Chromium Parity Matrix
Our public commitment to web developers: what sigilOS Browser supports, what are known gaps, and what we intentionally omit.
Director's framing: "The benchmark is: a developer used to Chrome should feel at home. Track gaps explicitly — every web platform feature we don't yet support is a known delta, not a surprise."
Status as of sigilOS 0.7.0-dev. This matrix is a living document — it updates as the cc0 runtime and browser chrome ship.
Legend: ✅ supported (or roadmapped this sprint) · 🔲 known gap (tracked, not yet built) · 🚫 intentionally omitted (by design).
Legend: ✅ supported (or roadmapped this sprint) · 🔲 known gap (tracked, not yet built) · 🚫 intentionally omitted (by design).
1. Core Web APIs
| Feature | Status | Notes |
|---|---|---|
| HTML5 parsing (cc0 parser) | ✅ | cc0 parser in-progress, 0.7.0 sprint |
| HTML5 tokenizer | ✅ | shipped (de47df3) — html_tokenizer.sg: byte-stream state machine (INIT→TAG→NAME→ATTR→ATTRN→ATTRE→ENDNAME). StartTag/EndTag/Text/Attr/SelfClose. src_buf @0x400000, tok_buf @0x500000, 12B/token. cc0 owns this lane at 0.7.0; arm-el0 placeholder holds it now. |
Canvas 2D (<canvas>) | ✅ | CANVAS2D-PASS (a02b6c7) — canvas2d.sg: fillRect/clearRect/drawImage. GPU-first (silicon-pending), cpuaccel.sg SW floor (AVX2→SSE2→NEON→scalar). All pixel probes pass. |
| WebGL 1.0 | ✅ | WEBGL-DIRTY-PASS (5460b56) — webgl.sg: gl_ctx_create/buffer_data/shader_compile/set_color/draw_arrays. SW floor: triangle bounding-box fill_span. GPU path silicon-pending: gpu_submit(CAP_ACCEL, webgl_ctx_buf()). Unblocks web content feature-detecting WebGL. |
| CSS2.1 + CSS3 layout | ✅ | Renderer lane, 0.7.0 |
CSS transform: (translate/scale/rotate/skew) | ✅ | CSSIMG-PASS (38b3d7c) — css_transform.sg: affine 2D matrix (fixed-point ×256), 5 constructors (identity/translate/scale/rotate90/skew), css_layer_apply_xform() rewrites compositor layer geometry. GPU path silicon-pending; integer SW floor on Pi3/QEMU. |
| JavaScript ES2020+ | ✅ | cc0/JS runtime, Kernel lane, 0.7.0 |
| WebAssembly | 🔲 | Tracked — RetroPie WASM lane already in 0.7.0 for gaming; browser wasm pending |
| Service Workers | 🔲 | Requires persistent background process; cap model design TBD |
| Web Workers | 🔲 | Needs multi-renderer IPC routing; tracked |
ES modules (import/export) | ✅ | cc0/JS runtime includes module loader |
2. Networking
| Feature | Status | Notes |
|---|---|---|
| HTTP/1.1 | ✅ | NET-PASS (0ecc2f6) — http_fetch.sg: GET/POST builder, response parser (status/Content-Length/body_off/Location redirect). Transport via Cap<NetConn> sys 110/111. Browser never opens raw sockets. |
| HTTP/2 | 🔲 | Tracked — multiplexing over existing TLS stack |
| HTTP/3 / QUIC | 🔲 | Tracked — requires UDP cap; longer term |
| HTTPS / TLS 1.3 | ✅ | NET-PASS (0ecc2f6) — tls_client.sg: thin cc0 wrapper over Kernel sys 117-119. Kernel validates cert chain; sys 117 returns -1 on cert failure. No EL0 override of trust store — structural, not policy. |
| DNS resolution | ✅ | NET-PASS (0ecc2f6) — dns_client.sg: A-record lookup over sys 120. dns_format_ipv4, dns_ipv4_to_int for Cap<NetConn> connect. |
| WebSockets | 🔲 | Tracked — persistent connection model TBD |
| Fetch API | ✅ | Routes through IPC_T_NET_REQ/RESP to Net process |
| XMLHttpRequest | ✅ | Mapped to same net broker |
| CORS | ✅ | Enforced at Net process level, not renderer |
3. Storage
| Feature | Status | Notes |
|---|---|---|
| Cookies | ✅ | VFS-backed (28c42bf) — browser_storage.sg: cookie namespace /<pfx>/browser/cookie/<key>, bs_cookie_{set,get,del}, key validation, idempotent set. Scoped by VFS prefix cap (origin isolation). |
| localStorage / sessionStorage | ✅ | VFS-backed (28c42bf) — browser_storage.sg: localStorage namespace /<pfx>/browser/local/<key>, bs_local_{set,get,del}. Keys ≤63B printable ASCII, no '/' (path-traversal rejected). Values ≤4096B. ABCDEFG test passed. |
| IndexedDB | 🔲 | Tracked — requires VFS blob store ABI extension |
| Cache API (Service Worker cache) | 🔲 | Blocked on Service Workers (see above) |
| Private mode: no persistence | ✅ | Structural — fs:rw cap removed at EL0 context level |
4. Media
| Feature | Status | Notes |
|---|---|---|
| Layer compositor (GPU-first) | ✅ | COMP-PASS (16997fc) — compositor.sg: 8-layer dirty-rect compositor (0xA00000 shared region), back-to-front composite, delta gate (n_dirty=0 skips re-composite). GPU path silicon-pending; copy_span SW fallback. GPU process=2 exclusively owns CAP_DISPLAY. |
| Dirty-rect sub-frame compositor | ✅ | WEBGL-DIRTY-PASS (5460b56) — comp_dirty.sg: tile-level dirty tracking (64×64 tiles, same model as SRDX encode). comp_dirty_mark/mark_rect/composite: only push changed tiles. GPU path silicon-pending; copy_span SW floor. Pi3 repaint cost cut by skipping unchanged tiles. |
| Text rendering (bitmap glyph rasterizer) | ✅ | FONTRAST-PASS (8f6bda0) — font_raster.sg: 8×8 bitmap Latin subset (space/punct/A-Z/0-9). font_raster_char_byte/glyph/atlas/string. Pi3 floor: if-chain bitmaps, no ROM, no FS cap needed at boot. GPU path: gpu_tex_upload + SDF rasterizer silicon-pending. |
| Text layout (line-wrap, cursor advance) | ✅ | TEXTLAYOUT-PASS (6158863) — text_layout.sg: left-to-right cursor, line-wrap at max_w, forced newline. text_layout_init/put_char/put_string/flush_gpu. Quad buffer; gpu_submit batch silicon-pending. 19-char wrap + 21-quad emit verified. Browser text rendering chain complete. |
| CSS block/inline layout (box model, flow) | ✅ | LAYOUTBOX-PASS (f33524f) — layout_box.sg: CSS2 block/inline formatting context. Node descriptors (type/cw/ch/margin/padding/border), results (border-box x/y/w/h). Block auto-fill, inline line boxes with wrap. 6-node tree verified. GPU paint path silicon-pending; SW floor: canvas2d_fill_rect / comp_submit_layer. |
| CSS tokenizer (selector/property/value/@rule) | ✅ | shipped (2ae5bda) — css_tokenizer.sg: 7-state machine, 4 token types (Selector/Property/Value/AtRule). Interop-identical layout with html_tokenizer (tok_buf @0x500000, 12B/token). Handles class/#id/tag selectors, comma groups, @import/@media, block comments. |
| CSS selector matching / cascade | ✅ | shipped (6df6641) — style_resolver.sg: tag/class/id selector match, last-wins cascade, writes per-node StyleMap @0x700000 (48B: color/font_size/width/height/display/margin). Feeds layout_box. 12240B arm-el0 cc0 PASS. |
| Scroll (overflow: scroll / scrollTop) | ✅ | SCROLLCOMP-PASS (21a7fd5) — scroll_compositor.sg: per-layer (scroll_x, scroll_y) offset table at 0xAB0000, scroll_comp_composite maps viewport→content rows with clip. GPU: display pan register (silicon-pending); SW floor: copy_span. 4-probe test passed. |
<img> (JPEG, PNG, WebP) | ✅ | CSSIMG-PASS (38b3d7c) — img_decode.sg: RGBA→GPU texture pipeline. Renderer sandbox decodes PNG/JPEG → RGBA32 → img_decode_submit → compositor blit. GPU path: gpu_tex_upload + gpu_submit(CAP_ACCEL), silicon-pending; copy_span SW floor on Pi3/QEMU. Pixel probe PASS. |
<video> / <audio> | 🔲 | Tracked — sigil-video codec integration; 0.7.x |
| WebRTC | 🔲 | Tracked — requires SRDX-style peer connection design |
| MediaDevices (camera, mic) | 🔲 | Camera/mic caps not yet exposed to browser layer |
| Web Audio API | 🔲 | Tracked — MIDI/audio lane, 0.7.x |
5. Security model
| Feature | Status | Notes |
|---|---|---|
| Per-tab process isolation | ✅ | renderer_spawn.sg — only CAP_IPC per renderer |
| Content Security Policy (CSP) | ✅ | Enforced at Net process before delivery to renderer |
| HTTPS certificate validation | ✅ | OS TLS stack — same as system-wide |
| Mixed content blocking | ✅ | Net process policy — no HTTP fetch on HTTPS origin |
| Private mode (structural) | ✅ | Separate EL0 context, not policy; synchronous heap-zero on close |
| Extension isolation | ✅ | Unprotected zone — distinct EL0, cap grant sheet at install |
| Same-origin policy | ✅ | Enforced in Net process; renderers can't cross origins directly |
| Ambient authority | 🚫 | Intentionally absent. Caps are explicit; no ambient authority by design. |
6. Developer tools
| Feature | Status | Notes |
|---|---|---|
| Live cap inspector | ✅ | Built into every tab — this is the sigilOS native equivalent of the DevTools Security tab |
| Element inspector (DevTools) | 🔲 | Tracked — 0.7.x |
| JS debugger | 🔲 | Tracked — requires cc0/JS debug hooks |
| Network monitor | 🔲 | Tracked — IPC_T_NET_REQ/RESP log surfacing |
| Performance profiler | 🔲 | Tracked — ACPI PM Timer hooks available in kernel |
7. Extension compatibility
| Feature | Status | Notes |
|---|---|---|
| Chromium Extension Manifest V3 | 🔲 | Tracked — .crx parse + extension zone spawn |
| WebExtensions API | 🔲 | Tracked — subset; scope TBD by RFC |
| Extension zone isolation | ✅ | [unprotected zone] badge, cap grant sheet — honest trust model |
| Silent background permissions | 🚫 | Intentionally absent. All caps shown to user before install. |
8. What we intentionally omit (and why)
Ambient authority
Chrome grants permissions silently when a page is loaded (camera "just works" if the user said yes once, system-wide). sigilOS caps are explicit per-session and revocable per-session. The cap inspector exists because ambient authority doesn't.
Silent extension permissions
Chrome's Manifest V2 allowed extensions to run in the background with broad permissions the user never explicitly saw. sigilOS always shows the cap grant sheet before any extension code runs. The [unprotected zone] badge is permanent.
"Secure" private mode theatre
Chrome Incognito is policy — it clears storage on close, but the same process, the same OS permissions, and the same network visibility exist. sigilOS private mode is structural: a separate EL0 context, fs:rw caps removed, synchronous kernel heap-zero on close. Not theatre.