Attestation surface · transparent · post-quantum
Every part of the OS,proven in your browser.
The bootloader, the kernel and every capsule of the shipping image, – units in all, each carrying a STARK proof of membership under a published root, each bound to the exact capabilities it was granted. The verifier below is nox_verify, the one the bootloader and kernel gates link, compiled to WebAssembly. Nothing leaves this page.
- –attestations
- 0verified here
- –median verify
- 3trees refolded
epoch – · three trees of depth 8 · Poseidon over Goldilocks · FRI folding by 8 · no trusted setup
Fixture proofs, not the OS. These are the pinned test proofs from NON-OS/STARKs, verified by the new verifier. The shipping kernel, bootloader and capsules appear here once their enrollment emits v4 trailers.
The policy tree · live
One root, 256 slots, and nothing else in them.
Every slot of the tree is drawn here. The members are the 115 enrolled capsules of 0.9.2; every other slot is padding drawn from the seed the transcript publishes, and this page recomputes each one when it refolds the root. As you verify, each member’s slot lights.
The boot chain, from the artifacts themselves.
No fixture stands on the trust path here. The shipping kernel image carries its proof in its own footer; the bootloader binary carries the root it enforces. This page parses the footer, measures the 90 MiB kernel body in WebAssembly, extracts the root from inside the EFI, and closes the chain. Drop your own downloaded copies, or run it on the bundled ones.
Every unit · one proof each
The whole system, one row at a time.
| Unit | Kind | Capabilities bound in the proof | BLAKE3 | Proof | Status |
|---|
What a green verdict proves
That this unit's proof is a valid STARK membership proof under the root above, bound to exactly the measurement, capability word and epoch shown on its row. The nine public words are rebuilt on this page from the values on this screen, so what verifies is precisely what you read; a served file cannot bind anything else. Any answer from the verifier other than a pass, a fault included, is a refusal.
The WebAssembly is nox_verify, the verifier the bootloader and kernel gates link, built from NON-OS/STARKs and reproducible bit for bit. Zero knowledge hides the slot's position and its siblings inside the proof; the trailer carries the plain path next to it, the gates check both, and this page draws the path from that part.
It does not prove the binary you run is this one. That link is the BLAKE3 column, which you check with b3sum against a downloaded release. A capability listed here is one the proof itself binds, not a line in a configuration file.
The parameters
Width-8 Poseidon at 32 rounds with the x⁷ S-box over Goldilocks. Round constants are derived from a public rule and re-derived independently in CI on every push; the diffusion matrix is a Cauchy matrix, MDS by theorem rather than by search. FRI folds by eight. The path check rests on Poseidon's collision resistance and the proof's soundness on the claim of the STARKs repository; no proof in the kernel tree covers either, and this page says so rather than print a figure for it. There are no elliptic curves anywhere in the construction.
- hash
- Poseidon, width 8, 32 rounds, x⁷, Goldilocks
- FRI
- folding by 8; each proof names its parameter id in its own header, shown when you inspect a row
- trees
- three of depth 8, 256 slots each: the capsule policy tree, the kernel tree and the bootloader tree
- soundness
- the STARKs repository's claim, stated there, not re-proved here
- zero knowledge
- the slot's position and siblings are hidden; each proof carries its certificate
- verifier
- nox_verify, the gates' own, compiled to WebAssembly