Common use of Alternative Monitoring Semantics Clause in Contracts

Alternative Monitoring Semantics. p → According to the reduction rule [R15], when a session is initiated with a service a c v, the client endpoint is monitored by the contract c advertised by the service and the service endpoint is monitored by the dual contract computed by dual c. We dub this semantics, where each peer of a session has its own monitor, double-sided monitoring in contrast to single-sided monitoring where only one peer is wrapped. Having monitors on both peers assures the presence of at least one chaperone contract for each endpoint in the system. To see the reason why this is technically convenient, consider item 3 of Definition 5.2, which concerns delegations: the guarantee that there is a monitor wrapping both the message and the endpoint on which the message is sent is a direct consequence of double-sided monitoring (cf. rule [R15]) and allows us to easily refer to the contracts c and d of the involved endpoints. Without this guarantee we would have four versions of item 3, depending on whether each endpoint is monitored or not. Even worse, we would have to compute the dual contract of each lone endpoint from that wrapping its peer, which could be located anywhere in the system. With the guarantee that each endpoint is monitored, Definition 5.2 remains reasonably compact and need not refer to parts of the system other than module p. In practice, double-sided monitoring induces a useless overhead because each message exchanged through the peer endpoints of a session is checked against the same contract twice, once for each peer. This is a consequence of the fact that dual only inverts the direction of the exchanged messages without affecting their contracts (rules [R8–R14]). The overhead caused by double-sided monitoring is clearly illustrated by Example 5.3, where several values end up being wrapped by adjacent monitors having the same contract and the same labels. We can eliminate this overhead by adopting single-sided monitoring, where session initialization attaches just one monitor to the client endpoint. From an operational standpoint, this amounts to replacing rule [R15] with q q [R21] ⟨ℰ [connect a]⟩p a →c v ›→ (νb )(⟨ℰ [[b+]c,q,p ]⟩p ⟨v b-⟩q ) a →c v that leaves b- unmonitored. While it is obvious that by removing one monitor we reduce the points in the program that can generate blame, it is not entirely obvious that no new blame is introduced. The next result guarantees that this is indeed the case:

Alternative Monitoring Semantics. p → ⇐ According to the reduction rule [R15], when a session is initiated with a service a c v, the client endpoint is monitored by the contract c advertised by the service and the service endpoint is monitored by the dual contract computed by dual c. We dub this semantics, where each peer of a session has its own monitor, double-sided monitoring in contrast to single-sided monitoring where only one peer is wrapped. Having monitors on both peers assures the presence of at least one chaperone contract for each endpoint in the system. To see the reason why this is technically convenient, consider item 3 of Definition 5.26, which concerns delegations: the guarantee that there is a monitor wrapping both the message and the endpoint on which the message is sent is a direct consequence of double-sided monitoring (cf. rule [R15]) and allows us to easily refer to the contracts c and d of the involved endpoints. Without this guarantee we would have four versions of item 3, depending on whether each endpoint is monitored or not. Even worse, we would have to compute the dual contract of each lone endpoint from that wrapping its peer, which could be located anywhere in the system. With the guarantee that each endpoint is monitored, Definition 5.2 6 remains reasonably compact and need not refer to parts of the system other than module p. In practice, double-sided monitoring induces a useless overhead because each message exchanged ex- changed through the peer endpoints of a session is checked against the same contract twice, once for each peer. This is a consequence of the fact that dual only inverts the direction of the exchanged messages without affecting their contracts (rules [R8–R14]). The overhead caused by double-sided monitoring is clearly illustrated by Example 5.32, where several values end up being wrapped by adjacent monitors having the same contract and the same labels. We can eliminate this overhead by adopting single-sided monitoring, where session initialization attaches just one monitor to the client endpoint. From an operational standpoint, this amounts to replacing rule [R15] with q q [R21] ⟨ℰ ⟨E [connect a]⟩p a →c ⇐c v ›→ '→ (νb )(⟨ℰ νb)(⟨E [[b+]c,q,p ]⟩p p]⟩p ⟨v b-⟩q b-⟩q) a →c ⇐c v that leaves b- unmonitored. While it is obvious that by removing one monitor we reduce the points in the program that can generate blame, it is not entirely obvious that no new blame is introduced. The next result guarantees that this is indeed the case:

Alternative Monitoring Semantics. ‌ p → According to the reduction rule [R15], when a session is initiated with a service a c v, the client endpoint is monitored by the contract c advertised by the service and the service endpoint is monitored by the dual contract computed by dual c. We dub this semantics, where each peer of a session has its own monitor, double-sided monitoring in contrast to single-sided monitoring where only one peer is wrapped. Having monitors on both peers assures the presence of at least one chaperone contract for each endpoint in the system. To see the reason why this is technically convenient, consider item 3 of Definition 5.2, which concerns delegations: the guarantee that there is a monitor wrapping both the message and the endpoint on which the message is sent is a direct consequence of double-sided monitoring (cf. rule [R15]) and allows us to easily refer to the contracts c and d of the involved endpoints. Without this guarantee we would have four versions of item 3, depending on whether each endpoint is monitored or not. Even worse, we would have to compute the dual contract of each lone endpoint from that wrapping its peer, which could be located anywhere in the system. With the guarantee that each endpoint is monitored, Definition 5.2 remains reasonably compact and need not refer to parts of the system other than module p. In practice, double-sided monitoring induces a useless overhead because each message exchanged through the peer endpoints of a session is checked against the same contract twice, once for each peer. This is a consequence of the fact that dual only inverts the direction of the exchanged messages without affecting their contracts (rules [R8–R14]). The overhead caused by double-sided monitoring is clearly illustrated by Example 5.3, where several values end up being wrapped by adjacent monitors having the same contract and the same labels. We can eliminate this overhead by adopting single-sided monitoring, where session initialization attaches just one monitor to the client endpoint. From an operational standpoint, this amounts to replacing rule [R15] with q q [R21] ⟨ℰ [connect a]⟩p a →c v ›→ (νb )(⟨ℰ [[b+]c,q,p ]⟩p ⟨v b-⟩q ) a →c v that leaves b- unmonitored. While it is obvious that by removing one monitor we reduce the points in the program that can generate blame, it is not entirely obvious that no new blame is introduced. The next result guarantees that this is indeed the case:

Alternative Monitoring Semantics. ‌ p → ⇐ According to the reduction rule [R15], when a session is initiated with a service a c v, the client endpoint is monitored by the contract c advertised by the service and the service endpoint is monitored by the dual contract computed by dual c. We dub this semantics, where each peer of a session has its own monitor, double-sided monitoring in contrast to single-sided monitoring where only one peer is wrapped. Having monitors on both peers assures the presence of at least one chaperone contract for each endpoint in the system. To see the reason why this is technically convenient, consider item 3 of Definition 5.26, which concerns delegations: the guarantee that there is a monitor wrapping both the message and the endpoint on which the message is sent is a direct consequence of double-sided monitoring (cf. rule [R15]) and allows us to easily refer to the contracts c and d of the involved endpoints. Without this guarantee we would have four versions of item 3, depending on whether each endpoint is monitored or not. Even worse, we would have to compute the dual contract of each lone endpoint from that wrapping its peer, which could be located anywhere in the system. With the guarantee that each endpoint is monitored, Definition 5.2 6 remains reasonably compact and need not refer to parts of the system other than module p. In practice, double-sided monitoring induces a useless overhead because each message exchanged ex- changed through the peer endpoints of a session is checked against the same contract twice, once for each peer. This is a consequence of the fact that dual only inverts the direction of the exchanged messages without affecting their contracts (rules [R8–R14]). The overhead caused by double-sided monitoring is clearly illustrated by Example 5.32, where several values end up being wrapped by adjacent monitors having the same contract and the same labels. We can eliminate this overhead by adopting single-sided monitoring, where session initialization attaches just one monitor to the client endpoint. From an operational standpoint, this amounts to replacing rule [R15] with q q [R21] ⟨ℰ ⟨E [connect a]⟩p a →c ⇐c v ›→ '→ (νb )(⟨ℰ νb)(⟨E [[b+]c,q,p ]⟩p p]⟩p ⟨v b-⟩q b-⟩q) a →c ⇐c v that leaves b- unmonitored. While it is obvious that by removing one monitor we reduce the points in the program that can generate blame, it is not entirely obvious that no new blame is introduced. The next result guarantees that this is indeed the case: