NONOS

NØNOS is an operating system built around privacy at the level of the kernel. Its design position is that a program is owed nothing and receives only what it has been explicitly granted.

The kernel is a microkernel with capability-based security. The component that grants and checks authority is under four thousand lines and is formally verified: the Rust is translated into Lean 4 by Charon and Aeneas, and the model is machine-checked to refine the extracted code, so the theorem covers the capability system as it ships.

Every program runs as a capsule, signed and started with exactly the permissions declared in its manifest, checked at spawn against the ceiling carried in its certificate. A capsule granted no network capability has no route to the network, no interface through which to request one, and no consent dialog through which a user can be persuaded to provide one. There is no root account and no administrator, so there is no authority to escalate toward.

Device drivers, the TCP/IP stack, the display server, the browser and the wallet/apps all run as capsules outside the kernel. Roughly 600k + lines of the system hold no privilege and have no path into the kernel address space.

The system is RAM-resident. After shutdown no logs, caches, browsing history or device identity remain on the machine. Network traffic leaves through an onion mixnet implemented inside the kernel with a fresh key agreement at every hop. Nothing executes unproved. The bootloader verifies the kernel under two independent signature schemes, one of them post-quantum, then checks the kernel own STARK proof against a root compiled into the bootloader. Each capsules proof is verified before its image is mapped, and a missing or invalid proof means the capsule does not run. The proving system is the project own transparent STARK over the Goldilocks field, requiring no trusted setup and no pairing-based cryptography. That same prover settles NOX Shield, a private transfer protocol verified on Ethereum by a Solidity contract. NOX is the ecosystem ERC-20 token on Ethereum.