Three layers. No new trust.
Everything you touch reduces to a kernel whose every transition is checked. Authority is something you show, never something you claim.
Everything a human or AI agent touches: cap-confined surfaces, the web-of-cells, rehydratable snapshots. A window is a Cap{ Surface(cell), rights }. Progressive enhancement becomes progressive attenuation. Enter the surface →
The object-capability core. One sentence carries it: a turn is the exercise of an attenuable, proof-carrying token over owned state, leaving a verifiable receipt. The kernel this site describes is the executor the node runs — the same file, in your browser.
One capability across a distance parameter. At n=1 it collapses to strong-local: immediate revocation, synchronous commit. On the network it flows to distributed with no seam. Read the substrate →
Three things only this substrate can do
Not features ported from elsewhere — categories that require an object-capability substrate with a verifiable history at once.
A surface is the authority: a typed bundle of cap-gated affordances. An unauthorized action is refused in-band by the required ⊆ held gate, not by app good behaviour. Anti-cheat is free, because the cheat is unrepresentable.
A snapshot is a paused camera on a witnessed scene: it embeds a sturdyref behind a membrane. Two people open "the same" image and rehydrate two different, per-viewer, attenuated views. What you shared was never the pixels — it was the revocable right to renegotiate.
An seL4 capability and a NULLIUS capability are the same abstraction at two points on a distance parameter n. The bounds relax along n with no seam — same handle, same attenuate / delegate / invoke.
Cells · turns · receipts
Everything above rests on three objects. And on the visibility rule that makes privacy physics: you cannot read what you do not hold the capability for. Hover to reveal what your capability authorizes.
A cell holds balances, capabilities and named slots — plus a predicate over its own transitions the substrate enforces on every change. Nothing is ownerless. "A budget that cannot be exceeded" is just a cell whose predicate says so.
An atomic batch of actions, ed25519-signed by its actor. Each presents a capability — narrowable but never amplifiable — and discharges every guard in scope. The whole turn commits or none of it does. Lineage: macaroons → biscuit → the proof system.
A committed turn leaves Q — a receipt binding the entire post-state, with no field a tamperer can edit. Receipts chain by hash; a light client verifies a whole history by checking the chain, re-executing nothing and trusting no executor.
A light client cannot be fooled
Five properties a stranger learns by running the smallest possible check. The foil has a name — the pale ghost, a server presenting a state it never legitimately produced. It cannot pass.
Every state change is justified by an unforgeable, non-amplified, fresh token chain.
floor: ed25519 (the signature on each handoff), HMAC (caveat-chain tags). Enforced in this kernel — forge one in the playground.
Per asset, the resource sum is identically zero — value only moves, never appears.
floor: integer arithmetic. Mints are issuer moves from a well cell that goes negative, so Σ = 0 by construction. Enforced.
A receipt binds the whole post-state; a tampered field is rejected.
floor: SHA-256 collision-resistance (standing in for Poseidon2). Edit any field and the commitment no longer opens. The explorer flags it.
No replay, no double-spend; a committed spend's nonce was fresh.
floor: a per-actor nullifier set. Replay a spent turn and it is refused. Enforced.
A light client verifying a receipt chain learns A–D for the whole history; re-executing nothing.
floor: hash-chain soundness (standing in for FRI/STARK recursion), ed25519. verifyHistory() runs client-side.
Apps where the security property is the feature
Fog of war is the membrane's per-viewer projection. To see a side's tiles you must hold the capability; a player holding only its own secret cannot construct the enemy's vision. Every move is a cap-gated verified turn.
Reads are free SQL; writes are verified turns. A row's policy calls null_admits(token,'read',id) — the same decision the kernel makes, from the same capability token. Attenuation and revocation that RLS structurally can't express.
A line of credit is an attenuated capability (an over-line draw is refused). An encrypted group is one whose membership is physics. Each is an SDK noun on the same executor — no new kernel entry.
The token of the NULLIUS substrate on Solana. Take nobody's word for it — including ours. The kernel is open and runs in your browser; verify before you believe.
Touch it in five minutes
The devnet is the same node the repo builds. Ask what produces its state, then faucet a cell:
curl -s nulliussol.xyz/status
# → state_producer:"lean"
curl -s -X POST nulliussol.xyz/api/faucet \
-d '{"recipient":"cell:me","amount":1000}'
curl -s nulliussol.xyz/api/cell/cell:meThe playground runs the real executor in your browser. Stage a transfer, then overdraw, replay, or forge a capability and watch the substrate refuse you — no server round-trip for the decision. Then open the explorer and scrub any cell's history backward. Time travel is just reading receipts, because the receipts are the history.