CHANGEOVER

A hyperlink and a hope

An agentic booking is four operations, not one: forming the intent, finding the screening, committing to seats, and paying. Finding is already solved by assistants; paying is contested by parties with balance sheets. What has no contract is the walk between them.

In most systems a seat hold isn’t an object at all. It is a side effect of an order, with an expiry that can move without telling anyone, so a customer handed over by an agent can arrive at a seat map that moved underneath them. The industry’s entire agentic surface currently ends in a hyperlink and a hope.

What the protocol will not do

There is no settlement verb, permanently: the protocol cannot take money, so no agent can be talked into taking it. The agent binding exposes exactly five tools. A partial unique index makes overselling a seat impossible to write rather than unlikely to happen — two hundred holds against a hundred-seat house end with nobody sitting on anybody.

Screenings are not interchangeable stock, either. A 70mm print can stand in for a digital screening; a digital screening cannot stand in for the print. The exhibitor states that rule once, and the server refuses the swap at commit with 412 substitution_refused.

Where a retry becomes a double-book

Idempotency by contract. Holding seats and handing off require an Idempotency-Key with at least 128 bits from a secure random source, scoped to the agent’s credential. A replay returns the stored response, with only its time fields re-projected from current state. The same key with a different request is 422 and nothing happens; a key already in flight is 409, and the agent must retry the same key — re-resolving is how a retry becomes a double-book.

Two clocks on a hold. A hold has a floor that never moves after grant and an expiry that can only move later, and there is no extend verb. Only the exhibitor, at its own console, can override the floor, and every override is counted. A hold’s state is worked out at every read, so a hold past its expiry can never look live, even if no cleanup job has run.

The hand-off. A hold moves live → handed_off → claimed, or ends released, expired or revoked. The claim link is single-use and prefetch-safe: opening it consumes nothing, and the first non-idempotent confirm binds it, so a mail scanner fetching the URL can’t spend the customer’s seats. Hold ids carry 160 random bits; the protocol forbids ULIDs and UUIDv7 there because they leak order.

A spec that hides its own review has published a brochure

The first commit holds the specification, its schemas, frozen fixtures and five proofs, and no implementation code — a proof checks that forever. The golden fixtures had their digests computed by a third-party library before any implementation existed. On its first run a proof failed against the spec’s own worked example, so the spec was corrected in the same commit and the failure written up.

Three adversarial reviews are recorded — concurrency (22 findings), security (21) and deployment (20) — with the six that were overruled and the reasons why.

Pass, fail, or cannot prove

A conformance harness holds any implementation to the text. Every proof exits in one of three ways: it passed, it failed, or it could not prove what it was asked to — the third is never rounded up to the first. The published report on Postgres reads ten pass, none fail, fourteen cannot prove, and re-holding released seats is measured, not asserted: p50 8.62 ms, p95 12.34 ms over twenty trials. The CLI lints, derives and conforms; its demo runs seven reels, four of them refused on purpose with typed codes.

Read the specification

The specification, the decision records, the schemas and the reference implementation are open. Thirty of the forty proof scripts run anywhere; the ten concurrency proofs need a real multi-connection Postgres, and say so rather than passing.