The NullKernel: A Kernel Architecture with an Empty Trust Surface

We present the NullKernel, a kernel architecture in which the trusted computing base (TCB) contains no policy-making components. We prove that hardware capability enforcement is sufficient to guarantee system security without a trusted kernel mediating access to resources. In this model, the kernel’s legitimate function reduces to two policy-free primitives: capability assertion, which determines whether a domain holds authority for an effect, and privileged execution, which performs the instructions that hardware restricts to ring 0. All other operating system functionality — including scheduling, memory allocation, fault resolution, IPC, and device management — is shown to be outside the necessary trust boundary. The result is an architecture in which the TCB is defined by hardware alone, and every software component above it is untrusted by construction and capability-constrained by enforcement. We formalize this claim, prove a trust-surface minimality theorem, and discuss a prototype implementation on commodity x86-64 hardware that demonstrates the realizability of a complete OS stack above a NullKernel. This is an exploratory preprint; the architecture and proofs are under active refinement and feedback is welcome.