NONOS

NØNOS is an operating system built around privacy at the level of the kernel. Its design position is that a program is owed nothing and receives only what it has been explicitly granted.

The kernel is a microkernel with capability-based security. The component that grants and checks authority is under four thousand lines and is formally verified: the Rust is translated into Lean 4 by Charon and Aeneas, and the model is machine-checked to refine the extracted code, so the theorem covers the capability system as it ships.

Every program runs as a capsule, signed and started with exactly the permissions declared in its manifest, checked at spawn against the ceiling carried in its certificate. A capsule granted no network capability has no route to the network, no interface through which to request one, and no consent dialog through which a user can be persuaded to provide one. There is no root account and no administrator, so there is no authority to escalate toward.

Device drivers, the TCP/IP stack, the display server, the browser and the wallet/apps all run as capsules outside the kernel.