NULLIUS: a verified
object-capability substrate

A window is a capability. This note sketches the substrate that makes the claim mean something, and points at the running code that demonstrates it.

We present NULLIUS, an object-capability kernel whose entire semantics reduce to three objects — cells, turns, receipts — and whose every state change is an atomic, capability-gated, signed turn leaving a hash-chained receipt. Authority is unforgeable and attenuable but never amplifiable (a macaroon/biscuit tag chain); value is conserved by construction (mints are issuer moves); integrity is a domain-tagged commitment binding the whole post-state; freshness is a per-actor nullifier set; and a light client verifies an entire history by re-checking the receipt chain, re-executing nothing and trusting no executor. In a full deployment the executor is machine-checked in Lean, emits STARK circuits, and boots as a protection domain on the seL4 microkernel. This implementation reproduces the kernel and its light client as one executor that runs identically in a node and in the browser, and marks the formal-verification and microkernel layers as represented.

▶ Read the seven-rung walkthrough
§1
The inversion

Ambient authority vs. capabilities. Why "a window is a session" is the bug and "a window is a capability" is the fix.

§2
Cells and predicates

State behind its own program. Solvent cells, budget cells, and the enforced transition relation.

§3
Turns and atomicity

All-or-nothing commit; the signed body; per-leg guard discharge; the void-on-any-failure rule.

§4
Capabilities

The HMAC tag chain; attenuation as restricting caveats; effective rights = root ∩ caveats.

§5
Receipts & the light client

Domain-tagged commitments, prevHash pinning, monotone sequence, unfoolability against the pale ghost.

§6
Local to global

One capability across a distance parameter; the n=1 collapse to strong-local; the substrate on seL4.

Lineage

Mark S. Miller. Robust Composition. The object-capability model.
Birgisson et al. Macaroons: Cookies with Contextual Caveats. The attenuable bearer token capabilities descend from.
biscuit-auth. Biscuit. Datalog-caveated capability tokens generalising macaroons.
Klein et al. seL4: Formal Verification of an OS Kernel. The verified microkernel the substrate boots on.
Ben-Sasson et al. Scalable, transparent (STARK) arguments. The recursion the light client's unfoolability rests on.
NULLIUS is a working object-capability substrate. The running kernel is original code; the design and assurance framing draw on the lineage above. AGPL-3.0-or-later.