[e-lang] Surprising consequences of pipelining?

[Kevin Reid]

On Jul 2, 2005, at 9:36, David Hopwood wrote:
> Kevin Reid wrote:
>> Consider this code:
>>   def coerced := (def guard := thing <- __getAllegedType()) <- 
>> coerce(thing)
...
>> A short description: An unresolved promise will behave as intended by 
>> the holder of its resolver, *but not necessarily as intended by its 
>> future resolution*.
...
> A surprise could only occur:
>  - if 'guard' were audited to be functional -- but we can't know that 
> it
>    is without trusting thing's vat, so that is not an issue.
>  - if we compare the reference 'guard' to another reference locally:

This is what I meant by "resolves to an already-known guard".

> IOW, the issue you've pointed out is a consequence of pipelining + EQ, 
> not pipelining alone. I'll have to think about whether it is actually 
> a problem, and your suggested solutions.
On Jul 2, 2005, at 9:42, David Hopwood wrote:
> Correction: it is a consequence of pipelining + (either EQ or rights
> amplification). For example, it would also be surprising if 'guard'
> had a known brand.

In the absence of EQ or audit-checking (which is only intra-vat), 
rights amplification cannot detect transparent forwarders, so one 
cannot gain any information about the behavior of the pre-amplification 
object. Having both pipelining and EQ seems to be necessary to create 
this problem.

-- 
Kevin Reid                            <http://homepage.mac.com/kpreid/>