A word that is easy to say
"Superset of Chrome, Safari and Comet" is the bar Dad set, and it is the kind of claim that becomes false quietly. Voyager runs on WebKit, and WebKit is not Chrome's superset by itself. Some Chrome features do not exist there at all. The architecture says so in its second section, before any design: where WebKit lacks something Chrome has, the gap is named in the parity contract and then closed in the shell, bridged natively, or accepted by Dad. It is never hidden.
The parity contract is the document that does the naming. It is short, and almost every part of it exists to stop "superset" from being claimed past what is true.
One oracle, two instruments
Comet is the oracle, because it is the browser Dad lives in. Chrome and Safari are secondary oracles. None of them is a runtime dependency. Against that oracle the contract uses two instruments, and the split between them is the design:
- The P0 table is what must already work before Dad is asked to live in Voyager. It was drawn from evidence on his own Mac, not from a feature list: the extensions in his Comet profile, the native messaging hosts registered there, a screenshot he shared, and his own words in the talk.
- The departure log is everything after that. Rows enter the later tiers only from the log.
The contract compresses the second instrument into one sentence: a feature nobody left for is not work. That is what stops a superset goal from turning into an endless reimplementation of Chrome. The bar is everything Dad needs, and the log is how Voyager learns what that is.
What a P0 row looks like
Every P0 row has three columns: an area, a case, and the evidence that proves it. The areas cover credentials, extensions, sign-in that survives a restart, media (sound, full screen, Picture in Picture, an H.264/AAC file that plays and downloads), input (Korean composition in every field, Chrome's shortcuts on every surface a tab can show), the basics (download, upload, find, zoom remembered per site, print to PDF, pop-ups, HTTP authentication, certificate errors), the family half, Pippa, identities, the system (a link from another app opens in Voyager) and lightness.
The evidence column is the useful part. "Korean input works" is a claim. "Typed by hand, including composition at a line end" is a test someone can run. The contract's evidence rules tighten it further:
- A case passes from
/Applications/Voyager.app, never from a debug build. - A run that skipped a case is not a pass; the skip is named.
- A case that passed on one macOS version is run again after a macOS update, because the engine changes with the system.
That last rule follows directly from the engine choice. When your engine ships with the operating system, an OS update is an engine update you did not schedule.
One row shows what the contract does when a P0 case fails. The first row is 1Password filling a login through its desktop app, and the contract writes the fallback next to it: if 1Password cannot connect from a browser of ours, Dad rules what is enough, and the row is rewritten to what he rules. The honest state of that row is the subject of a later track.
The gaps, each with a reason and an answer
The contract's engine-bound table is the core of this lesson. Each row is a thing WebKit does not do, the reason, and Voyager's answer. Read it together with the engine evaluation's list of what WebKit lacks, and all three answers from the architecture appear in practice:
| Answer | Example |
|---|---|
| Closed in the shell | WebKit has no public tab mute, so Voyager's own script mutes the page's media elements in every frame. WebKit's find answers only whether a match exists, so the "3 of 17" count is computed from the page's visible text. |
| Bridged natively | Web MIDI is absent in WebKit, and cwkBonfire uses it. A native bridge for that one family page is one option; the ruling is still open. |
| Accepted by Dad | On iPhone and iPad, a family web app's service worker does not run without Apple's web-browser entitlement. Dad accepted that, because with no network the household servers are unreachable anyway. |
The table ends with the sentence that gives the whole document its point: these are named here so that "superset" is never claimed past them. And each one that starts producing departures is a reason to reopen the reserved option in the engine evaluation: Voyager's features attached to an existing Chromium browser, reusing the same Swift core. A named gap carries its own escape hatch.
The phone is held to a different oracle
The iPhone and iPad app is measured against Safari on the phone, not against Chrome on the Mac, and its gaps get their own table: no service workers for family apps, no passkeys, not the default browser, no extension host, no downloads list. The entitlement that would close the first three was dropped on 2026-10-26, because Apple grants it only after a public TestFlight link and external Beta App Review, and no family app goes there:
아니, 근데 이거 다 디폴트 브라우져 자격 얻는데 필요한 깐깐한 심사 아니야? 디폴트로 안 쓰면 그만이잖아? 이걸 외부 베타 테스트 심사까지 받는다고? 그건 하면 안 돼.
"Wait, isn't all this the strict review you need to qualify as a default browser? If we don't use it as the default, that's the end of it, right? Going all the way through external beta review for this? We shouldn't do that."
That is a gap accepted with its price written down, which is exactly what the contract asks for.
Never, with the reason
The last table lists what Voyager will not build: a bundled or patched engine, a private WebKit interface without Dad's ruling, a second Pippa, a hand-kept list of family apps, and a workaround that hides Voyager's identity from a site in pieces. Each row carries its reason, and a row moves only by Dad's ruling with the departure that forced the question cited beside it. A "never" without a reason is a prejudice. A "never" with one is a decision the next session can check.
Gaps live in code as well as in documents. The address resolver's header says Phase 2 puts a family app's name in front of both (the launch catalog), and its resolve(_:) knows schemes, hosts and the search template, nothing else. The gap is visible to anyone who opens the file.