+  // sender must not create a new request or re-notify the guardian — the
+  // handshake is waiting on the sender to enter their code.
+  test("suppressed while the approval's verification window is open", async () => {
+    createCanonicalGuardianRequest({
+      id: `approved-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-approved-user",
+      requesterExternalUserId: "approved-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "approved",
+    });
+
+    const result = await notifyGuardianOfAccessRequest({
+      canonicalAssistantId: "self",
+      sourceChannel: "telegram",
+      conversationExternalId: "chat-approved",
+      actorExternalId: "approved-user",
+      actorDisplayName: "Approved User",
+    });
+
+    expect(result.notified).toBe(false);
+    if (!result.notified) {
+      expect(result.reason).toBe("approval_pending_verification");
+    }
+    expect(emitSignalCalls.length).toBe(0);
+
+    const pending = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "approved-user",
+      kind: "access_request",
+    });
+    expect(pending.length).toBe(0);
+  });
+
+  test("re-prompts once the approval's verification window has lapsed", async () => {
+    const requestId = `approved-stale-${Date.now()}`;
+    createCanonicalGuardianRequest({
+      id: requestId,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-stale-user",
+      requesterExternalUserId: "stale-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "approved",
+    });
+    // Age the approval decision past the verification-code TTL: the code can
+    // no longer be redeemed, so the sender's next message legitimately
+    // re-prompts the guardian.
+    const staleUpdatedAt = Date.now() - 11 * 60 * 1000;
+    getDb().run(
+      sql`UPDATE canonical_guardian_requests SET updated_at = ${staleUpdatedAt} WHERE id = ${requestId}`,
+    );
+
+    const result = await notifyGuardianOfAccessRequest({
+      canonicalAssistantId: "self",
+      sourceChannel: "telegram",
+      conversationExternalId: "chat-stale",
+      actorExternalId: "stale-user",
+      actorDisplayName: "Stale User",
+    });
+
+    expect(result.notified).toBe(true);
+    expect(emitSignalCalls.length).toBe(1);
+
+    const pending = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "stale-user",
+      kind: "access_request",
+    });
+    expect(pending.length).toBe(1);
+  });
+
+  test("a terminal deny wins over an in-window approval for the same sender", async () => {
+    createCanonicalGuardianRequest({
+      id: `approved-then-denied-a-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-flip-user",
+      requesterExternalUserId: "flip-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "approved",
+    });
+    createCanonicalGuardianRequest({
+      id: `approved-then-denied-d-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-flip-user",
+      requesterExternalUserId: "flip-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "denied",
+    });
+
+    const result = await notifyGuardianOfAccessRequest({
+      canonicalAssistantId: "self",
+      sourceChannel: "telegram",
+      conversationExternalId: "chat-flip",
+      actorExternalId: "flip-user",
+      actorDisplayName: "Flip User",
+    });
+
+    expect(result.notified).toBe(false);
+    if (!result.notified) {
+      expect(result.reason).toBe("already_denied");
+    }
+    expect(emitSignalCalls.length).toBe(0);
+  });
+
+  test("a prior deny for one sender does not suppress prompts for a different sender", async () => {
+    createCanonicalGuardianRequest({
+      id: `denied-other-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-denied-user",
+      requesterExternalUserId: "denied-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "denied",
+    });
+
+    // A different sender still gets a fresh prompt.
+    const result = await notifyGuardianOfAccessRequest({
+      canonicalAssistantId: "self",
+      sourceChannel: "telegram",
+      conversationExternalId: "chat-fresh",
+      actorExternalId: "fresh-user",
+      actorDisplayName: "Fresh User",
+    });
+
+    expect(result.notified).toBe(true);
+    expect(emitSignalCalls.length).toBe(1);
+
+    const pending = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "fresh-user",
+      kind: "access_request",
+    });
+    expect(pending.length).toBe(1);
+  });
+
+  test("a denied request on a different channel does not suppress a new channel's prompt", async () => {
+    // Denied on telegram; the same actor id messaging on slack is a distinct
+    // (channel-scoped) context and still surfaces to the guardian.
+    createCanonicalGuardianRequest({
+      id: `denied-tg-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-cross-user",
+      requesterExternalUserId: "cross-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "denied",
+    });
+
+    const result = await notifyGuardianOfAccessRequest({
+      canonicalAssistantId: "self",
+      sourceChannel: "slack",
+      conversationExternalId: "C-cross",
+      actorExternalId: "cross-user",
+      actorDisplayName: "Cross User",
+    });
+
+    expect(result.notified).toBe(true);
+    const pending = listCanonicalGuardianRequests({
+      status: "pending",
+      requesterExternalUserId: "cross-user",
+      sourceChannel: "slack",
+      kind: "access_request",
+    });
+    expect(pending.length).toBe(1);
+  });
+
+  test("isAccessRequestDenied is true only for the denied (assistant, channel, sender)", () => {
+    const key = {
+      canonicalAssistantId: "self",
+      sourceChannel: "telegram",
+      actorExternalId: "denied-user",
+    };
+    expect(isAccessRequestDenied(key)).toBe(false);
+
+    createCanonicalGuardianRequest({
+      id: `denied-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-denied-user",
+      requesterExternalUserId: "denied-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "denied",
+    });
+
+    expect(isAccessRequestDenied(key)).toBe(true);
+    // Scoped: a different channel or sender is not treated as denied.
+    expect(isAccessRequestDenied({ ...key, sourceChannel: "slack" })).toBe(
+      false,
+    );
+    expect(isAccessRequestDenied({ ...key, actorExternalId: "other" })).toBe(
+      false,
+    );
+    // A still-pending request is not a terminal deny.
+    createCanonicalGuardianRequest({
+      id: `pending-${Date.now()}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "access-req-self-telegram-pending-user",
+      requesterExternalUserId: "pending-user",
+      guardianPrincipalId: anchorPrincipalId,
+      toolName: "ingress_access_request",
+      status: "pending",
+    });
+    expect(
+      isAccessRequestDenied({ ...key, actorExternalId: "pending-user" }),
+    ).toBe(false);
+  });
 });

package/src/__tests__/notification-decision-fallback.test.ts

@@ -285,6 +285,100 @@ describe("notification decision fallback copy", () => {
     expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 reject"');
     expect(decision.renderedCopy.vellum?.body).not.toContain("<your answer>");
   });
+
+  test("slack approval copy is stripped of request-code instructions instead of enforced", async () => {
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-grant-slack-1",
+        questionText: "Approve tool: bash — ls /tmp (requested by Alice)",
+        requestCode: "A1B2C3",
+        requestKind: "tool_grant_request",
+        toolName: "bash",
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "vellum",
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(true);
+    // Vellum keeps the code-reply directive.
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 approve"');
+    // Slack renders Approve/Reject buttons — no code anywhere in its copy.
+    expect(decision.renderedCopy.slack?.body).toBe(
+      "Approve tool: bash — ls /tmp (requested by Alice)",
+    );
+    expect(decision.renderedCopy.slack?.body).not.toContain("A1B2C3");
+  });
+
+  test("slack copy strips LLM-authored approval-code phrasing for approval requests", async () => {
+    configuredProvider = {
+      sendMessage: async () => ({ content: [] }),
+    };
+    extractedToolUse = {
+      name: "record_notification_decision",
+      input: {
+        shouldNotify: true,
+        selectedChannels: ["slack"],
+        reasoningSummary: "LLM decision",
+        renderedCopy: {
+          slack: {
+            title: "Tool Grant Request",
+            body: "Alice is asking to run ls /tmp.",
+            deliveryText:
+              'Alice is asking to run ls /tmp.\nApproval code: A1B2C3\nReference code: A1B2C3. Reply "A1B2C3 approve" or "A1B2C3 reject".',
+          },
+        },
+        dedupeKey: "guardian-question-slack-llm-test",
+        confidence: 0.9,
+      },
+    };
+
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-grant-slack-2",
+        questionText: "Approve tool: bash — ls /tmp (requested by Alice)",
+        requestCode: "A1B2C3",
+        requestKind: "tool_grant_request",
+        toolName: "bash",
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(false);
+    expect(decision.renderedCopy.slack?.deliveryText).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+    expect(decision.renderedCopy.slack?.body).toBe(
+      "Alice is asking to run ls /tmp.",
+    );
+  });
+
+  test("slack answer-mode questions keep code instructions (no buttons render)", async () => {
+    const signal = makeSignal({
+      contextPayload: {
+        requestId: "req-pending-slack-1",
+        questionText: "What is the gate code?",
+        requestCode: "A1B2C3",
+        requestKind: "pending_question",
+        callSessionId: "call-1",
+        activeGuardianRequestCount: 1,
+      },
+    });
+
+    const decision = await evaluateSignal(signal, [
+      "slack",
+    ] as NotificationChannel[]);
+
+    expect(decision.fallbackUsed).toBe(true);
+    expect(decision.renderedCopy.slack?.body).toContain(
+      '"A1B2C3 <your answer>"',
+    );
+  });
 });
 
 // ── Access-request instruction enforcement ──────────────────────────────
@@ -326,9 +420,11 @@ describe("access-request instruction enforcement", () => {
     ] as NotificationChannel[]);
 
     expect(decision.fallbackUsed).toBe(true);
-    expect(decision.renderedCopy.vellum?.body).toContain("A1B2C3");
-    expect(decision.renderedCopy.vellum?.body).toContain("approve");
-    expect(decision.renderedCopy.vellum?.body).toContain("reject");
+    // Directive form, not prose mentions: the guardian must be able to reply
+    // with these exact code+verb tokens.
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 trust"');
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 reject"');
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 block"');
     expect(decision.renderedCopy.vellum?.body).toContain("open invite flow");
   });
 
@@ -359,9 +455,9 @@ describe("access-request instruction enforcement", () => {
     ] as NotificationChannel[]);
 
     expect(decision.fallbackUsed).toBe(false);
-    expect(decision.renderedCopy.vellum?.body).toContain("A1B2C3");
-    expect(decision.renderedCopy.vellum?.body).toContain("approve");
-    expect(decision.renderedCopy.vellum?.body).toContain("reject");
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 trust"');
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 reject"');
+    expect(decision.renderedCopy.vellum?.body).toContain('"A1B2C3 block"');
     expect(decision.renderedCopy.vellum?.body).toContain("open invite flow");
   });
 
@@ -397,7 +493,7 @@ describe("access-request instruction enforcement", () => {
 
   test("enforcement does not duplicate when LLM copy already has all required elements", async () => {
     const fullBody =
-      'Alice wants access.\nReply "A1B2C3 approve" to grant access or "A1B2C3 reject" to deny.\nReply "open invite flow" to start Trusted Contacts invite flow.';
+      'Alice wants access.\nReply "A1B2C3 verify" to send them a verification code, "A1B2C3 trust" to trust them without one, "A1B2C3 reject" to leave them unverified, or "A1B2C3 block" to block them.\nReply "open invite flow" to start Trusted Contacts invite flow.';
     configuredProvider = {
       sendMessage: async () => ({ content: [] }),
     };
@@ -495,7 +591,7 @@ describe("access-request instruction enforcement", () => {
     ] as NotificationChannel[]);
 
     // Must contain the proper contract instructions despite conflicting LLM copy
-    expect(decision.renderedCopy.vellum?.body).toContain("A1B2C3 approve");
+    expect(decision.renderedCopy.vellum?.body).toContain("A1B2C3 verify");
     expect(decision.renderedCopy.vellum?.body).toContain("A1B2C3 reject");
     expect(decision.renderedCopy.vellum?.body).toContain("open invite flow");
   });

package/src/__tests__/notification-decision-strategy.test.ts

@@ -278,8 +278,8 @@ describe("notification decision strategy", () => {
       const copy = composeFallbackCopy(signal, channels);
       expect(copy.vellum).toBeDefined();
       expect(copy.vellum!.body).toContain("D4E5F6");
-      expect(copy.vellum!.body).toContain("approve");
-      expect(copy.vellum!.body).toContain("reject");
+      expect(copy.vellum!.body).toContain("trust");
+      expect(copy.vellum!.body).toContain("block");
     });
 
     test("ingress.access_request template includes invite flow instruction", () => {
@@ -709,10 +709,21 @@ describe("notification decision strategy", () => {
   describe("access-request instruction detection", () => {
     test("detects complete access-request instructions with full directive patterns", () => {
       const text =
-        'Alice wants access.\nReply "A1B2C3 approve" to grant access or "A1B2C3 reject" to deny.\nReply "open invite flow" to start.';
+        'Alice wants access.\nReply "A1B2C3 verify" to send them a verification code, "A1B2C3 trust" to trust them without one, "A1B2C3 reject" to leave them unverified, or "A1B2C3 block" to block them.\nReply "open invite flow" to start.';
       expect(hasAccessRequestInstructions(text, "A1B2C3")).toBe(true);
     });
 
+    test("does not require the verify directive when the handshake is not offered", () => {
+      const text =
+        'Alice wants access.\nReply "A1B2C3 trust" to trust them, "A1B2C3 reject" to leave them unverified, or "A1B2C3 block" to block them.\nReply "open invite flow" to start.';
+      expect(hasAccessRequestInstructions(text, "A1B2C3")).toBe(false);
+      expect(
+        hasAccessRequestInstructions(text, "A1B2C3", {
+          handshakeOffered: false,
+        }),
+      ).toBe(true);
+    });
+
     test("fails when request code is missing", () => {
       const text = 'Alice wants access.\nReply "open invite flow" to start.';
       expect(hasAccessRequestInstructions(text, "A1B2C3")).toBe(false);
@@ -732,7 +743,7 @@ describe("notification decision strategy", () => {
 
     test("is case-insensitive for request code matching", () => {
       const text =
-        'Reply "a1b2c3 approve" to grant access or "a1b2c3 reject" to deny.\nReply "open invite flow" to start.';
+        'Reply "a1b2c3 verify" to send a code, "a1b2c3 trust" to trust them, "a1b2c3 reject" to leave them unverified, or "a1b2c3 block" to block them.\nReply "open invite flow" to start.';
       expect(hasAccessRequestInstructions(text, "A1B2C3")).toBe(true);
     });
 
@@ -788,7 +799,7 @@ describe("notification decision strategy", () => {
 
     test("accepts directives at the start of text (no preceding newline needed)", () => {
       const text =
-        'Reply "A1B2C3 approve" to grant or "A1B2C3 reject" to deny. Reply "open invite flow" to start.';
+        'Reply "A1B2C3 verify" to send a code, "A1B2C3 trust" to trust, "A1B2C3 reject" to leave unverified, or "A1B2C3 block" to block. Reply "open invite flow" to start.';
       expect(hasAccessRequestInstructions(text, "A1B2C3")).toBe(true);
     });
 
@@ -857,8 +868,11 @@ describe("notification decision strategy", () => {
         previousMemberStatus: "revoked",
       });
       expect(text).toContain("Alice");
-      expect(text).toContain("D4E5F6 approve");
+      // Telegram carries no workspace identity — the handshake leads.
+      expect(text).toContain("D4E5F6 verify");
+      expect(text).toContain("D4E5F6 trust");
       expect(text).toContain("D4E5F6 reject");
+      expect(text).toContain("D4E5F6 block");
       expect(text).toContain("open invite flow");
       expect(text).toContain("previously revoked");
     });
@@ -869,10 +883,45 @@ describe("notification decision strategy", () => {
         requestCode: "A1B2C3",
       });
       expect(text).not.toContain("revoked");
-      expect(text).toContain("A1B2C3 approve");
+      expect(text).toContain("A1B2C3 trust");
       expect(text).toContain("open invite flow");
     });
 
+    test("workspace-member contract omits the verify directive", () => {
+      const text = buildAccessRequestContractText({
+        senderIdentifier: "Alice",
+        requestCode: "A1B2C3",
+        sourceChannel: "slack",
+        isStranger: false,
+        isRestricted: false,
+      });
+      expect(text).not.toContain("A1B2C3 verify");
+      expect(text).toContain("A1B2C3 trust");
+      expect(text).toContain("A1B2C3 block");
+    });
+
+    test("slack contract with unknown signals keeps the verify directive (fail-safe)", () => {
+      const text = buildAccessRequestContractText({
+        senderIdentifier: "Alice",
+        requestCode: "A1B2C3",
+        sourceChannel: "slack",
+      });
+      expect(text).toContain("A1B2C3 verify");
+    });
+
+    test("bot contract never offers the code option", () => {
+      const text = buildAccessRequestContractText({
+        senderIdentifier: "Shard",
+        requestCode: "A1B2C3",
+        sourceChannel: "slack",
+        isBot: true,
+        isStranger: true,
+      });
+      expect(text).not.toContain("A1B2C3 verify");
+      expect(text).toContain("A1B2C3 trust");
+      expect(text).toContain("code verification isn't possible");
+    });
+
     test("builds contract without decision directive when no request code", () => {
       const text = buildAccessRequestContractText({
         senderIdentifier: "Charlie",
@@ -891,7 +940,7 @@ describe("notification decision strategy", () => {
       });
       expect(text).not.toContain("\n\n\n"); // no triple newlines from injected newlines
       expect(text).not.toContain("\x00");
-      expect(text).toContain("A1B2C3 approve");
+      expect(text).toContain("A1B2C3 verify");
       expect(text).toContain("open invite flow");
     });
   });