This is material that has been said better elsewhere but I am not ready to junk it.

We suppose that each site terminates one end of each of several links and each link connects two sites. The authority to communicate on these link ends is held by an ordinary program trusted not to invoke the capabilities communicated over the link. We will follow CORBA and call such programs brokers. Consider two sites A and B with a link between them. Capabilities in A to objects in B are, upon closer examination, actually capabilities to objects that obey broker code. We call such objects adaptors. Upon invocation such code sends a signal to the peer broker in B describing the invocation. The object in B is identified in the message by an index into a table in the broker at B that is maintained cooperatively by the two brokers. When object references occur in the message they may refer to objects in either A or B. References to objects in A may or may not already have been transmitted to B. The brokers will have an agreed table index to refer to references in B to objects in A and such an index serves to identify the capability. If the capability has not yet be transmitted to B then a new index value is chosen by the A broker and the B broker, upon receipt, creates a new adaptor and delivers a capability to that adaptor in place of the original capability to the object in A. For each link end the broker maintains an in-table and an out-table. The in-table holds real capabilities to local objects to which these capabilities have been exported. The in-table is used to translate incoming messages from the link to a local message holding the local capabilities, and thence delivered to the local recipient. When a message arrives with a capability to an object at the far end, two cases arise,

In the first case we create a proxy for the remote object that will accept local messages on its behalf, obey broker code to code and transmit the message. This reduces the second case to the first case.

When a local recipient invokes a remote object it obliviously invokes a local agent for the remote object that obeys trusted communications code that examines the capabilities within the message and with the use of the out-table constructs a message that can be interpreted by the remote broker. The remote broker will build and deliver a message to the intended recipient. Neither the sender nor receiver need know that the invocation was remote, except perhaps, for the time involved.