feat(netsurf): NetSurf-on-NONOS foundation — toolchain, relibc Pal, capsule ops, display de-risk gate

.gitignore

@@ -88,3 +88,6 @@ CONTEXT.md
 .continue/
 .superpowers/
 
+
+# nonos C sysroot (build artifact of toolchain/nonos-c/build-sysroot.sh)
+toolchain/nonos-c/sysroot/

Cargo.toml

@@ -66,6 +66,10 @@ sched = []
 # below maps 1:1 to a capsule directory under `userland/`.
 nonos-capsule-proof-io          = []
 nonos-capsule-std-proof         = []
+nonos-capsule-c-proof           = []
+nonos-capsule-relibc-test       = []
+nonos-capsule-c-net             = []
+nonos-capsule-nsfb-probe        = []
 nonos-capsule-ripgrep           = []
 nonos-capsule-ramfs             = []
 nonos-capsule-wallpaper         = []
@@ -212,6 +216,77 @@ microkernel-ramfs = [
   "nonos-capsule-ramfs",
 ]
 
+microkernel-c-proof = [
+  "microkernel-core",
+  "nonos-production",
+  "nonos-capsule-proof-io",
+  "nonos-capsule-c-proof",
+]
+
+# Temporary unverified boot proof of the clang/relibc C capsule: spawns
+# c_proof via the legacy unverified path (no ZK attestation) while the
+# capsule-attestation NZKCAPS2 migration is owned elsewhere. Superseded by
+# microkernel-c-proof once a valid c_proof trailer is available.
+microkernel-c-proof-smoketest = [
+  "microkernel-core",
+  "nonos-dev-unverified-capsules",
+  "nonos-capsule-c-proof",
+]
+
+# Phase-4 framebuffer probe (verified path). Brings up the compositor
+# and the virtio-gpu driver so a real framebuffer exists, then spawns
+# nsfb_probe which registers a surface, reads OP_DISPLAY_INFO, paints a
+# gradient, and presents it.
+microkernel-nsfb-probe = [
+  "microkernel-core",
+  "nonos-production",
+  "nonos-capsule-proof-io",
+  "nonos-capsule-compositor",
+  "nonos-capsule-driver-virtio-gpu",
+  "nonos-capsule-nsfb-probe",
+]
+
+# Unverified smoke build of the framebuffer probe: spawns nsfb_probe via
+# the legacy path while the NZKCAPS2 migration is owned elsewhere. The
+# compositor + virtio-gpu carry real ZK trailers that the always-on
+# transparent verifier would reject, so `nonos-zk-rollout` keeps a stale
+# trailer non-fatal — the same reason the cnet/relibc smoketests set it.
+microkernel-nsfb-probe-smoketest = [
+  "microkernel-core",
+  "nonos-dev-unverified-capsules",
+  "nonos-zk-rollout",
+  "nonos-capsule-compositor",
+  "nonos-capsule-driver-virtio-gpu",
+  "nonos-capsule-nsfb-probe",
+]
+
+microkernel-relibc-test-smoketest = [
+  "microkernel-core",
+  "nonos-dev-unverified-capsules",
+  "nonos-zk-rollout",
+  "nonos-capsule-proof-io",
+  "nonos-capsule-ramfs",
+  "nonos-capsule-vfs",
+  "nonos-capsule-relibc-test",
+]
+
+microkernel-cnet-smoketest = [
+  "microkernel-core",
+  "nonos-dev-unverified-capsules",
+  "nonos-zk-rollout",
+  "nonos-capsule-proof-io",
+  "nonos-capsule-driver-virtio-net",
+  "nonos-capsule-net-l2",
+  "nonos-capsule-net-ip",
+  "nonos-capsule-net-udp",
+  "nonos-capsule-net-dhcp",
+  "nonos-capsule-net-tcp",
+  "nonos-capsule-net-dns",
+  "nonos-capsule-net-sockets",
+  "nonos-capsule-net-nym",
+  "nonos-capsule-c-net",
+]
+
 microkernel-keyring = [
   "microkernel-core",
   "nonos-production",

Makefile

@@ -534,6 +534,10 @@ nonos-mk-trust-policy: $(NONOS_TRUST_ANCHOR_POLICY_BIN)
 #   nonos-mk-check-<slug>-keys assert publisher seeds + pubs exist
 include userland/capsule_proof_io/Capsule.mk
 include userland/capsule_std_proof/Capsule.mk
+include userland/capsule_c_proof/Capsule.mk
+include userland/capsule_relibc_test/Capsule.mk
+include userland/capsule_c_net/Capsule.mk
+include userland/capsule_nsfb_probe/Capsule.mk
 include userland/capsule_ripgrep/Capsule.mk
 include userland/capsule_ramfs/Capsule.mk
 include userland/capsule_keyring/Capsule.mk
@@ -809,6 +813,72 @@ nonos-mk-std-proof-prod: $(proof-io_ARTIFACTS) $(std-proof_ARTIFACTS) nonos-mk-c
 		$(CARGO) build $(KERNEL_BUILD_FLAGS) \
 		--no-default-features --features microkernel-proof-io,nonos-capsule-std-proof
 
+.PHONY: nonos-mk-cproof-prod nonos-mk-boot-cproof nonos-mk-cproof-test
+nonos-mk-cproof-prod: $(proof-io_ARTIFACTS) $(c-proof_ARTIFACTS) \
+		nonos-mk-check-deps nonos-mk-ensure-signing-key
+	@echo "Building kernel (microkernel-c-proof)..."
+	@$(SDK_FLAGS) NONOS_SIGNING_KEY=$(KERNEL_SIGNING_KEY) \
+		RUSTUP_TOOLCHAIN=$(TOOLCHAIN) \
+		$(CARGO) build $(KERNEL_BUILD_FLAGS) \
+		--no-default-features --features microkernel-c-proof
+
+nonos-mk-boot-cproof:
+	@./tests/boot/cproof.sh
+
+nonos-mk-cproof-test: nonos-mk-boot-cproof
+
+.PHONY: nonos-mk-cproof-smoke-prod nonos-mk-cproof-smoke-test
+nonos-mk-cproof-smoke-prod: $(c-proof_ARTIFACTS) \
+		nonos-mk-check-deps nonos-mk-ensure-signing-key
+	@echo "Building kernel (microkernel-c-proof-smoketest, unverified)..."
+	@$(SDK_FLAGS) NONOS_SIGNING_KEY=$(KERNEL_SIGNING_KEY) \
+		RUSTUP_TOOLCHAIN=$(TOOLCHAIN) \
+		$(CARGO) build $(KERNEL_BUILD_FLAGS) \
+		--no-default-features --features microkernel-c-proof-smoketest
+
+nonos-mk-cproof-smoke-test:
+	@CPROOF_PROD_TARGET=nonos-mk-cproof-smoke-prod ./tests/boot/cproof.sh
+
+.PHONY: nonos-mk-relibc-smoke-prod nonos-mk-relibc-smoke-test
+nonos-mk-relibc-smoke-prod: $(relibc-test_ARTIFACTS) \
+		nonos-mk-check-deps nonos-mk-ensure-signing-key
+	@echo "Building kernel (microkernel-relibc-test-smoketest, unverified)..."
+	@$(SDK_FLAGS) NONOS_SIGNING_KEY=$(KERNEL_SIGNING_KEY) \
+		RUSTUP_TOOLCHAIN=$(TOOLCHAIN) \
+		$(CARGO) build $(KERNEL_BUILD_FLAGS) \
+		--no-default-features --features microkernel-relibc-test-smoketest
+
+nonos-mk-relibc-smoke-test:
+	@CPROOF_PROD_TARGET=nonos-mk-relibc-smoke-prod ./tests/boot/relibc.sh
+
+.PHONY: nonos-mk-cnet-smoke-prod nonos-mk-cnet-smoke-test
+nonos-mk-cnet-smoke-prod: $(proof-io_ARTIFACTS) $(driver-virtio-net_ARTIFACTS) \
+		$(net-l2_ARTIFACTS) $(net-ip_ARTIFACTS) $(net-udp_ARTIFACTS) \
+		$(net-dhcp_ARTIFACTS) $(net-tcp_ARTIFACTS) $(net-dns_ARTIFACTS) \
+		$(net-sockets_ARTIFACTS) $(net-nym_ARTIFACTS) $(c-net_ARTIFACTS) \
+		nonos-mk-check-deps nonos-mk-ensure-signing-key
+	@echo "Building kernel (microkernel-cnet-smoketest, unverified)..."
+	@$(SDK_FLAGS) NONOS_SIGNING_KEY=$(KERNEL_SIGNING_KEY) \
+		RUSTUP_TOOLCHAIN=$(TOOLCHAIN) \
+		$(CARGO) build $(KERNEL_BUILD_FLAGS) \
+		--no-default-features --features microkernel-cnet-smoketest
+
+nonos-mk-cnet-smoke-test:
+	@CNET_PROD_TARGET=nonos-mk-cnet-smoke-prod ./tests/boot/cnet.sh
+
+.PHONY: nonos-mk-nsfbprobe-smoke-prod nonos-mk-nsfbprobe-smoke-test
+nonos-mk-nsfbprobe-smoke-prod: $(compositor_ARTIFACTS) \
+		$(driver-virtio-gpu_ARTIFACTS) $(nsfb-probe_ARTIFACTS) \
+		nonos-mk-check-deps nonos-mk-ensure-signing-key
+	@echo "Building kernel (microkernel-nsfb-probe-smoketest, unverified)..."
+	@$(SDK_FLAGS) NONOS_SIGNING_KEY=$(KERNEL_SIGNING_KEY) \
+		RUSTUP_TOOLCHAIN=$(TOOLCHAIN) \
+		$(CARGO) build $(KERNEL_BUILD_FLAGS) \
+		--no-default-features --features microkernel-nsfb-probe-smoketest
+
+nonos-mk-nsfbprobe-smoke-test:
+	@NSFBPROBE_PROD_TARGET=nonos-mk-nsfbprobe-smoke-prod ./tests/boot/nsfbprobe.sh
+
 nonos-mk-ramfs-prod: $(proof-io_ARTIFACTS) $(ramfs_ARTIFACTS) \
 		nonos-mk-check-deps nonos-mk-ensure-signing-key
 	@echo "Building kernel (microkernel-ramfs)..."

src/userspace/capsule_c_net/embed.rs

@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+#[cfg(feature = "nonos-capsule-c-net")]
+pub(crate) const C_NET_ELF: &[u8] = include_bytes!(
+    "../../../userland/capsule_c_net/target/x86_64-nonos-user/release/c_net"
+);
+
+#[cfg(feature = "nonos-capsule-c-net")]
+pub(crate) const C_NET_NONOS_ID_CERT_BYTES: &[u8] =
+    include_bytes!("../../../nonos-data/trust/capsules/c_net.nonos_id_cert.bin");
+
+#[cfg(feature = "nonos-capsule-c-net")]
+pub(crate) const C_NET_MANIFEST_BYTES: &[u8] =
+    include_bytes!("../../../nonos-data/trust/capsules/c_net.manifest.bin");
+
+#[cfg(feature = "nonos-capsule-c-net")]
+pub(crate) const C_NET_ATTESTATION_BYTES: &[u8] =
+    include_bytes!("../../../nonos-data/trust/capsules/c_net.zk_trailer.bin");
+
+#[cfg(not(feature = "nonos-capsule-c-net"))]
+pub(crate) const C_NET_ELF: &[u8] = &[];
+
+#[cfg(not(feature = "nonos-capsule-c-net"))]
+pub(crate) const C_NET_NONOS_ID_CERT_BYTES: &[u8] = &[];
+
+#[cfg(not(feature = "nonos-capsule-c-net"))]
+pub(crate) const C_NET_MANIFEST_BYTES: &[u8] = &[];
+
+#[cfg(not(feature = "nonos-capsule-c-net"))]
+pub(crate) const C_NET_ATTESTATION_BYTES: &[u8] = &[];

src/userspace/capsule_c_net/mod.rs

@@ -0,0 +1,20 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+mod embed;
+mod spawn;
+
+pub use spawn::spawn_c_net_capsule;

src/userspace/capsule_c_net/spawn.rs

@@ -0,0 +1,84 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+use super::embed::C_NET_ELF;
+#[cfg(not(feature = "nonos-dev-unverified-capsules"))]
+use super::embed::{
+    C_NET_ATTESTATION_BYTES, C_NET_MANIFEST_BYTES, C_NET_NONOS_ID_CERT_BYTES,
+};
+use crate::capabilities::Capability;
+use crate::kernel_core::process_spawn::capsule_spawn::{self, SpawnError};
+#[cfg(not(feature = "nonos-dev-unverified-capsules"))]
+use crate::kernel_core::process_spawn::capsule_spawn::CapsuleSpecVerified;
+#[cfg(feature = "nonos-dev-unverified-capsules")]
+use crate::kernel_core::process_spawn::capsule_spawn::CapsuleSpec;
+#[cfg(not(feature = "nonos-dev-unverified-capsules"))]
+use crate::security::nonos_id_cert::IdCertVerifyError;
+#[cfg(not(feature = "nonos-dev-unverified-capsules"))]
+use crate::security::nonos_trust_anchor::{
+    decode as decode_trust_anchor, BAKED_TRUST_ANCHOR_POLICY,
+};
+
+const SERVICE_NAME: &str = "c_net";
+const SERVICE_PORT: u32 = 4508;
+const REPLY_INBOX: &str = "endpoint.c_net.reply";
+const REPLY_PORT: u32 = 4509;
+#[cfg(not(feature = "nonos-dev-unverified-capsules"))]
+const TARGET_TRIPLE: &str = "x86_64-nonos-user";
+
+fn requested_caps() -> u64 {
+    Capability::CoreExec.bit()
+        | Capability::IPC.bit()
+        | Capability::Memory.bit()
+        | Capability::Debug.bit()
+}
+
+#[cfg(not(feature = "nonos-dev-unverified-capsules"))]
+pub fn spawn_c_net_capsule() -> Result<(), SpawnError> {
+    let trust_anchor = decode_trust_anchor(BAKED_TRUST_ANCHOR_POLICY)
+        .map_err(|_| SpawnError::NonosIdCertRejected(IdCertVerifyError::TrustAnchorPolicy))?;
+
+    let spec = CapsuleSpecVerified {
+        name: SERVICE_NAME,
+        service_port: SERVICE_PORT,
+        reply_inbox: REPLY_INBOX,
+        reply_port: REPLY_PORT,
+        elf: C_NET_ELF,
+        nonos_id_cert_bytes: C_NET_NONOS_ID_CERT_BYTES,
+        manifest_bytes: C_NET_MANIFEST_BYTES,
+        attestation_trailer: C_NET_ATTESTATION_BYTES,
+        target_triple: TARGET_TRIPLE,
+        requested_caps: requested_caps(),
+        debug_tag: b"",
+    };
+    capsule_spawn::spawn_verified(&spec, &trust_anchor, None)?;
+    Ok(())
+}
+
+#[cfg(feature = "nonos-dev-unverified-capsules")]
+pub fn spawn_c_net_capsule() -> Result<(), SpawnError> {
+    let spec = CapsuleSpec {
+        name: SERVICE_NAME,
+        service_port: SERVICE_PORT,
+        reply_inbox: REPLY_INBOX,
+        reply_port: REPLY_PORT,
+        elf: C_NET_ELF,
+        caps_bits: requested_caps(),
+        debug_tag: b"",
+    };
+    capsule_spawn::spawn(&spec)?;
+    Ok(())
+}

src/userspace/capsule_c_proof/embed.rs

@@ -0,0 +1,44 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+#[cfg(feature = "nonos-capsule-c-proof")]
+pub(crate) const C_PROOF_ELF: &[u8] = include_bytes!(
+    "../../../userland/capsule_c_proof/target/x86_64-nonos-user/release/c_proof"
+);
+
+#[cfg(feature = "nonos-capsule-c-proof")]
+pub(crate) const C_PROOF_NONOS_ID_CERT_BYTES: &[u8] =
+    include_bytes!("../../../nonos-data/trust/capsules/c_proof.nonos_id_cert.bin");
+
+#[cfg(feature = "nonos-capsule-c-proof")]
+pub(crate) const C_PROOF_MANIFEST_BYTES: &[u8] =
+    include_bytes!("../../../nonos-data/trust/capsules/c_proof.manifest.bin");
+
+#[cfg(feature = "nonos-capsule-c-proof")]
+pub(crate) const C_PROOF_ATTESTATION_BYTES: &[u8] =
+    include_bytes!("../../../nonos-data/trust/capsules/c_proof.zk_trailer.bin");
+
+#[cfg(not(feature = "nonos-capsule-c-proof"))]
+pub(crate) const C_PROOF_ELF: &[u8] = &[];
+
+#[cfg(not(feature = "nonos-capsule-c-proof"))]
+pub(crate) const C_PROOF_NONOS_ID_CERT_BYTES: &[u8] = &[];
+
+#[cfg(not(feature = "nonos-capsule-c-proof"))]
+pub(crate) const C_PROOF_MANIFEST_BYTES: &[u8] = &[];
+
+#[cfg(not(feature = "nonos-capsule-c-proof"))]
+pub(crate) const C_PROOF_ATTESTATION_BYTES: &[u8] = &[];

src/userspace/capsule_c_proof/mod.rs

@@ -0,0 +1,20 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+mod embed;
+mod spawn;
+
+pub use spawn::spawn_c_proof_capsule;