If you’re running Ventura or Sonoma, you may have noticed that Safari, the app, behaves strangely. Look in your main /Applications folder, and it’s shown just as you’d expect, but look in the folder containing all the other bundled apps, in /System/Applications, and it’s missing. So just where is the Safari app, then?

This becomes more of a mystery if you have a second bootable volume group available, either installed alongside your main one, or on an external disk. Look on that System volume when your Mac hasn’t booted from it, and not only is Safari not in /System/Applications, but it’s even missing from its main /Applications folder. Indeed, the only apps you’ll see there are those you installed on that system. If you haven’t added any, then /Applications is completely empty apart from an empty Utilities folder.

The reason for Safari’s odd behaviour is that it isn’t installed on either the System or Data volume now, as it used to be in Monterey and earlier. In those days, to ensure that Safari could be updated outside full macOS updates, it was installed on the Data volume. From Ventura onwards it comes wrapped in a Cryptex, a secure disk image that’s loaded during the boot process, and that locates its copy of Safari in the /Applications folder.

Cryptexes, and the system snapshot that forms the Signed System Volume (SSV), are only mounted when they’re part of the active boot volume group. Your inactive boot volume group thus doesn’t mount its Cryptex containing Safari, or its SSV containing all the other bundled apps. So you can’t see them where they aren’t on your boot volume.

Just when you think you’ve got your head around that, try running one of the bundled apps from that inactive boot volume group, from its /System/Applications folder. You’ll discover that’s impossible, as macOS crashes the app immediately it tries to start up, complaining of a Code Signature Invalid error.

How come a perfectly valid and undamaged copy of one of the bundled apps can’t be run from an inactive boot volume group?

This is because macOS will only run those bundled apps from a mounted SSV, and not from a different bootable system. Since Ventura, the macOS security system has applied Launch Constraints to certain types of code, which among other things only lets you run bundled apps from their expected locations, on the SSV and (in the case of Safari) from a mounted Cryptex. Those launch constraints are assembled into Trust Caches, and the only way that you can break their rules is to turn System Integrity Protection (SIP) off.

That’s why, even if you manage to make a copy of one of the bundled apps in Ventura or Sonoma, the security system won’t allow you to run it, as that copy fails to meet its Launch Constraints.

Summary

In Ventura and Sonoma:

• Safari is run from a Cryptex, so only appears for the active boot volume group.
• You can’t run bundled apps in inactive boot volume groups.
• Neither can you run copies of bundled apps.