A Passable is PureData when its entire data structure is free of PassableCaps
(remotables and promises) and error objects.
PureData is an arbitrary composition of Atoms into CopyArray,
CopyRecord, and/or CopyTagged containers
(or a single Atom with no container), and is fully pass-by-copy.
This restriction assures absence of side effects and interleaving risks
given that none of the containers can be a Proxy instance.
TODO SECURITY BUG we plan to enforce this, giving PureData the same security
properties as the proposed
Records and Tuples.
(TODO update to point at the non-trapping shim)
Given this (currently counter-factual) assumption, a PureData value cannot
be used as a communications channel,
and can therefore be safely shared with subgraphs that should not be able
to communicate with each other.
Without that assumption, such a guarantee requires a marshal-unmarshal round
trip (as exists between vats) to produce data structures disconnected from
any potential proxies.
A Passable is PureData when its entire data structure is free of PassableCaps (remotables and promises) and error objects. PureData is an arbitrary composition of Atoms into CopyArray, CopyRecord, and/or CopyTagged containers (or a single Atom with no container), and is fully pass-by-copy.
This restriction assures absence of side effects and interleaving risks given that none of the containers can be a Proxy instance. TODO SECURITY BUG we plan to enforce this, giving PureData the same security properties as the proposed Records and Tuples. (TODO update to point at the non-trapping shim)
Given this (currently counter-factual) assumption, a PureData value cannot be used as a communications channel, and can therefore be safely shared with subgraphs that should not be able to communicate with each other. Without that assumption, such a guarantee requires a marshal-unmarshal round trip (as exists between vats) to produce data structures disconnected from any potential proxies.