Booking via the OpenActive Open Booking API

[neldroid]

Goal

Let clients book sessions and facility slots through the OpenActive Open Booking API, instead of only linking to the provider's booking page.

Context

ORP 0.1.0 deliberately does no booking or payments (see spec/2026-09-16/overview.md §6). Many OpenActive publishers already implement Open Booking, so ORP should build on it rather than invent anything.

Open questions (needs an RFC)

• User identity and consent: what is the minimum customer data to send, and how does the user approve each booking explicitly?
• Where do credentials and payment live, given ORP's local-first rule that secrets never go into ORP documents?
• Tool design: for example booking_quote → booking_confirm, with a mandatory confirmation step in prompts.
• Privacy impact: booking necessarily shares personal data with the provider, which needs a clear exception in privacy.md.
• Test strategy against the OpenActive test suite and reference implementation.

Done when

• An accepted RFC, spec changes, a reference implementation behind an opt-in flag, and offline tests.