That's a lot to consider, thanks!
Ideally, I want something already baked as an OS, but if that isn't an option, then here's my backup plan.
I want a system that could let you build a sandbox that consists of an emulator, and a pipe to the rest of the world that only speaks capabilities. This would allow you to run arbitrary code without risking the emulator by handling actual system calls.
At its core, a capability is a token, which should be both authorization and address for some resource, there shouldn't be any other thing required. That is very much at odds with a channel subject to snooping.
The thing is, if you have access to a single file, to keep it simple... it should be easy to write a filter that takes that access, and creates a new access that the filter then handles, to make the channel write only, or read only, a DBMS, etc.
If you can run that filter on the same machine, or somewhere across the internet, no data should go around the filter. It should be possible for the filter to hide any URLS, etc. of the source capability.
I'm sure those types of issues come up eventually even internally to programs, as you eventually implement the proverbial half a Lisp.
If you support libraries, or units... how does a capability get passed between them?
Like I said, lots to consider, thanks!