Rust microkernel · capability security · attested userland
The operating system that proves what it runs.
Every program carries a proof of what it is, and the kernel verifies that proof before it will start it. Drivers run in userspace, not in the kernel. Nothing is granted authority it was not explicitly given, and nothing persists after power-off.
Version 0.9.1 is out now. Boot it on QEMU, VirtualBox or real hardware.
Security is the architecture, not a feature.
Most systems trust what they load and audit later. NØNOS inverts that: programs ship as sealed capsules with a manifest, a signature, and the exact capabilities they may hold. The kernel refuses anything it cannot verify. There is no path around the check.
Capsules and trustNo ambient authority. Ever.
A capsule without the network capability cannot open a socket. One without storage rights cannot touch the filesystem. Authority is granted token by token, named in the signed manifest, and checked on every call.
Grants are explicit, auditable, and revocable at runtime. What was never granted does not exist for that capsule, and there is nothing to escalate.
Capabilities and tokensOld images do not boot again.
Every kernel carries a rollback index, and the bootloader enforces it against a TPM monotonic counter that only moves forward. Once a newer kernel has booted, the floor has risen for good.
A downgrade attack, flashing yesterday's vulnerable image to reopen yesterday's hole, dies at the gate. The signature is valid; the index is not. It does not run.
Attestation and rollbackPower off is a cryptographic event.
The system is RAM-resident. Nothing persists unless you decide it should, and memory that held secrets is zeroized on release, not merely freed.
A reboot is a clean slate: no stale credentials, no forensic residue, no state an attacker can seed today and harvest tomorrow.
How zeroization worksNot audited. Proven.
Audits sample; proofs cover. Lean 4 states what must be true across 155 modules
with zero sorry, and seven kernel functions are tied to that spec by
machine-checked extraction of the real compiler MIR with Charon and Aeneas. Verus
and Kani prove the implementation over every input, and the primitives underneath
are pinned to NIST and RFC vectors.
The proofs compile against the kernel source itself, never a copy, so a divergence is a build error. The STARK attestation gate alone carries 291 Lean theorems, a Verus bound on the parser, and a Kani totality proof, and writing them found and closed a real denial-of-service bug at the spawn gate.
The verification mapA post-quantum proof on every spawn, and on the kernel itself.
NØNOS carries its own transparent STARK: hash-based and post-quantum, with no trusted setup and no ceremony to leak. Goldilocks field arithmetic over a quadratic extension, Merkle membership as the statement, and money-grade soundness near 2-128 through extension-field challenges, proof-of-work grinding, and a blown-up FRI rate. Keccak drives the transcript, BLAKE3 measures the image, Poseidon is the in-circuit sponge.
Every capsule arrives with a proof binding its BLAKE3 measurement, its capability mask, and the policy epoch, and the kernel verifies membership in the enrolled policy root before a single instruction runs. The bootloader now does the same for the kernel, checking its STARK before the jump. One shared verifier crate is linked by both, so the proof written is exactly the proof read. It replaced a forgeable path.
We wrote our own language. Every run proves itself.
zKølang is a verifiable-compute language. You write straight-line field arithmetic
and a few assertions, it runs on a small register machine, and it hands back a
transparent STARK that anyone checks far faster than re-running the program. It
computes over the same Goldilocks field the kernel's STARK already commits to, so a
run and its proof are one object, and generation happens inside the kernel, in a
signed capsule, behind the zkolang terminal command.
Two NOX utilities ride on it. Pay to prove is a market: submit a program and public inputs with a NOX fee, a prover returns the STARK, and the fee releases on verification, most to the prover and a cut to the treasury. Private value reuses the same STARK as the verifier substrate for shielded transfer, send, swap, and unshield. Both settle in NOX.
Watch it prove itself.
From power-on to desktop, every stage is checked: the bootloader authenticates the kernel, the kernel authenticates every capsule, and the attestation gate holds until the proofs pass.
These are the real boot markers, in real order. The same chain runs on QEMU and on real x86_64 hardware.
How boot worksA real microkernel, drawn with hard lines.
The kernel keeps primitives: address spaces, scheduling, IPC, capabilities. Policy lives in userland capsules. Drivers claim hardware through a broker that mediates MMIO, port I/O, DMA and interrupts, and revokes a grant the moment a driver misbehaves.
The design is documented page by page, verified against the source it describes.
Explore the architectureRuns real software.
NØNOS implements a platform layer for the Rust standard library. Unmodified
Rust applications compile for the x86_64-nonos target and install as
signed capsules: threads, sockets, filesystem and all.
- Compositor, terminal, and an editor with a full IDE shell
- A browser engine rendering real pages over TLS
- WiFi, DHCP, DNS: a complete network stack in capsules
- Boots on real x86_64 laptops, not only in QEMU
Everything is public. Kernel to staking.
The kernel, the proofs, the signing tools, the documentation, and the staking stack are all AGPL and all on GitHub. Nothing runs on our servers that you cannot run on yours.
Stake NOX from your own machine: the receipt is signed locally as EIP-712 and lands on mainnet with no backend in the path.
Staking documentationWritten in the open, in these languages.
Rust across the kernel, tools, and userland. The rest is the Lean 4 proofs, which keep growing as more of the kernel is put under proof, plus the build system, arch-specific assembly, and the scripting around the proof and release pipelines.
@nonos/nox-dashboard
v0.1.2Local-first staking dashboard for NOX. Run it on your own machine, connect your own RPC and wallet, and stake without trusting a website.
npx @nonos/nox-dashboard
@nonos/nox-staking-sdk
v0.2.2Local-first TypeScript SDK for NOX staking. EIP-712 receipts, namespaces, tiers, and a pinned mainnet deployment, so integrations verify instead of trust.
npm install @nonos/nox-staking-sdk
nonos-micro-kernel
The kernel itself: Rust microkernel, bootloader, userland capsules, and the Lean, Verus and Kani proofs in one tree.
Rust · AGPL-3.0nonos-docs
The full documentation, written against the source it describes and versioned with the kernel.
Docs · AGPL-3.0nonos-sign
The host-side capsule signer and verifier. Hybrid Ed25519 and ML-DSA-65, the same trust chain the kernel enforces.
Rust · AGPL-3.0nonos-trust-keystore
Trust anchor, publisher keys, sealed policy and the signed capsule ledger. The roots of the chain, in public.
Keys · AGPL-3.0