NØNOS is an operating system built from bare metal around one idea: a machine should trust as little as possible and remember as little as it needs. The kernel starts from zero state, runs from memory, and loads only software whose signature it can check. Every privilege is a capability granted on purpose, never something a process inherits by accident.
The rest of the stack follows the same rule. The NØNOS STARK is a transparent proof system written from scratch, with no trusted setup and no pairings. NØNOS Shield uses it to move value privately on Ethereum: one transaction per transfer, and inside it the chain verifies the whole proof itself.
Every program runs in a box: a short list, in its signed listing, of what it may touch. A window. Its own home folder. The network over Nym or Anyone. Anything not on the list is refused, and the log says why. The Marketplace lists 31 Linux programs, each with its own box. In 0.9.3 a program whose box grants a window opens it on the NØNOS desktop, as KeePassXC, swayimg and foot do, and gets no rights of its own.
Ring 0 does only what ring 0 must. Drivers, networking and the desktop are capsules in ring 3, and every call they make is checked against a 40-bit capability word. Memory is wiped when you power off, and nothing touches a disk unless you install.
A program reaches a NØNOS machine only through a build that anyone can repeat and a signature the kernel verifies before it runs a single instruction. Capsules carry a hybrid signature, Ed25519 and ML-DSA-65, checked against a sealed trust anchor.
The Marketplace applies the same chain to third-party software, so a listing says what a program may do and the kernel holds it to that.
Where a claim can be checked by a machine, it is: by a signature, by a transparent proof, or by a test that fails when the property breaks.
Private transfers on Ethereum L1, verified by a STARK in a single transaction.
| 1 transaction per private transfer, with the whole proof verified on chain |
0 trusted setups no ceremony, no pairings, no off-chain verifier |
Every constraint recomputed by the chain, not supplied by the prover |
Sepolia first end-to-end private transfers settled, in ETH and NOX |
Solid lines exist today. Dashed ones are a direction. Blinded proofs, proving on your own device and an external audit come before mainnet.
| Kernel |
microkernel The NØNOS microkernel, in Rust releases Every release: images, checksums and the public material to verify them docs Kernel, userland and security documentation, in the microkernel repository nonos-ci Static checks, baselines and trust-chain CI |
|---|---|
| Trust chain |
nonos-sign Capsule signer and verifier, Ed25519 and ML-DSA-65 nonos-mk Capsule packager and marketplace index nonos-mirror The package mirror stark-attest Attest a set of artifacts with one 32-byte statement, transparently |
| Proofs and Shield |
STARKs A transparent STARK over Goldilocks: circuits, verifiers, wallet prover, Zig client and Lean core L1-Shield Private payments on Ethereum L1, one STARK per transfer shield-core The Rust core of NØNOS Wallet shield-android · shield-ios NØNOS Wallet for Android and iOS zkolang A verifiable-compute language, proven by the NØNOS STARK |
| Nil and tools |
NIL A private workspace for teams who sign in with a wallet: tasks, docs, chat and files, encrypted in the browser nonos.software Wiki, manual, ISO downloads and news BuyBot · gitbot · NOXDashboard · NOXtools · nonos-wallpapers |
Write to team@nonos.systems, or use the security policy of the repository concerned. Please do not open a public issue for a weakness.
nonos.software · nonos.systems · team@nonos.systems
Trust nothing you cannot verify. Keep nothing you do not need.