The 'objectId' field is now deprecated. Long-term, each vat will export no more than one "bootstrap interface" which can be obtained via 'Bootstrap'. Restoring SturdyRefs will be accomplished through higher-level interfaces specific to the VatNetwork in use.

See comments for 'Bootstrap' in rpc.capnp for more discussion.

This only happened if the Finish message indicating cancellation and the Return message happened to cross paths. If the Finish arrived before the Return was sent, then the server would send an empty response. If the Return was received before the Finish was sent, the client would properly record caps in the response. But if they crossed paths, the server would send back a full response with caps, but the client would never bother to inspect that response, thus leaking the caps. Fix is to set the flag to release all returned caps in the Finish message when cancelling.

Fix obscure bug where the last outgoing message (and any capabilities therein) would not get released (until a new message was sent, replacing it as the last).

This took hours to track down, because it initially looked like "Release" messages weren't being honored in some cases (when they happened to be releasing a capability from the last message, and no subsequent messages were sent). Initial attempts to capture this in a unit test failed because the test of course used a subsequent call to detect if the capability had been released, which succeeded.

Bug 1
-----

If a Resolve message indicated that the promise had been rejected, the code would see the error cap as a local cap and erroneously believe that the promise had resolved back to a local capability, thereby requiring a Disembargo to be sent. The peer, on receiving the nonsensical Disembargo, would throw an exception and close the connection.

The error message seen was: "expected target->getBrand() == this; 'Disembargo' of type 'senderLoopback' sent to an object that does not point back to the sender."

Bug 2
-----

Disembargos are sent not only in response to Resolves, but also Returns, since capabilities in a returned message were previously accessible as PromisedAnswers. This means that we must apply the same rule that states that once a promise has been resolved, the promise must from then on forward all messages it receives strictly to the object to which it resolved, even if that object is itself a promise which later resolves to somewhere else. The code which sends Resolve messages was doing this correctly, but the code sending Return messages was not. They now both operate correctly. I've also added more explanation to the documentation in rpc.capnp.

The error message seen was: "expected redirect == nullptr; 'Disembargo' of type 'senderLoopback' sent to an object that does not appear to have been the object of a previous 'Resolve' message."

For portions currently copyright by Kenton (most of it), transfer copyright to Sandstorm Development Group, Inc. (Kenton's company).

The license change is practically meaningless, as MIT and BSD 2-clause are legally equivalent. However, the BSD 2-clause license is sometimes confused for its ugly siblings, BSD 3-clause and BSD 4-clause. The MIT license is more immediately recognizeable for what it is.

Rémy Blank and Jason Choy (the two non-trivial contributors) are on record as approving this change:

https://groups.google.com/d/msg/capnproto/xXDd2HUOCcc/gbe_COIuXKYJ

Eliminate the concept of imbuing messages in favor of the simpler concept of setting a cap table directly on MessageReader / getting one from MessageBuilder.  This eliminates capability-context entirely.  This was made possible by the earlier change which moved capabilities to a separate table rather than storing CapDescriptors inline, but I didn't realize it at the time.

Define additional type aliases AnswerId and ImportId.  In the RPC protocol, always use the type corresponding to the sender's point of view.  In the implementation, always use the type corresponding to the local point of view.

Change capability pointers to be indexes into a separate cap list so that CapDescriptors can be interpreted on receipt rather than delaying until the application actually traverses the message.  This massively simplifies a lot of things.

Make all Promise methods consistently consume the promise (returning a new promise when it makes sense), rename daemonize -> detach, and make eagerlyEvaluate() require an error handler (this caught several places where I forgot to use one).

Overhaul the way EventLoop is specialized so that it's possible to hook up to an existing event loop infrastructure that is not KJ-aware.  This also makes the async IO API more dependency-injection-friendly.

Revamp concurrency model, part 1:  EventLoop no longer allows cross-thread event queuing, simplifying many things.  Capability clients are no longer thread-safe, so they don't have to be so const.  In the future, explicit ways to communicate between threads will be re-added, but threads will be treated more like separate vats that just happen to have a particularly fat pipe.  Upcoming:  Remove mutexes.

Implement opt-in cancellation for local calls.  (Previously, cancellation would happen whether or not the callee had opted in.)

Tail calls half-implemented, but I think it's time to delete all the cancellation code before continuing because it will simplify things.

In RPC protocol, rename request -> params, answer -> results.  Also fix up Join stuff in rpc-twoparty.capnp, because it was sort of wrong.

Spin off libraries kj-async and capnp-rpc, so that people who don't want them can avoid their large footprint.

Implement two-party network.  The first RPC call over a socket took place at 2013-11-08 14:46:43 -0800 and completed successfully.