WhatsApp door commands
OpenApp’s WhatsApp path is not the copilot LLM and not a custom parser of free-form English. A text to the OpenApp number from a user’s verified E.164 phone is that user. A closed per-locale verb list (open, unlock, פתח, and the other catalog languages) plus resolve_score picks at most one entity they may entities:set_state on.
Contract
Section titled “Contract”The shipped contract is notes/contracts/whatsapp-channel.md in the repository. Summary:
- Utility invite template only; marketing templates are never sent.
- Unique name and no
require_step_up→switchable.openas that user (Cedar, quiet hours, lockdown,door_opens). - Ambiguous names or step-up → follow-up; preview token is the existing 10-minute single-use token.
- Audit
entity.action.succeeded/deniedwithdetails.channel=whatsapp. Do not copy the utterance into audit.
Webhook
Section titled “Webhook”GET/POST /api/v1/webhooks/whatsapp is anonymous at the gateway. Trust POST only after X-Hub-Signature-256 (HMAC-SHA256 of the raw body with the app secret). Store Meta message ids and ignore replays.
What an ambiguous reply looks like
Section titled “What an ambiguous reply looks like”The member is asked to open one of the named doors. Nothing actuates until a unique command (or a step-up confirm) succeeds.