0.7.0 · BROWSER

sigilOS Browser

A capability-native browser — where every tab is isolated by construction, not by policy.

Section 1: The security model — tab isolation by construction

The sigilOS browser's security model is not policy. A compromised renderer process in Chrome can still read process memory, open files, or use any capability the process inherited. In sigilOS, rend_spawn(tab_id) grants exactly one capability: CAP_IPC. All other capabilities are cleared at spawn. The renderer cannot:

[fs] filesystem access

NOT HELD — cleared at spawn; all file I/O routes through Browser process via IPC

[net] network

NOT HELD in renderer — all net I/O routes through Net process, process 3, via IPC_T_NET_REQ/RESP

[display] direct display write

NOT HELD — paint goes to GPU process, process 2, via IPC_T_PAINT_LAYER

[exec] process spawn

NOT HELD — only Browser process 0 can spawn

[CAP_IPC] IPC channel

HELD — the only permitted channel: to send messages, receive responses, nothing else

When a renderer crashes, rend_crash() strips even CAP_IPC. The renderer exits with zero capabilities.

Section 2: The 4-process architecture

Multi-process architecture with capability-separated roles:

Process	ID	Capabilities	Role
Browser	0	`CAP_IPC + CAP_DISPLAY + CAP_FS + CAP_EXEC`	Chrome UI, tab management, session orchestration
Renderer	1 + tab_id	`CAP_IPC only`	HTML/CSS parse, JS execute, paint layer output
GPU	2	`CAP_IPC + CAP_DISPLAY`	Compositor, frame buffer, VESA/GPU output
Net	3	`CAP_IPC + CAP_NET + CAP_TLS`	TLS/HTTP stack, SRDX transport, net broker

The IPC ring (BIPC_MAGIC = 0x49504300, 16 slots × 64 B) is the only channel between processes. 8 message types cover the full navigation-paint-input-network cycle.

Section 3: Unified session model — tabs and SRDX are the same thing

One of the unconventional design choices: a browser tab and an SRDX remote-desktop session are the same object at the session layer. Both are BrowserSession { origin, mode, cap_profile, private }. https://example.com and srdx://sigil-pi:5900 are both sessions; the difference is the transport.

Benefits:

Session Manager and browser share one list — no "browser window" vs "remote desktop client"
@web @recent Smart Folder shows both web pages and SRDX sessions
Same cap inspector UX for both: you see exactly what the SRDX session is allowed vs what the web session is allowed
Same private-mode structural isolation applies to remote sessions

Section 4: Private mode — structural, not theatrical

Property	sigilOS private	Chrome Incognito
Isolation mechanism	Separate EL0 context	Same process, cleared storage on close
History on close	Synchronous kernel-level zero	Browser-level clear (not kernel-verified)
Persistence caps	Removed at context level	Still present, browser policy prevents use
Net caps	HELD (honest: traffic visible to network)	HELD (stated: "Incognito doesn't hide from network")
Visual marker	`[private]` badge in address bar	Dark theme + incognito icon
Cap inspector	Shows NOT HELD for `[fs:rw]` and `[fs:history]`	No equivalent

Section 5: Smart Folder + browser history = one search space

Browser history, bookmarks, local files, and SRDX session history are all tagged items in the same FS substrate. One Smart Folder query surfaces all of them:

@web @recent              → recent web pages
@web @domain:github.com   → all github.com visits
@bookmark @work           → bookmarks tagged @work
@srdx @recent             → recent remote sessions
@recent                   → files + web + SRDX sessions unified

Bookmarks = fs_tag(item, "bookmark"). No separate bookmark storage, no export/import — they are FS items.

Section 6: Extension zone — honest trust, not hidden trust

Extensions in sigilOS run in the [unprotected zone] — a distinct EL0 context with a wider cap profile than normal apps. The extension manager always shows the zone trust badge (no option to hide it). Before any extension code runs, the cap grant sheet presents every permission requested — same UX as apps/authority/authority.sg. The Director's framing: "sigilOS shows: 'This extension runs in the extension zone — it has broader system access than normal apps. Install only extensions you trust.' That's the honest version of what Chrome does silently."

Section 7: The Four Pillars angle

The sigilOS browser is not an accommodation — it's what happens when the Four Pillars are applied to the browser problem directly.

Pillar	What it means for the browser
⚡ FAST	GPU-first compositor (COMP-PASS: 8 layers, dirty-rect delta, `comp_composite()` skips unchanged layers). Canvas 2D GPU path (`gpu_submit`, silicon-pending). SRDX tab transport sends only changed tiles — bandwidth scales with content delta, not frame size. SRDXBENCH: fps≈162@100Mbit on a 77 KB frame.
🪶 EFFICIENT	Pi 3 / 1 GB floor works: `cpuaccel.sg` software fallback chain (AVX2→SSE2→NEON→scalar) means compositor and Canvas 2D degrade gracefully. Renderer processes spawn with only `CAP_IPC` — no fat runtime. Closed tab = process killed, kernel heap-zeroed. No persistent worker bloat.
🔒 SECURE	`rend_spawn(tab_id)` clears all capabilities except `CAP_IPC`. The renderer cannot read files, open sockets, or write to the display — structurally, not by policy. Private mode: kernel synchronously heap-zeros the EL0 region on tab close; no speculative retention. Extension zone: user always sees the `[unprotected zone]` trust badge before install. `xport_uptr_ok`/`xport_outbuf_ok` bounds-check every EL0→EL1 SRDX frame (SRDX-xport PASS SRT bnd=1).
🪨 STABLE	Per-tab EL0 isolation: one crashed renderer cannot affect other tabs or the browser chrome. The compositor (GPU process=2, `CAP_DISPLAY`) is the only process that can write to the display — a compromised renderer has no path to the screen. Net process=3 is the only process that can open sockets — a compromised renderer has no network path. Fault boundaries are process boundaries.

Section 8: Status and roadmap

Component	Status
`browser_ipc.sg` — 16-slot IPC ring	PASS (ceedcb6)
`renderer_spawn.sg` — cap-isolated renderer	PASS (ceedcb6)
`ext_zone.sg` — extension zone (16 slots, V2/V3 caps)	PASS (ae38f9a)
`BROWSER_RFC.md` — design contract	RATIFIED (5211c20)
`browser.sg` — Lumen chrome shell (nav/tabs/cap-inspector/status)	LIVE (2a08813)
`compositor.sg` — 8-layer GPU-first compositor	COMP-PASS (16997fc)
`canvas2d.sg` — fillRect/clearRect/drawImage	CANVAS2D-PASS (a02b6c7)
`ext_manager.sg` — honest extension UX ([unprotected zone] banner, cap grant sheet, Revoke/Remove)	LIVE (f6ef9a4)
`sessions.sg` — srdx_negotiate_* wired, SRDX ACTIVE badge, Discovery, Negotiated	LIVE (f6ef9a4)
SRDX tab IPC wiring (renderer↔browser↔GPU)	Pending — RFC §9 open Qs
Smart Folder history (`@web` tagging)	Pending
cc0/JS runtime (Kernel)	In progress — 0.7.0