This is the exact proof the NONOS bootloader verifies before it jumps to the kernel, run here in the same gate, compiled to WebAssembly. The root below is the one baked into the boot chain; the trailer is the one shipped with the image. Transparent, post-quantum, no trusted setup. It verifies in your browser, and nothing is sent anywhere.
The WebAssembly here is not a demonstration. It is the same
verify_attestation_trailer the kernel runs at every process
spawn and the bootloader runs before the jump, built from
NON-OS/stark-attest.
A green verdict proves the trailer is a valid STARK membership proof under
this root, bound to this context, at the parameters compiled into the
verifier.
It does not prove the kernel you downloaded is that member. That link is
the BLAKE3 measurement shown above: check it against a release with
b3sum. A verification page that overstates what it verifies
teaches the wrong habit.
The verifier is 90 KB of WebAssembly, reproducible from source:
cargo build --release --target wasm32-unknown-unknown \ -p stark-attest-verifier-wasm
The red button flips the last bit of the proof and verifies again, so the refusal can be watched rather than taken on faith. Acceptance and rejection cost the same.