Agoric opaque box
From Erights
The concept is introduced in Agoric Open Systems: Agoric Systems in the Large - Section 6.1.2 Hardware Encapsulation
It is criticised in Against opaque boxes
Reasoning of that post was rebutted on #erights on irc.freenode.org .
The rebuttal was somewhat like this:
The boxes need not to trust each other. Only the developers need to trust an brand of an opaque box. Therefore what trust between two brands of opaque boxes is inhertenly based on the trust of the developer that programmed an system that could span them for the brands in these brands.