0.7.0 is the web milestone, and load_page is the line that closes it: the single entry point that takes a URL all the way to a rendered page — and it now passes on real x86 hardware (LPCAP-PASS, commit 14f5053). Every stage the browser has been building for months finally runs end to end, in order, on metal.
The whole pipeline, in one call
load_page is a capstone because it doesn't add a feature — it composes the ones already built into one verified path:
URL
→ net IPC ring (fetch the bytes, capability-gated)
→ html_tokenizer (bytes → tokens)
→ dom_builder (tokens → DOM tree)
→ style_resolver (match rules → computed style)
→ css_layout (style + DOM → box tree)
→ render_engine (box tree → pixels)
→ page_present (pixels → the framebuffer)Each of those shipped and was tested on its own. The capstone proves they connect — that a real URL produces a real painted page with nothing hand-fed in between.
Fetched the sigilOS way
The fetch doesn't reach for a socket directly. It goes over a capability-gated net IPC ring — the page-loading code holds a capability to request bytes, not ambient network authority, and the network lane is a separate, auditable boundary. The same discipline that isolates every tab as its own EL0 process governs how a page gets its bytes in the first place.
The four pillars, end to end
FAST
The terminal stage, page_present, lands pixels straight on the GPU framebuffer — the same accelerated path the compositor uses.
EFFICIENT
One linear pipeline, no redundant buffering between stages — bytes flow tokens → DOM → boxes → pixels and stop.
SECURE
Bytes arrive over a cap-gated IPC ring, not ambient sockets; rendering runs in per-tab EL0 isolation. Untrusted content never holds untrusted authority.
STABLE
LPCAP-PASS on x86 metal — the full path is proven on real hardware, not just QEMU.
With load_page green on metal, the browser stops being a pile of passing unit tests and becomes a thing that loads a page. That's the milestone 0.7.0 was named for.