System Capybara: Tracking Capabilities for Separation and Freshness (Extended Version)

2026-07-10

AI Summary

This work addresses the challenge of enabling fine-grained alias control in high-level, widely shared languages like Scala while preserving their expressive abstractions. The paper introduces System Capybara, which extends Scala’s existing capture-checking mechanism with a substructural type system that tracks separation, consumption, freshness, and read-only access to capabilities. This approach enables selective alias control without relying on global invariants. The key contributions include the first support in Scala for local ownership reasoning and higher-order separation logic, guaranteeing data-race freedom, memory safety (eliminating use-after-free and double-free errors), and read-only immutability. Technically, the system employs a type translation featuring capture polymorphism and freshness quantifiers, constraint-indexed modal types, and a core calculus named CoreCapybara, whose semantics are formally verified in Lean 4.

Abstract

Substructural type systems give strong static control over aliasing. Examples include uniqueness, separation, and borrowing. How can such control be brought to established languages whose programming models rely on higher-order abstraction, unrestricted aliasing, and pervasive sharing? We study this problem in the context of Scala. We show how to retrofit these guarantees selectively instead of globally: ordinary code keeps Scala's usual aliasing discipline, while stronger guarantees can be enforced where they matter. Our starting point is Scala's capture checking, whose treatment of capabilities is inspired by the object-capability tradition: capabilities are ordinary values, and capture sets record, in a value's type, which capabilities the value may use. We develop System Capybara, which adds a selective alias-control layer to this mechanism. By tracking separation, consumption, freshness, and read-only access for capabilities, Capybara recovers key reasoning principles from substructural and ownership-based disciplines without global invariants. We give a type-preserving translation from the surface calculus Capybara to CoreCapybara, a core calculus extending System Capless, the earlier foundation for capture checking. The translation uses quantifiers for capture polymorphism and freshness, and constraint-indexed modal types for separation. We prove a semantic soundness result for the core calculus in Lean 4 and derive type safety, memory safety (no use-after-free or double-free), immutability of read-only computations, and data-race freedom for well-typed programs. Finally, we implement Scala 3's new separation checker, which brings higher-order separation reasoning about effects, capabilities, and resources to ordinary Scala, including fearless concurrency.

Problem

• substructural type systems
• aliasing control
• Scala
• capabilities
• ownership

Innovation

• substructural types
• capability-based security
• selective alias control
• separation logic
• capture checking