a Book my oil change Thursday ~1 PM
Discover → mandate → availability → hold → human OK → confirm, with a signed receipt.
b Two agents race for the same barber slot
Both see the slot open; both send POST /holds at once. One wins; the other gets 409 + alternatives (iTIP COUNTER).
c Hold and walk away
Watch the hold count down on the dashboard, expire, fire a hold.expired webhook, and free the slot.
d Price above the mandate's limit
The host checks the signed mandate on every action: the hold is refused with 403 MANDATE_LIMIT.
e Cancel: always free
Book, then cancel. The host signs a fresh receipt (sequence + 1) and frees the time, waitlist first. SchCP charges nothing and records nothing; any policy of the host’s own is between the guest and the host.
f Calendar host needs approval you decide
Rosie’s runs on a calendar, so the booking goes pending_host. Approve or decline it in the dashboard; the agent waits for the signed webhook.
g Spoofed endpoint
Endpoint authorization (spec §2.2): the agent refuses before sending a single signed request or mandate.
h Dentist: the patient signs the exact offer
The clinic requires a closed mandate for every offer: the open mandate is refused, an agent that shows the patient a lower price is caught by the hash, and the honest flow books with the hash in the receipt.
i A script floods the barbershop with new identities
The new-guest pool caps the flood (spec §7.2); the PhoneCheck-attested newcomer draws on a separate pool and still gets in (§7.5).
j Waitlist: a cancellation goes to the first person waiting
Both barbers are booked, so your agent joins the waitlist. When another guest cancels, the chair is offered to you as a hold (waitlist.offered) before it ever shows up in public availability.
k Book for two: a second person confirms from their own key app you decide
Sam books and names Alex as a required participant, so the booking is tentative (202) until Alex’s own agent answers with his own key app. You decide what Alex says: accept and it is confirmed, decline and it is released with a reason.
l Playdate: two parents’ agents find a time you decide
Noor’s agent reads her own calendar and Ellis’s (she is on Ellis’s contact list), finds a time both are free, holds it on both, and books it at Trinity Bellwoods. Nothing is priced and the playdate has no agreed end. Ellis’s agent asks Ellis: you answer for Ellis.
m Playdate for three families: one contract, three yeses you decide
Noor’s agent finds a time all three calendars share, holds it on each, and writes one contract naming all three people and each calendar’s signed offer. Noor approves it once. Priya’s agent says yes by a rule Priya signed; Ellis’s agent asks Ellis: you answer for Ellis, and can suggest another park instead. Nothing is confirmed anywhere until all three have said yes to the same contract hash.
n A stranger asks for a person’s time
A person’s calendar is contacts-only. Discovery is public, but availability and holds from anyone not on the list get 403 NOT_PERMITTED (not_a_contact); the list itself is never published. A contact asking the same question sees the free times.