1 release 1 tag

RSS feed

• v0.9.2 6f269fdd3a

  Compare

  v0.9.2 Pre-release

  nonos-sync released this 2026-10-10 09:35:22 -04:00 | 2 commits to main since this release

  NONOS 0.9.2 (pre-release)

  This tag replaces the 0.9.2 pre-release of September 3. That tag was cut before most of what 0.9.2
  is: the Linux personality, the Anyone transport, the shield, the installer and the Marketplace
  all landed after it. This one is cut from the tree that holds them, built the same way on Linux
  and macOS, with every capsule proved under one STARK policy root.

  It is a pre-release. What it does not do yet is listed under Known limitations,
  and it should be read before you install it on a machine you care about.

  What you download

  File	Made by	What it is
  nonos.img, nonos.iso	the release seal, on the signing machine	The bootable image, its kernel and loader signed (Ed25519 and ML-DSA-65).
  nonos-release-bundle.tar.gz	CI, from a reproducible build	The kernel ELF, the UEFI loader, the capsule catalogue, the SBOM, every trust root and the STARK trailer of every enrolled capsule.
  verifier.wasm	CI	The STARK verifier the kernel's gate links (nox_verify), for checking proofs in a browser.
  nonos.cdx.json, nonos-build.json, provenance.json	CI	Bill of materials, build record with every input hash, and the bundle's provenance.
  SHA256SUMS, BLAKE3SUMS	CI	Sums over exactly the CI files above.
  IMAGE-SHA256SUMS, IMAGE-BLAKE3SUMS	the release seal	Sums over nonos.img and nonos.iso.

  CI holds no signing key and signs nothing. The image is the same build CI makes, plus signatures.

  Verify it

  sha256sum -c SHA256SUMS && sha256sum -c IMAGE-SHA256SUMS
  b3sum -c BLAKE3SUMS && b3sum -c IMAGE-BLAKE3SUMS
  gh attestation verify nonos-release-bundle.tar.gz --repo NON-OS/microkernel
  

  Rebuild it yourself and compare: nix build .#standard at this tag gives the kernel, loader and
  capsules in the bundle, byte for byte, on x86_64 Linux and on Apple silicon macOS. The
  reproducible CI lane builds on both and compares every file.

  What is new since the September tag

  Running Linux programs

  The Linux personality (capsule_linux) runs unmodified x86_64 Linux binaries, static and
  dynamic, with threads, a filesystem view, sockets and signals, each confined and attested before
  it runs. It installs Alpine, Debian/Kali and pacman packages. Every image carries CPython 3.12,
  Lua 5.4, zstd, John the Ripper and qwenchat (llama.cpp), all built from pinned sources; a
  dozen more (sqlite3, perl, tclsh, mruby, qjs, jq, gojq, rg, fd, nano, make, openssl) install
  from the Marketplace.

  Private networking

  • Anyone transport (capsule_net_anon): an onion routing client for the Anyone network, a
    Tor 0.4.8.11 fork. Model downloads go over it.
  • Nym: the whole active set is held and drawn without bias, the replay window is checked on
    the live receive path, and the S-box is constant time.
  • TLS: a streaming client with alert reasons, and DER lengths past the buffer refused.

  Wallet, proofs and attestation

  • Shield (capsule_shield): the NOX Shield wallet service, on the same Rust core as the
    phone apps.
  • Anonymous device proof (capsule_prove), with no network capability.
  • One STARK policy root over every capsule, checked at spawn by nox_verify. The kernel and
    the loader carry their own attestation roots, and the kernel checks the loader at boot.
  • TPM machine key and vault: records sealed to the machine; the wallet vault is sealed by the
    keyring.

  Installing and the Marketplace

  • Installer (capsule_install, and install-cli): writes a whole NONOS disk and reads every
    sector back. It keeps setup answers, Wi-Fi, the wallet vault, models and installed packages.
  • Marketplace with a signed catalogue, and Qwen tiers installed from the Models tab or
    qwen get, each file checked against its SHA-256.
  • Image profiles come from nonos.toml: standard, hardened, airgapped, qemu, dev, core.

  Kernel

  • SMP on every core: AP bring-up, IPIs, TLB shootdown, and deferred invalidation with one
    rendezvous per unmap.
  • Hardening that was off is on: stack guards, the W^X check on both halves, uncached MMIO,
    the IOMMU brought up after paging, and every device mapping confined to the broker allowlist.
  • Smaller syscall surface: MkSpawn and the five signing syscalls are gone, wallet curve
    crypto moved to ring 3, and the halo2 verifier removed from kernel and loader.
  • Fixes: the SYSRET STAR RPL bits, IDT error codes for vectors 29 and 30, the RSDP checks,
    PCI masking, IOMMU register bounds, close-on-exec across fork, and fatal exceptions that now
    explain themselves on serial.

  Desktop

  git in the Terminal (clone and push over HTTPS), an xterm-compatible terminal emulator, the
  rebuilt Files app with search, tags and favourites, contrast-checked themes, text scaling and
  reduced motion, and a startup chime.

  Verification

  979 kernel functions are extracted from the Rust and proven in Lean (492 with a behavioural
  property), next to 1,499 core Lean theorems with no sorry, 109 Kani harnesses and 107 runnable
  proof crates (verification/evidence/EVIDENCE.json). The proofs found real bugs, among them
  align_up defined four ways with four answers and a constant-time compare that computed its
  borrow wrongly.

  Build

  One Nix build behind make. The capsules, tools, kernel and image come out byte-identical on
  Linux and macOS: fat LTO, host-neutral crate names in the rustc wrapper, one codegen unit for
  upstream tools, portable BLAKE3, and pinned host tools. make seal signs and enrolls, and keeps
  the committed STARK enrollment when it still proves the capsules.

  Breaking changes

  • The MkSpawn and signing syscalls are removed. Capsules built out of tree must use
    nonos_ed25519 and nonos_secp256k1 and the current spawn path.
  • New capability bits: AttestRead, LocalSign, ForeignExec.
  • The submodules are folded into this one repository. Re-clone.
  • The trust set is re-signed. Enrollments from the September tag do not verify against it.
  • No in-place upgrade. Reinstall; nothing carries over from an older install.

  Known limitations

  • A USB stick boot does not bind the stick. The kernel picks a disk at its first block I/O,
    and a boot from a stick makes none, so its state is not kept on the stick. The CI boot test
    checks that the stick boots and the USB storage driver starts, not that it binds.
  • Not in any image yet: the e1000e, igc, USB Ethernet and rtsx drivers, the attack suite,
    the assembly installer and the SMP stress test.
  • Desktop: it cannot power off, Files and the Editor do not keep files across a reboot,
    there is no login password, no USB hubs, and memory above 64 GiB is unused.
  • Hardening: no KASLR, no compiler stack canaries, the capability ceiling is logged rather
    than enforced, and the package store is not encrypted.
  • aarch64 is a preview with no loader or image; riscv64 does not build a kernel.
  • Not yet tested on a booted image: live Nym and Anyone traffic, Secure Boot enabled, and an
    update from one release to the next.

  What's Changed

  • Capsule boot and init/spawn by @senseix21 in https://github.com/NON-OS/microkernel/pull/163
  • Advance main: capsule refactors, broker IRQ routing, docs and wallpaper submodules by @eKisNonos in https://github.com/NON-OS/microkernel/pull/164
  • Input probe harness by @senseix21 in https://github.com/NON-OS/microkernel/pull/165
  • fix: working keyboard under macOS hvf (PS/2 input path) by @senseix21 in https://github.com/NON-OS/microkernel/pull/166
  • feat(boot): modern boot experience + ZK attestation surfacing + graphics by @senseix21 in https://github.com/NON-OS/microkernel/pull/167
  • Fix/capsule integrity fixes by @senseix21 in https://github.com/NON-OS/microkernel/pull/168
  • Fix/capsule integrity fixes by @senseix21 in https://github.com/NON-OS/microkernel/pull/169
  • Fix/capsule integrity fixes by @senseix21 in https://github.com/NON-OS/microkernel/pull/170
  • boot on virtualbox, gop framebuffer handoff, arch boundary by @eKisNonos in https://github.com/NON-OS/microkernel/pull/171
  • Feat/vfs real work loop by @senseix21 in https://github.com/NON-OS/microkernel/pull/172
  • Feat/alive system by @senseix21 in https://github.com/NON-OS/microkernel/pull/173
  • terminal: full nox shell, self-healing input, panic-free hot paths by @eKisNonos in https://github.com/NON-OS/microkernel/pull/174
  • build: boot QEMU at 1920x1080 so fullscreen fills the screen by @eKisNonos in https://github.com/NON-OS/microkernel/pull/175
  • driver/virtio-gpu: clamp tiny host scanout modes up to 1080p by @eKisNonos in https://github.com/NON-OS/microkernel/pull/176
  • kernel: load and spawn capsules from the VFS store at runtime by @eKisNonos in https://github.com/NON-OS/microkernel/pull/178
  • nonos/libc runtime bindings by @eKisNonos in https://github.com/NON-OS/microkernel/pull/179
  • nonos/runtime install by @eKisNonos in https://github.com/NON-OS/microkernel/pull/180
  • nonos/std library by @eKisNonos in https://github.com/NON-OS/microkernel/pull/181
  • nonos/std example by @eKisNonos in https://github.com/NON-OS/microkernel/pull/182
  • nonos/wallet by @eKisNonos in https://github.com/NON-OS/microkernel/pull/183
  • nonos/rustfmt by @eKisNonos in https://github.com/NON-OS/microkernel/pull/184
  • ci: pin the tests submodule back to its pushed commit by @eKisNonos in https://github.com/NON-OS/microkernel/pull/185
  • feat: snake game capsule + fleet-wide input/UI fixes by @senseix21 in https://github.com/NON-OS/microkernel/pull/186
  • std: x86_64-nonos platform layer (unmodified Rust on NONOS) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/187
  • kernel: process arguments (mk_args) through the verified spawn path by @eKisNonos in https://github.com/NON-OS/microkernel/pull/188
  • std: net, sync, process, env, and a wider io and fs surface by @eKisNonos in https://github.com/NON-OS/microkernel/pull/189
  • capsules: std_proof and gui_proof on nonos_std by @eKisNonos in https://github.com/NON-OS/microkernel/pull/191
  • wallet: ethereum transaction flow, network probe, and UI build-out by @eKisNonos in https://github.com/NON-OS/microkernel/pull/192
  • desktop: wallet launcher icon, NONOS logo, taskbar refinements by @eKisNonos in https://github.com/NON-OS/microkernel/pull/193
  • docs: README and quickstart touch-ups, qemu network-mode audit script by @eKisNonos in https://github.com/NON-OS/microkernel/pull/194
  • feat(net-tcp): RFC-793 TCP P0+P1 + fix outbound egress (TCP works end-to-end) by @senseix21 in https://github.com/NON-OS/microkernel/pull/195
  • feat(desktop-shell): hover-to-reveal the auto-hidden bottom dock by @senseix21 in https://github.com/NON-OS/microkernel/pull/197
  • std: complete the x86_64-nonos platform layer (fs, net, threads, real heap) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/196
  • kernel: mk_thread_spawn, user threads sharing the capsule address space by @eKisNonos in https://github.com/NON-OS/microkernel/pull/198
  • fix: repair microkernel syscall wiring after thread-spawn merge by @eKisNonos in https://github.com/NON-OS/microkernel/pull/199
  • fix(net-l2): learn leased IP so ARP carries a real sender by @senseix21 in https://github.com/NON-OS/microkernel/pull/200
  • fix(virtio-net): defer RX refill until the frame is consumed by @senseix21 in https://github.com/NON-OS/microkernel/pull/202
  • fix(net-tcp): reject ACKs that don't acknowledge our SYN by @senseix21 in https://github.com/NON-OS/microkernel/pull/201
  • crypto: AEAD AAD + ECDSA verify + SHA-384; wallet: TLS 1.3 client by @eKisNonos in https://github.com/NON-OS/microkernel/pull/203
  • fix(net-ip): reject fragmented IPv4 datagrams by @senseix21 in https://github.com/NON-OS/microkernel/pull/204
  • fix(net-l2): evict the genuinely-oldest ARP entry by @senseix21 in https://github.com/NON-OS/microkernel/pull/205
  • syscall: add MkProcOutput to drain a child's stdout by @eKisNonos in https://github.com/NON-OS/microkernel/pull/206
  • virtio-net: accept MSI-X NICs and trace setup stages by @eKisNonos in https://github.com/NON-OS/microkernel/pull/207
  • net-tcp: bound connect wait with a wall-clock timeout by @eKisNonos in https://github.com/NON-OS/microkernel/pull/208
  • net-dns: take the upstream resolver from DHCP by @eKisNonos in https://github.com/NON-OS/microkernel/pull/209
  • run unmodified crates.io apps as verified capsules by @eKisNonos in https://github.com/NON-OS/microkernel/pull/210
  • userland: rustfmt pass by @eKisNonos in https://github.com/NON-OS/microkernel/pull/211
  • feat(net-tcp): TCP reliability core — retransmission, reassembly, flow & congestion control by @senseix21 in https://github.com/NON-OS/microkernel/pull/212
  • feat(net): security hardening Wave 1 — ARP/DNS/TCP/DHCP by @senseix21 in https://github.com/NON-OS/microkernel/pull/213
  • feat(net): authorize sensitive control ops by service-owner pid by @senseix21 in https://github.com/NON-OS/microkernel/pull/214
  • perf(desktop): drop ripgrep/std_proof embeds from the desktop kernel by @senseix21 in https://github.com/NON-OS/microkernel/pull/215
  • sched: preempt on the timer tick and fix per-CPU identity by @eKisNonos in https://github.com/NON-OS/microkernel/pull/216
  • mm: bound demand faults per process and report heap corruption by @eKisNonos in https://github.com/NON-OS/microkernel/pull/217
  • input: route key release to the press target by @eKisNonos in https://github.com/NON-OS/microkernel/pull/218
  • smp/apic: x2apic detection and IPI vector handlers by @eKisNonos in https://github.com/NON-OS/microkernel/pull/219
  • fix(net): grant net.dhcp and net.dns the Crypto capability by @senseix21 in https://github.com/NON-OS/microkernel/pull/221
  • fix(ipc): yield instead of spin on capsule transport locks under preemption by @senseix21 in https://github.com/NON-OS/microkernel/pull/222
  • syscall: bound user-supplied lengths and authorize proc_output by @eKisNonos in https://github.com/NON-OS/microkernel/pull/223
  • surface: compute the next vblank on a fixed phase grid by @eKisNonos in https://github.com/NON-OS/microkernel/pull/224
  • feat(terminal): Warp look, full command set, and boot-testable GUI capsule by @senseix21 in https://github.com/NON-OS/microkernel/pull/225
  • nonos-hardening: trusted-path hardening, dead-surface cleanup, block-device storage by @eKisNonos in https://github.com/NON-OS/microkernel/pull/227
  • fix(net): real terminal ping + working DNS resolution by @senseix21 in https://github.com/NON-OS/microkernel/pull/228
  • fix(net-dns): time-bound the DNS exchange so slow lookups resolve by @senseix21 in https://github.com/NON-OS/microkernel/pull/229
  • feat(terminal): VT100/ECMA-48 cell-grid terminal emulator (translated from Redox ransid) by @senseix21 in https://github.com/NON-OS/microkernel/pull/230
  • chore(terminal): remove the autorun/autofocus GUI-smoke demo by @senseix21 in https://github.com/NON-OS/microkernel/pull/231
  • chore(terminal): remove the autorun/autofocus GUI-smoke demo by @senseix21 in https://github.com/NON-OS/microkernel/pull/232
  • feat(terminal): VT100 terminal emulator + ping/DNS + ZK policy-root fix (merge to main) by @senseix21 in https://github.com/NON-OS/microkernel/pull/233
  • feat(terminal): tabs + Warp-style command blocks by @senseix21 in https://github.com/NON-OS/microkernel/pull/234
  • Transparent ZK attestation across bootloader and kernel by @eKisNonos in https://github.com/NON-OS/microkernel/pull/235
  • feat(terminal): modern restyle — Warm Slate palette + command-block headers by @senseix21 in https://github.com/NON-OS/microkernel/pull/236
  • Dev bootstrap: clean clone can attest and boot (NONOS_DEV) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/237
  • fix(wallet): make TLS 1.3 complete a full live handshake (7 root-cause fixes) by @senseix21 in https://github.com/NON-OS/microkernel/pull/238
  • fix(wallet): wallet TLS 1.3 live-handshake fixes into main (7 fixes, #238) by @senseix21 in https://github.com/NON-OS/microkernel/pull/239
  • feat(net-core): smoltcp-backed network core capsule (net.tcp/udp/dhcp/dns) by @senseix21 in https://github.com/NON-OS/microkernel/pull/240
  • Fix/wallet tls live handshake by @senseix21 in https://github.com/NON-OS/microkernel/pull/241
  • Bootloader hardening by @eKisNonos in https://github.com/NON-OS/microkernel/pull/243
  • Bump nonos-sign submodule (deterministic CI + verification hardening) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/247
  • Bootloader: TPM measured boot + NV monotonic counter working in firmware by @eKisNonos in https://github.com/NON-OS/microkernel/pull/248
  • ci: add evidence, reproducibility, and release provenance gates by @eKisNonos in https://github.com/NON-OS/microkernel/pull/244
  • Bootloader: show TPM measured boot + NV counter status on the boot screen by @eKisNonos in https://github.com/NON-OS/microkernel/pull/249
  • Bootloader: TPM-backed anti-rollback (signed index + monotonic counter floor) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/251
  • Bootloader: the boot menu chooses the security policy by @eKisNonos in https://github.com/NON-OS/microkernel/pull/252
  • feat(browser): capsule_browser P0–P3 — HTTP+HTTPS browser capsule (renderer correctness, async fetch, gzip) by @senseix21 in https://github.com/NON-OS/microkernel/pull/242
  • Feat/net core smoltcp by @senseix21 in https://github.com/NON-OS/microkernel/pull/253
  • ci: publish benchmark artifacts by @eKisNonos in https://github.com/NON-OS/microkernel/pull/250
  • Kernel hardening: return paths, IPC, usercopy, and exceptions by @eKisNonos in https://github.com/NON-OS/microkernel/pull/254
  • Harden browser and network capsules by @eKisNonos in https://github.com/NON-OS/microkernel/pull/255
  • Browser and network hardening by @eKisNonos in https://github.com/NON-OS/microkernel/pull/257
  • Bootloader: require hybrid kernel release signatures by @eKisNonos in https://github.com/NON-OS/microkernel/pull/258
  • Browser and network hardening for the full attested desktop by @eKisNonos in https://github.com/NON-OS/microkernel/pull/260
  • Kernel/crypto trust-boundary hardening + IOMMU S1 (prod-readiness audit) by @senseix21 in https://github.com/NON-OS/microkernel/pull/261
  • browser: calc, box-sizing, flex, heights, WebP lossless, backgrounds, gradients, shadows, tables by @eKisNonos in https://github.com/NON-OS/microkernel/pull/262
  • Filesystem and file manager hardening by @eKisNonos in https://github.com/NON-OS/microkernel/pull/263
  • Formal verification: Verus proofs of kernel invariants + proof-stack CI by @eKisNonos in https://github.com/NON-OS/microkernel/pull/264
  • Crypto proofs: known-answer verification of the hash and signature primitives by @eKisNonos in https://github.com/NON-OS/microkernel/pull/265
  • Boot proofs: anti-rollback invariants and image-parser safety by @eKisNonos in https://github.com/NON-OS/microkernel/pull/266
  • Net proofs: DNS parser compression-pointer safety by @eKisNonos in https://github.com/NON-OS/microkernel/pull/267
  • deps: bump crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/291
  • feat(clock): clock app with digital/analog, stopwatch, timer, and manual time-set by @senseix21 in https://github.com/NON-OS/microkernel/pull/280
  • feat(ntp): network time sync — SNTP capsule + disciplinable kernel clock by @senseix21 in https://github.com/NON-OS/microkernel/pull/281
  • Kernel isolation proofs: W^X encoding and user-copy bounds by @eKisNonos in https://github.com/NON-OS/microkernel/pull/268
  • Driver proofs: AHCI block I/O bounds by @eKisNonos in https://github.com/NON-OS/microkernel/pull/271
  • #270 verification foundation by @eKisNonos in https://github.com/NON-OS/microkernel/pull/301
  • Verification architecture documentation by @eKisNonos in https://github.com/NON-OS/microkernel/pull/275
  • Driver proofs: NVMe block I/O bounds and device-page parser safety by @eKisNonos in https://github.com/NON-OS/microkernel/pull/276
  • Driver proofs: xHCI TRB encodings match the specification by @eKisNonos in https://github.com/NON-OS/microkernel/pull/284
  • Driver proofs: virtio-net RX slot confinement by @eKisNonos in https://github.com/NON-OS/microkernel/pull/287
  • browser: @import, parallel image loading, flex centering, object-fit by @eKisNonos in https://github.com/NON-OS/microkernel/pull/272
  • Lean specification proofs: anti-rollback and capability security by @eKisNonos in https://github.com/NON-OS/microkernel/pull/273
  • USB proofs: HID descriptor parser safety by @eKisNonos in https://github.com/NON-OS/microkernel/pull/274
  • STARK field: transparent post-quantum proof foundation by @eKisNonos in https://github.com/NON-OS/microkernel/pull/277
  • Driver proofs: USB mass-storage descriptor, CSW, and request safety by @eKisNonos in https://github.com/NON-OS/microkernel/pull/278
  • Driver proofs: virtio-blk request bounds and exact framing by @eKisNonos in https://github.com/NON-OS/microkernel/pull/279
  • Driver proofs: e1000 descriptor rings are bounded state machines by @eKisNonos in https://github.com/NON-OS/microkernel/pull/282
  • Driver proofs: RTL8139 ring walk confinement by @eKisNonos in https://github.com/NON-OS/microkernel/pull/283
  • Lean proofs by @eKisNonos in https://github.com/NON-OS/microkernel/pull/326
  • ci: restore verification proof gates by @eKisNonos in https://github.com/NON-OS/microkernel/pull/311
  • Lean specifications for every proven surface, and a verification truth pass by @eKisNonos in https://github.com/NON-OS/microkernel/pull/324
  • extraction: regenerate for the TimeSet capability by @eKisNonos in https://github.com/NON-OS/microkernel/pull/329
  • ci: publish lean evidence like the benchmark workflow by @eKisNonos in https://github.com/NON-OS/microkernel/pull/334
  • verification: prove ZeroState wiping and IPC sender attestation in Lean by @eKisNonos in https://github.com/NON-OS/microkernel/pull/331
  • stark: land the full transparent proof stack in one merge by @eKisNonos in https://github.com/NON-OS/microkernel/pull/336
  • stark: restore the Poseidon preimage AIR and the forgery fuzz by @eKisNonos in https://github.com/NON-OS/microkernel/pull/337
  • Post-quantum capsule attestation, and a grounded Lean formalization of the STARK by @eKisNonos in https://github.com/NON-OS/microkernel/pull/338
  • feat(terminal): cooperative shell/job engine + attributed-spawn kernel support by @senseix21 in https://github.com/NON-OS/microkernel/pull/341
  • Lean: close the degree bound and pin the AIR quotient by @eKisNonos in https://github.com/NON-OS/microkernel/pull/340
  • stark: money-grade STARK over the Goldilocks extension by @eKisNonos in https://github.com/NON-OS/microkernel/pull/342
  • desktop: compositor, window manager and app runtime by @eKisNonos in https://github.com/NON-OS/microkernel/pull/344
  • fix(installer): correct SpawnBroker cap literal after bit move (0x400019 → 0x800019) by @senseix21 in https://github.com/NON-OS/microkernel/pull/350
  • fix: resolve installer & process_manager endpoint-registration collisions by @senseix21 in https://github.com/NON-OS/microkernel/pull/351
  • Hardening wave: multi-window ZeroState, std runtime, desktop, drivers, verification by @eKisNonos in https://github.com/NON-OS/microkernel/pull/349
  • verification/lean: expand the kernel proof suite and document it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/361
  • sys/sync: add a counting semaphore and a seqlock with proofs by @eKisNonos in https://github.com/NON-OS/microkernel/pull/362
  • mechanism_proofs: bind the buddy allocator arithmetic to its Lean model by @eKisNonos in https://github.com/NON-OS/microkernel/pull/363
  • verification/lean: record the mechanism_proofs code bindings by @eKisNonos in https://github.com/NON-OS/microkernel/pull/364
  • iwlwifi: 802.11 frames + host-command queue, wired into the driver by @eKisNonos in https://github.com/NON-OS/microkernel/pull/365
  • Real-hardware device bring-up: i2c-HID touchpad, i8042 keyboard, storage and USB by @eKisNonos in https://github.com/NON-OS/microkernel/pull/366
  • feat(image_viewer): image viewer capsule opened from file manager by @senseix21 in https://github.com/NON-OS/microkernel/pull/360
  • iwlwifi: MLME association and WPA2 supplicant state machines by @eKisNonos in https://github.com/NON-OS/microkernel/pull/367
  • nonos_wifi_core: shared 802.11/WPA2/CCMP driver core by @eKisNonos in https://github.com/NON-OS/microkernel/pull/368
  • Real-hardware bring-up: RTL8821CE WiFi, network stack, device drivers, desktop by @eKisNonos in https://github.com/NON-OS/microkernel/pull/370
  • STARK recursive verifier and capsule attestation gate by @eKisNonos in https://github.com/NON-OS/microkernel/pull/375
  • verification/lean: machine-checked STARK attestation model by @eKisNonos in https://github.com/NON-OS/microkernel/pull/376
  • stark: shared crate + bootloader kernel self-attestation by @eKisNonos in https://github.com/NON-OS/microkernel/pull/377
  • WiFi stack, network transport, and browser engine bring-up by @eKisNonos in https://github.com/NON-OS/microkernel/pull/379
  • Transparent post-quantum STARK attestation: the production default, enforced at both layers by @eKisNonos in https://github.com/NON-OS/microkernel/pull/378
  • Production build and docs move, plus the verification corpus, extraction, evidence and prove language by @eKisNonos in https://github.com/NON-OS/microkernel/pull/382
  • Browser: embedded QuickJS engine, faithful CSS, and framework rendering by @eKisNonos in https://github.com/NON-OS/microkernel/pull/380
  • feat(wallet): redesign capsule UI to the 1280×800 dashboard + theming, icon controls, interactions by @senseix21 in https://github.com/NON-OS/microkernel/pull/383
  • stark: preprocessed-periodic proving path by @eKisNonos in https://github.com/NON-OS/microkernel/pull/385
  • Formal verification: non-interference, confidentiality, attestation binding and fairness by @eKisNonos in https://github.com/NON-OS/microkernel/pull/386
  • feat(terminal): nox pull/push — HTTP file/folder transfer into the VFS by @senseix21 in https://github.com/NON-OS/microkernel/pull/369
  • stark: witness-mode recursion assembly and production gen by @eKisNonos in https://github.com/NON-OS/microkernel/pull/387
  • stark: parallel preprocessed-periodic commit (emit tooling) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/388
  • std PAL: run unmodified tokio on NONOS by @eKisNonos in https://github.com/NON-OS/microkernel/pull/389
  • stark: all-cores prover (bit-exact with serial) by @eKisNonos in https://github.com/NON-OS/microkernel/pull/390
  • browser: inline-block, absolute anchoring, and nowrap in box layout by @eKisNonos in https://github.com/NON-OS/microkernel/pull/391
  • browser: fetch images with Connection: close by @eKisNonos in https://github.com/NON-OS/microkernel/pull/392
  • terminal builtins and bounded driver probe by @eKisNonos in https://github.com/NON-OS/microkernel/pull/393
  • wallet: real scannable QR on the receive screen by @eKisNonos in https://github.com/NON-OS/microkernel/pull/394
  • spawn: keep the on-demand window drain from being starved by @eKisNonos in https://github.com/NON-OS/microkernel/pull/397
  • shell: show the window-launch result as a toast by @eKisNonos in https://github.com/NON-OS/microkernel/pull/398
  • wallet: size transfer fees from the live gas price by @eKisNonos in https://github.com/NON-OS/microkernel/pull/396
  • ci: reclaim runner disk before the full-image benchmark by @eKisNonos in https://github.com/NON-OS/microkernel/pull/399
  • security: fix frame aliasing, keylogging, reply injection, service squat by @eKisNonos in https://github.com/NON-OS/microkernel/pull/405
  • feat(audio): working Resonare playback, plus the kernel fixes it uncovered by @senseix21 in https://github.com/NON-OS/microkernel/pull/431
  • Fix the #405 boot regressions, add the Launchpad, and install the crates.io tool suite by @eKisNonos in https://github.com/NON-OS/microkernel/pull/430
  • Route the shared kernel through an arch boundary, and fix what was behind it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/432
  • aarch64: the kernel library compiles by @eKisNonos in https://github.com/NON-OS/microkernel/pull/433
  • aarch64 boots to userspace; signing seeds protected at rest by @eKisNonos in https://github.com/NON-OS/microkernel/pull/434
  • Nym bring-up: a mixnet session, and the network path that reaches it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/436
  • Browser: fix the element surface QuickJS hands a page, and prove the tree builder by @eKisNonos in https://github.com/NON-OS/microkernel/pull/437
  • Wi-Fi on real hardware, and three ways a build could ship the wrong thing by @eKisNonos in https://github.com/NON-OS/microkernel/pull/439
  • feat: install & launch third-party signed GUI capsules + .nonos packaging by @senseix21 in https://github.com/NON-OS/microkernel/pull/438
  • feat(desktop-shell): convert the shell to a single measured AA text path by @senseix21 in https://github.com/NON-OS/microkernel/pull/441
  • feat(display): 2560x1440 desktop over VNC and HiDPI chrome scaling by @senseix21 in https://github.com/NON-OS/microkernel/pull/443
  • feat(video-player): MJPEG AVI player capsule with baked-in sample media by @senseix21 in https://github.com/NON-OS/microkernel/pull/451
  • feat(paint): antialiased drawing primitives for PaintBuffer by @senseix21 in https://github.com/NON-OS/microkernel/pull/452
  • feat(ui): shared paint primitives, restyled shell chrome, rebuilt app window frame by @senseix21 in https://github.com/NON-OS/microkernel/pull/453
  • feat(settings): restyle the panel around a sidebar and grouped cards by @senseix21 in https://github.com/NON-OS/microkernel/pull/454
  • feat(icons): unify every OS icon behind a single source by @senseix21 in https://github.com/NON-OS/microkernel/pull/455
  • caps: bind service gates to real kernel bits by @eKisNonos in https://github.com/NON-OS/microkernel/pull/442
  • tls: check basic constraints before trusting an issuer by @eKisNonos in https://github.com/NON-OS/microkernel/pull/446
  • libc: drop the graphics wrappers the kernel no longer serves by @eKisNonos in https://github.com/NON-OS/microkernel/pull/449
  • feat(process-manager): restyle into a six-screen activity monitor by @senseix21 in https://github.com/NON-OS/microkernel/pull/456
  • feat(desktop-shell): rebuild the Launchpad around a resolved visible set by @senseix21 in https://github.com/NON-OS/microkernel/pull/459
  • arch: VT-d translation, SMP bring-up, virtio-gpu 3D by @eKisNonos in https://github.com/NON-OS/microkernel/pull/444
  • feat(capsule-snake): rebuild snake as a six-screen arcade by @senseix21 in https://github.com/NON-OS/microkernel/pull/461
  • feat(capsule-calculator): five-mode restyle by @senseix21 in https://github.com/NON-OS/microkernel/pull/462
  • abi: publish the syscalls the kernel actually dispatches by @eKisNonos in https://github.com/NON-OS/microkernel/pull/448
  • feat(text_editor): NØNOS Docs — document core, app shell, block formatting by @senseix21 in https://github.com/NON-OS/microkernel/pull/464
  • sdk: make an application declare what it may do by @eKisNonos in https://github.com/NON-OS/microkernel/pull/447
  • stark: evaluate periodic columns by the subgroup closed form by @eKisNonos in https://github.com/NON-OS/microkernel/pull/450
  • attest: export path and developer roots by @eKisNonos in https://github.com/NON-OS/microkernel/pull/445
  • stark: mount the unified engine from stark-attest by @eKisNonos in https://github.com/NON-OS/microkernel/pull/465
  • Restore networking, the browser and the desktop by @eKisNonos in https://github.com/NON-OS/microkernel/pull/460
  • build: end the build by proving what it produced by @eKisNonos in https://github.com/NON-OS/microkernel/pull/466
  • release: hand the lanes their secrets by @eKisNonos in https://github.com/NON-OS/microkernel/pull/469
  • release: every tag ships the attestation surface by @eKisNonos in https://github.com/NON-OS/microkernel/pull/468
  • feat(terminal): command blocks, real ls, neofetch and a live telemetry rail by @senseix21 in https://github.com/NON-OS/microkernel/pull/467
  • Production release gates: fix the three tag failures, make the image reproducible, ship the vendor image unbound by @eKisNonos in https://github.com/NON-OS/microkernel/pull/470
  • feat(about): redesign the About capsule into a five-section window by @senseix21 in https://github.com/NON-OS/microkernel/pull/474
  • Production builds verify the enrolled trust set instead of signing by @eKisNonos in https://github.com/NON-OS/microkernel/pull/475
  • Secondary CPUs come up for the first time, and four defects that stopped them by @eKisNonos in https://github.com/NON-OS/microkernel/pull/479
  • Desktop capsule correctness, and a measurement harness that reports the tail by @eKisNonos in https://github.com/NON-OS/microkernel/pull/476
  • i2c: a modelled DesignWare core, and three defects it caught by @eKisNonos in https://github.com/NON-OS/microkernel/pull/495
  • Remove MkSpawn, a pid-exhaustion primitive nothing called by @eKisNonos in https://github.com/NON-OS/microkernel/pull/492
  • Five published syscalls were unreachable by @eKisNonos in https://github.com/NON-OS/microkernel/pull/491
  • Sixteen features gate code that no build lane compiles by @eKisNonos in https://github.com/NON-OS/microkernel/pull/488
  • build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in https://github.com/NON-OS/microkernel/pull/352
  • Remove the halo2 verifier: unreachable, unbuildable, and the wrong security class by @eKisNonos in https://github.com/NON-OS/microkernel/pull/490
  • Five security mechanisms were compiled and switched off by @eKisNonos in https://github.com/NON-OS/microkernel/pull/493
  • build(deps): bump softprops/action-gh-release from 2.0.8 to 3.0.2 by @dependabot[bot] in https://github.com/NON-OS/microkernel/pull/440
  • build(deps): bump actions/attest-build-provenance from 2.2.0 to 4.1.1 by @dependabot[bot] in https://github.com/NON-OS/microkernel/pull/381
  • build(deps): bump actions/checkout from 4.3.1 to 7.0.1 by @dependabot[bot] in https://github.com/NON-OS/microkernel/pull/429
  • build(deps): bump smallvec from 1.15.1 to 1.15.2 by @dependabot[bot] in https://github.com/NON-OS/microkernel/pull/357
  • build(deps): bump bitflags from 2.11.1 to 2.13.1 by @dependabot[bot] in https://github.com/NON-OS/microkernel/pull/359
  • Device conformance proofs without the hardware by @eKisNonos in https://github.com/NON-OS/microkernel/pull/482
  • The attestation receipt: the entries behind the signed root, readable and checkable by @eKisNonos in https://github.com/NON-OS/microkernel/pull/481
  • Serialize proof-crate test binaries so the live device models stay scheduled by @senseix21 in https://github.com/NON-OS/microkernel/pull/499
  • Build NONOS from source the way the installer installs it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/472
  • feat(files): a real Files backend and a rebuilt interface by @senseix21 in https://github.com/NON-OS/microkernel/pull/478
  • The attestation document carries the key that signed it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/487
  • Shell store probe backoff, and the IPC round trip in bench by @eKisNonos in https://github.com/NON-OS/microkernel/pull/477
  • A QEMU lane with an IOMMU present, so the VT-d bring-up runs at all by @eKisNonos in https://github.com/NON-OS/microkernel/pull/489
  • iwlwifi: gen3 peripheral scratch structure by @eKisNonos in https://github.com/NON-OS/microkernel/pull/395
  • The ABI publishes a capability; the kernel checks one. Nothing compared them by @eKisNonos in https://github.com/NON-OS/microkernel/pull/496
  • Reply inbox names stored inline, and the runtime load stops leaking them by @eKisNonos in https://github.com/NON-OS/microkernel/pull/484
  • secp256k1, ed25519 signing and the wallet's application crypto leave ring 0 by @eKisNonos in https://github.com/NON-OS/microkernel/pull/483
  • A key only this machine can derive, and a vault the wallet keeps under it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/485
  • iommu: engage the unit, and the multiprocessor defects found behind it by @eKisNonos in https://github.com/NON-OS/microkernel/pull/498
  • Shrink-only gates, and the one that catches mechanisms nothing calls by @eKisNonos in https://github.com/NON-OS/microkernel/pull/494
  • Directory records as one layout, and same-length replacement in the store by @eKisNonos in https://github.com/NON-OS/microkernel/pull/486
  • readme: say what the system is, and give it one command to run by @eKisNonos in https://github.com/NON-OS/microkernel/pull/508
  • fix(interrupts): make a ring-0 #GP explain itself on serial by @senseix21 in https://github.com/NON-OS/microkernel/pull/514
  • fix(syscall): give STAR's SYSRET base its RPL bits by @senseix21 in https://github.com/NON-OS/microkernel/pull/524
  • fix(gdt): derive the duplicate STAR encoding from the GDT constants by @senseix21 in https://github.com/NON-OS/microkernel/pull/525
  • diag(interrupts): flag a malformed user frame on the timer return path by @senseix21 in https://github.com/NON-OS/microkernel/pull/526
  • fix(interrupts): make every fatal exception reach the serial port by @senseix21 in https://github.com/NON-OS/microkernel/pull/516
  • ci: make one boot a merge gate, and the matrix a nightly by @senseix21 in https://github.com/NON-OS/microkernel/pull/527
  • ci: build only the images the requested cells need by @senseix21 in https://github.com/NON-OS/microkernel/pull/528
  • fix(smp): stop the TLB shootdown from halting the multiprocessor boot by @senseix21 in https://github.com/NON-OS/microkernel/pull/539
  • apic: refuse an IPI before the local APIC is mapped by @eKisNonos in https://github.com/NON-OS/microkernel/pull/501
  • process: say which capsule exited non-zero, and why it panicked by @eKisNonos in https://github.com/NON-OS/microkernel/pull/502
  • block drivers: size the receive buffer for a whole write request by @eKisNonos in https://github.com/NON-OS/microkernel/pull/500
  • mk: scope the swtpm teardown, and sequence the iommu lane's ESP by @eKisNonos in https://github.com/NON-OS/microkernel/pull/529
  • services: allowlist runtime registration instead of denylisting names by @eKisNonos in https://github.com/NON-OS/microkernel/pull/534
  • security: log what the image ceiling would refuse by @eKisNonos in https://github.com/NON-OS/microkernel/pull/536
  • security: replace the secure boot anchors by @eKisNonos in https://github.com/NON-OS/microkernel/pull/537
  • keyring: fail the build on a repeated opcode by @eKisNonos in https://github.com/NON-OS/microkernel/pull/541
  • inflate: decode every gzip member by @eKisNonos in https://github.com/NON-OS/microkernel/pull/543
  • ci: one run per branch instead of two by @eKisNonos in https://github.com/NON-OS/microkernel/pull/550
  • aes: a software AES-128, and the vectors that say it is one by @eKisNonos in https://github.com/NON-OS/microkernel/pull/548
  • crypto: the PKCS#1 signature shape a directory protocol uses by @eKisNonos in https://github.com/NON-OS/microkernel/pull/547
  • process: run foreign binaries without teaching the kernel about them by @eKisNonos in https://github.com/NON-OS/microkernel/pull/506
  • audio: one wire format, and the two sounds the desktop never made by @eKisNonos in https://github.com/NON-OS/microkernel/pull/540
  • linux: give a guest the filesystem it expects by @eKisNonos in https://github.com/NON-OS/microkernel/pull/509
  • tls: a streaming client, and the alert a peer sends when it refuses by @eKisNonos in https://github.com/NON-OS/microkernel/pull/538
  • linux: run a dynamically linked program by @eKisNonos in https://github.com/NON-OS/microkernel/pull/510
  • process: purge the reap log too when a pid is reused by @eKisNonos in https://github.com/NON-OS/microkernel/pull/533
  • toolkit: derive the chrome palette, and prove it stays legible by @eKisNonos in https://github.com/NON-OS/microkernel/pull/549
  • memory: flush the asid that was written, not the active one by @eKisNonos in https://github.com/NON-OS/microkernel/pull/530
  • ci: skip production-build on dependabot PRs by @senseix21 in https://github.com/NON-OS/microkernel/pull/552
  • linux: threads, and a futex that needs nothing from the kernel by @eKisNonos in https://github.com/NON-OS/microkernel/pull/511
  • process: count what the kernel actually does, per process and in total by @eKisNonos in https://github.com/NON-OS/microkernel/pull/503
  • process manager: real numbers, and a layout that can show them by @eKisNonos in https://github.com/NON-OS/microkernel/pull/504
  • Every kernel entry point moves into assembly, and the installer arrives as one by @eKisNonos in https://github.com/NON-OS/microkernel/pull/471
  • nym: check the replay window on the live receive path by @eKisNonos in https://github.com/NON-OS/microkernel/pull/542
  • usercopy: bound the whole table page, fail on truncated strings by @eKisNonos in https://github.com/NON-OS/microkernel/pull/531
  • fix(inflate): verify gzip member trailers by @senseix21 in https://github.com/NON-OS/microkernel/pull/557
  • git: object model, packfiles, clone and push over https by @eKisNonos in https://github.com/NON-OS/microkernel/pull/435
  • fix(idt): hand interrupt_dispatch the frame, not the saved ds slot by @senseix21 in https://github.com/NON-OS/microkernel/pull/553
  • fix(aes): constant-time s-box by @senseix21 in https://github.com/NON-OS/microkernel/pull/554
  • fix(accounting): keep the idle and tick-origin flags per CPU by @senseix21 in https://github.com/NON-OS/microkernel/pull/555
  • fix(foreign): tear down the parked thread when registry insert fails by @senseix21 in https://github.com/NON-OS/microkernel/pull/556
  • install: write the running system to a disk by @eKisNonos in https://github.com/NON-OS/microkernel/pull/505
  • fix(terminal): open the window without waiting on vfs by @senseix21 in https://github.com/NON-OS/microkernel/pull/558
  • crypto: take the zk scalar field's order from ed25519 by @senseix21 in https://github.com/NON-OS/microkernel/pull/560
  • abi: fail the caps check closed and publish the hardware gates by @senseix21 in https://github.com/NON-OS/microkernel/pull/561
  • linux: finish the stack (#532 #535 #512 + install queue) by @senseix21 in https://github.com/NON-OS/microkernel/pull/559
  • capabilities: generate the enum, bit and all from one list by @eKisNonos in https://github.com/NON-OS/microkernel/pull/532
  • syscall: give local signing a capability a capsule can hold by @eKisNonos in https://github.com/NON-OS/microkernel/pull/535
  • fix(sched): boost init with interrupts masked by @senseix21 in https://github.com/NON-OS/microkernel/pull/562
  • fix(rsa): verify pkcs1 v1.5 by exact re-encoding by @senseix21 in https://github.com/NON-OS/microkernel/pull/563
  • verification: Lean 4 over the boundaries, the live holes and the hardware paths by @eKisNonos in https://github.com/NON-OS/microkernel/pull/565
  • verification: prove the constant-time comparison primitives correct for every pair of words by @eKisNonos in https://github.com/NON-OS/microkernel/pull/568
  • crypto, memory: one constant-time compare, and align_up never returns less by @eKisNonos in https://github.com/NON-OS/microkernel/pull/569
  • verification: follow the two fixes that #569 made under the extracted code by @eKisNonos in https://github.com/NON-OS/microkernel/pull/572
  • verification: grow Lean coverage, extract 558 more functions, fix what the proofs found by @eKisNonos in https://github.com/NON-OS/microkernel/pull/590
  • Lean verification: prove 164 more functions and fix the kernel bugs the proofs found by @eKisNonos in https://github.com/NON-OS/microkernel/pull/591
  • NONOS 0.9.2: the daily driver release by @eKisNonos in https://github.com/NON-OS/microkernel/pull/601
  • ci(benchmark): build the capsule set through the flake so provisioning stops timing out by @eKisNonos in https://github.com/NON-OS/microkernel/pull/603
  • tcb(x86_64): raise ring-0 budget for the ACPI, NVMe and cryptoblock work by @eKisNonos in https://github.com/NON-OS/microkernel/pull/604
  • interrupts: retire the IDT under arch::x86_64::idt that nothing loads by @senseix21 in https://github.com/NON-OS/microkernel/pull/616

  New Contributors

  • @dependabot[bot] made their first contribution in https://github.com/NON-OS/microkernel/pull/352

  Full Changelog: https://github.com/NON-OS/microkernel/commits/v0.9.2

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    0 downloads

  ---

  • BLAKE3SUMS
    0 downloads · 2026-10-10 14:37:09 -04:00 · 588 B
  • BUNDLE-BLAKE3SUMS
    0 downloads · 2026-10-10 14:37:09 -04:00 · 66 KiB
  • BUNDLE-SHA256SUMS
    0 downloads · 2026-10-10 14:37:10 -04:00 · 66 KiB
  • SHA256SUMS
    1 download · 2026-10-10 14:37:21 -04:00 · 588 B
  • nonos-build.json
    0 downloads · 2026-10-10 14:37:11 -04:00 · 28 KiB
  • nonos-release-bundle.tar.gz
    0 downloads · 2026-10-10 14:37:19 -04:00 · 176 MiB
  • nonos.cdx.json
    0 downloads · 2026-10-10 14:37:20 -04:00 · 236 KiB
  • provenance.json
    0 downloads · 2026-10-10 14:37:20 -04:00 · 173 KiB
  • verifier.wasm
    0 downloads · 2026-10-10 14:37:21 -04:00 · 221 KiB