cap_spawn_renderer.sg closes the Four Pillars browser security gate: every renderer process is spawned with exactly two kernel capabilities — CAP_REND_FB (tab-scoped framebuffer tile) and CAP_REND_IPC (browser-ring IPC channel). No Cap<FS>, no Cap<NetConn>, no Cap<Admin> ever granted. The audit gate (cap_rend_isolated()) verifies CAPS == 3 (FB|IPC only). QEMU-verified. CSR spawn=1 iso=1 kil=1 K.
Design and audit model
cap_spawn_renderer(tab_id)
cap_spawn_renderer(tab_id) is the only kernel path by which a browser renderer process can be created. It allocates a slot in the 8-entry renderer process table, assigns a pid to the slot, and installs exactly two capabilities:
CAP_REND_FB(bit 0): framebuffer tile capability — scoped to this tab's screen region only. The renderer can write pixels to its tile but cannot access any other framebuffer region or any other tab's pixels.CAP_REND_IPC(bit 1): IPC browser-ring channel — allows the renderer to communicate with the browser process over a capability-gated ring. This is the only communication path.
Cap<FS> is not granted (the renderer cannot read or write files), Cap<NetConn> is not granted (the renderer cannot open network connections directly — all network I/O goes through the browser process via IPC), and Cap<Admin> is not granted (the renderer cannot call privileged kernel services). This enforces the sigilOS principle: authority is always explicit and minimal. Returns Cap<RendererIPC> to the calling browser process.
cap_rend_isolated(slot) + cap_renderer_crash(slot)
cap_rend_isolated(slot): the audit gate — returns 1 iff CAPS == 3 (exactly FB|IPC, nothing more). This can be called by the browser process or any kernel inspector at any time to verify a renderer has not had additional capabilities granted. If a capability escalation ever occurred, CAPS would be non-3, and the gate would return 0 — triggering a policy violation response.
cap_kill_renderer(slot): normal termination — frees the slot and zeroes CAPS, pid, and STATUS. The slot is returned to the pool.
cap_renderer_crash(slot): abnormal termination (crash) — zeroes CAPS (capability isolation is preserved even in crash) and pid, but marks STATUS=crashed while keeping VALID=1. The VALID=1 on crash is the key design: it allows the browser process to detect that a specific tab's renderer crashed (by slot index) and respawn a new renderer into the same slot index, restoring the tab without losing the tab's identity. This is the proc_super-for-browser equivalent — crash detect + respawn, but capability-enforced at the kernel boundary.
The renderer spawn gate is a direct expression of sigilOS's capability security model applied to the browser: the kernel never grants more authority than the minimal set needed, and the audit gate makes that invariant machine-checkable at any time. CAPS == 3 is the proof.