Splitting read and write capabilities

[abrgr]

Do you see value in separating the ability to access a promise's value from the ability to set its value? This would essentially be adding a capability-based model with independent read and write capabilities.

createPromise could return a promiseID and a resolutionToken. Mutations could then be keyed off of the resolution token and getPromise could be keyed off of the ID.

This certainly adds some complexity to clients but it removes any worry associated with passing around promise IDs - no rouge subsystem (implemented by another team, etc) could interfere with an ongoing operation it was only intended to be able to observe.