Image NØNOS

Rust microkernel · capability security · attested userland

The operating system that proves what it runs.

Every program carries a proof of what it is, and the kernel verifies that proof before it will start it. Drivers run in userspace, not in the kernel. Nothing is granted authority it was not explicitly given, and nothing persists after power-off.

1,054 machine-checked theorems zero sorry ring-3 drivers

Version 0.9.1 is out now. Boot it on QEMU, VirtualBox or real hardware.

0unsigned binaries ever executed
95.6%Rust across the kernel, tools, and userland
3architectures: x86_64 today, aarch64 and riscv64 in bring-up
1054machine-checked Lean 4 theorems, verified in CI on every push

Security is the architecture, not a feature.

Most systems trust what they load and audit later. NØNOS inverts that: programs ship as sealed capsules with a manifest, a signature, and the exact capabilities they may hold. The kernel refuses anything it cannot verify. There is no path around the check.

Capsules and trust
ed25519 verify at the gate · invalid images never execute

No ambient authority. Ever.

A capsule without the network capability cannot open a socket. One without storage rights cannot touch the filesystem. Authority is granted token by token, named in the signed manifest, and checked on every call.

Grants are explicit, auditable, and revocable at runtime. What was never granted does not exist for that capsule, and there is nothing to escalate.

Capabilities and tokens
granted tokens dock · everything else is repelled at the shield

Old images do not boot again.

Every kernel carries a rollback index, and the bootloader enforces it against a TPM monotonic counter that only moves forward. Once a newer kernel has booted, the floor has risen for good.

A downgrade attack, flashing yesterday's vulnerable image to reopen yesterday's hole, dies at the gate. The signature is valid; the index is not. It does not run.

Attestation and rollback
the counter only moves forward · index 300 bounces off the ratchet

Power off is a cryptographic event.

The system is RAM-resident. Nothing persists unless you decide it should, and memory that held secrets is zeroized on release, not merely freed.

A reboot is a clean slate: no stale credentials, no forensic residue, no state an attacker can seed today and harvest tomorrow.

How zeroization works
the sweep is the wipe · power off → zeroized

Not audited. Proven.

Audits sample; proofs cover. Lean 4 states what must be true across 155 modules with zero sorry, and seven kernel functions are tied to that spec by machine-checked extraction of the real compiler MIR with Charon and Aeneas. Verus and Kani prove the implementation over every input, and the primitives underneath are pinned to NIST and RFC vectors.

The proofs compile against the kernel source itself, never a copy, so a divergence is a build error. The STARK attestation gate alone carries 291 Lean theorems, a Verus bound on the parser, and a Kani totality proof, and writing them found and closed a real denial-of-service bug at the spawn gate.

The verification map
1054Lean 4 theorems, 155 modules, zero sorry, checked in CI
7kernel functions extracted from real compiler MIR
74Kani harnesses: every input, not a test set
34proof crates that execute the real source

A post-quantum proof on every spawn, and on the kernel itself.

NØNOS carries its own transparent STARK: hash-based and post-quantum, with no trusted setup and no ceremony to leak. Goldilocks field arithmetic over a quadratic extension, Merkle membership as the statement, and money-grade soundness near 2-128 through extension-field challenges, proof-of-work grinding, and a blown-up FRI rate. Keccak drives the transcript, BLAKE3 measures the image, Poseidon is the in-circuit sponge.

Every capsule arrives with a proof binding its BLAKE3 measurement, its capability mask, and the policy epoch, and the kernel verifies membership in the enrolled policy root before a single instruction runs. The bootloader now does the same for the kernel, checking its STARK before the jump. One shared verifier crate is linked by both, so the proof written is exactly the proof read. It replaced a forgeable path.

transparent, post-quantum Goldilocks + Fp2 Merkle membership Keccak · BLAKE3 · Poseidon kernel + capsule attest no trusted setup
Inside the attestation
a capsule proves membership under the policy root · the path verifies, the root flashes, the spawn proceeds

We wrote our own language. Every run proves itself.

zKølang is a verifiable-compute language. You write straight-line field arithmetic and a few assertions, it runs on a small register machine, and it hands back a transparent STARK that anyone checks far faster than re-running the program. It computes over the same Goldilocks field the kernel's STARK already commits to, so a run and its proof are one object, and generation happens inside the kernel, in a signed capsule, behind the zkolang terminal command.

Two NOX utilities ride on it. Pay to prove is a market: submit a program and public inputs with a NOX fee, a prover returns the STARK, and the fee releases on verification, most to the prover and a cut to the treasury. Private value reuses the same STARK as the verifier substrate for shielded transfer, send, swap, and unshield. Both settle in NOX.

transparent STARK Goldilocks field 12 opcodes, all proven register binding pay to prove private value
Read the zKølang docs
the NOX badge, with its two utilities in orbit · pay to prove, and private value

Watch it prove itself.

From power-on to desktop, every stage is checked: the bootloader authenticates the kernel, the kernel authenticates every capsule, and the attestation gate holds until the proofs pass.

These are the real boot markers, in real order. The same chain runs on QEMU and on real x86_64 hardware.

How boot works
nothing runs until its stage verifies · the pulse is the boot

A real microkernel, drawn with hard lines.

The kernel keeps primitives: address spaces, scheduling, IPC, capabilities. Policy lives in userland capsules. Drivers claim hardware through a broker that mediates MMIO, port I/O, DMA and interrupts, and revokes a grant the moment a driver misbehaves.

The design is documented page by page, verified against the source it describes.

Explore the architecture
syscall pulses cross the boundary · denied calls stop at the kernel · the broker grants hardware

Runs real software.

NØNOS implements a platform layer for the Rust standard library. Unmodified Rust applications compile for the x86_64-nonos target and install as signed capsules: threads, sockets, filesystem and all.

  • Compositor, terminal, and an editor with a full IDE shell
  • A browser engine rendering real pages over TLS
  • WiFi, DHCP, DNS: a complete network stack in capsules
  • Boots on real x86_64 laptops, not only in QEMU
See the userland
a crate enters, the press signs it, a capsule docks · install-any-crate, verified

Everything is public. Kernel to staking.

The kernel, the proofs, the signing tools, the documentation, and the staking stack are all AGPL and all on GitHub. Nothing runs on our servers that you cannot run on yours.

Stake NOX from your own machine: the receipt is signed locally as EIP-712 and lands on mainnet with no backend in the path.

Staking documentation
signed on your machine · lands on mainnet · nothing in between

Written in the open, in these languages.

Rust across the kernel, tools, and userland. The rest is the Lean 4 proofs, which keep growing as more of the kernel is put under proof, plus the build system, arch-specific assembly, and the scripting around the proof and release pipelines.

Rust95.6% Lean2.9% Makefile0.7% Shell0.4% Assembly0.2% Python0.1%
See it on GitHub →

@nonos/nox-dashboard

v0.1.2

Local-first staking dashboard for NOX. Run it on your own machine, connect your own RPC and wallet, and stake without trusting a website.

npx @nonos/nox-dashboard

@nonos/nox-staking-sdk

v0.2.2

Local-first TypeScript SDK for NOX staking. EIP-712 receipts, namespaces, tiers, and a pinned mainnet deployment, so integrations verify instead of trust.

npm install @nonos/nox-staking-sdk