The annalist was the first membrane that I built. The idea had been developing for a while and it was the first implementation that I am aware of. Here is the manual section we wrote in 1988 to describe how to use it in Keykos.

There is a set of ideas on how to separate some system that is assembled of capabilities between two or more machines without shared RAM or even disk. These ideas are not simple but you may be familiar with them. Imagine wire between two machines and wire connecting those two machines and a set of objects distributed between those machines but unaware of the split. Now imagine that both ends of the wire go to the same machine but that each end is connected to distinct sets of objects and that there no caps in one set to the other set. Now optimize by removing the wire and keeping the signals designed for the wire internal. Now you have a membrane between the two sets with no caps between but with an internal illusion of interoperation by capabilities.

For a glimpse of how this works there is between the sets the membrane M proper. For each program P in X that thinks it has a cap to C which is in set Y, there is a object C' produced and remembered by M that behaves enough like C to fool P. P really holds a cap to C'. When P sends a message to C' the message ends up with the “man in the middle” which is M. The data portion of the message is delivered to C but any capabilities in the message are transformed as follows:

In short M, the man in the middle, stays in the middle. If it should be necessary to sever the relationship, M and the fakes it has created is deleted and both X and Y see many stub end caps that have vanished. Going back to the wire analogy it is as if we had broken the wire.