  In this paper, we take a pervasively effectful (in the style of ML) typed
lambda calculus, and show how to extend it to permit capturing pure expressions
with types. Our key observation is that, just as the pure simply-typed lambda
calculus can be extended to support effects with a monadic type discipline, an
impure typed lambda calculus can be extended to support purity with a comonadic
type discipline. We establish the correctness of our type system via a simple
denotational model, which we call the capability space model. Our model
formalizes the intuition common to systems programmers that the ability to
perform effects should be controlled via access to a permission or capability,
and that a program is capability-safe if it performs no effects that it does
not have a runtime capability for. We then identify the axiomatic categorical
structure that the capability space model validates, and use these axioms to
give a categorical semantics for our comonadic type system. We then give an
equational theory (substitution and the call-by-value $\beta$ and $\eta$ laws)
for the imperative lambda calculus, and show its soundness relative to this
semantics. Finally, we give a translation of the pure simply-typed lambda
calculus into our comonadic imperative calculus, and show that any two terms
which are $\beta\eta$-equal in the STLC are equal in the equational theory of
the comonadic calculus, establishing that pure programs can be mapped in an
equation-preserving way into our imperative calculus.
