Expand description
C2 Layer C — the receiver’s typed, bounded acceptance contract for shipped computation.
Send computed f (Layer B) lets a peer ship a pure function — its GenExpr body,
not its data — which the receiver evaluates in a bounded sandbox. That is safe in that
the sandbox can only do total integer arithmetic over one argument; it is NOT safe in
that the receiver would run whatever shape arrived on whatever argument.
An AcceptanceContract closes that gap the way a web form’s validator does: the
receiver writes down exactly the interface it will run — a single integer argument
within a declared inclusive range — and every invocation is validated against it
before evaluation. A function of the wrong shape is refused at the signature check; an
argument outside the range is refused, never silently clamped. The attack surface is
precisely what the receiver wrote down, and nothing more.
The check is O(1) — two integer comparisons over a value the sandbox already bounds — so the safety costs essentially nothing on the hot path.
Structs§
- Acceptance
Contract - A receiver-declared acceptance contract: a single integer parameter accepted only within
[lo, hi](inclusive), returning an integer. The bound is what the receiver promises to honor; anything outside is refused at the seam.