All the ethical ambiguity of AI-powered clean room reimplementation, but you run it yourself. No cute marketing site. No fake testimonials from "Dr. Heinrich Offshore." No offshore subsidiaries. Just a Rust binary, your API keys, a real process boundary, and whatever you tell your lawyers.
Apparently "free as in freedom" doesn't mean "free as in do whatever you want and pretend you wrote it." Who knew.
One careless npm install and suddenly your proprietary SaaS must disclose its source. Your investors
are calling. Your lawyers are crying. Your quarterly report is weeping.
Keeping track of 2,000+ transitive dependencies and their license terms? That's not engineering, that's archaeology. And your compliance team bills by the hour.
Some licenses require you to share your improvements. Your board didn't raise $40M in Series B so you could give code to strangers on the internet.
Third-party audits. License scanners. Legal reviews. All so you can use a left-pad function some maintainer wrote in eleven lines.
Malus showed the world this was possible. PHALUS lets you do it in your basement.
Two AI agents. One fail-closed boundary. No runtime source-code handoff. Legal precedent since 1984.
Drop in your package.json, requirements.txt, Cargo.toml, or go.mod.
PHALUS resolves every dependency against the live registry. It knows what you depend on. It judges silently.
Agent A reads only public documentation — READMEs, API docs, type definitions. Never a single line of source code. It produces a Clean Room Specification Pack (CSP): 10 documents describing what the package does, never how. Think of it as the world's most thorough product requirements doc, written by an AI that takes clean room protocol more seriously than your compliance team.
Agent B runs in a separate OS process by default; hardened container mode adds a Docker boundary. It receives the CSP, selected license, and its own runtime settings — not Agent A's context, credentials, or source material. If the requested boundary cannot start, the run stops. There is no silent downgrade. Phoenix Technologies used separate teams in 1984. We use separate runtimes in 2026.
Agent B reads the CSP through a Symbiont 1.21 reasoning loop governed by an exact three-tool allowlist. It writes files, checks API completeness, resolves missing imports, and records a protected, signed per-run journal. Its runtime inputs exclude the original source and documentation; non-completed or unconfirmed effects fail the run. The result is an implementation backed by evidence, not a pinky promise.
Only after generation does the validator fetch original source for comparison. A passing verdict requires source-backed similarity, license evidence, requested Docker syntax and test execution, and API coverage. Missing tools, missing tests, or missing source fail closed. The top-level audit is hash-chained and binds the signed Symbiont journal — because if you're going to do something legally dubious, you should at least have tamper-evident paperwork.
A clean-room claim is only as credible as the boundary and evidence behind it. Both are now enforced.
Agent B runs in a separate process by default. Container mode adds a read-only root, dropped capabilities, resource limits, and controlled mounts. Unsafe same-context execution requires an explicit opt-in.
Symbiont 1.21 allows exactly three Agent B tools and signs a protected per-run journal. Policy denial, unconfirmed effects, and every non-completed termination are treated as failures.
Similarity must use fetched source; requested tests and syntax checks must actually execute; license evidence and configured API coverage must pass. A missing checker is a failure, not a free pass.
Each audit event carries a sequence, previous hash, and entry hash. Generated files, prompts, and the signed Symbiont journal are bound into the record, so later edits are detectable.
The moral reckoning takes longer.
| Ecosystem | Manifest | Registry |
|---|---|---|
| npm | package.json | registry.npmjs.org |
| Python | requirements.txt | pypi.org |
| Rust | Cargo.toml | crates.io |
| Go | go.mod | proxy.golang.org |
We think you should read the answers before using it.
Clean room reimplementation has legal precedent going back to Phoenix Technologies' 1984 IBM BIOS clone and Baker v. Selden (1879). Whether that precedent extends to AI-assisted reimplementation is, to use the legal term, completely untested. You are your own legal counsel here. We are a Rust binary, not a law firm.
Malus is a SaaS product with a payment page, a marketing site, and testimonials from "Dr. Heinrich Offshore." PHALUS is the same two-agent pipeline running on your machine, with your API keys, under a 0BSD license. No cloud. No accounts. No middleman taking a cut of your moral compromise.
This is the question that matters. Clean room reimplementation — whether done by humans in 1984 or AI in 2026 — fundamentally challenges the social contract of open source. PHALUS exists to make that challenge visible, not to celebrate it. If the ease of this tool concerns you, good. It should.
Every run produces evidence of the runtime process: a fail-closed worker boundary, source-backed similarity scoring, a hash-chained audit, and a signed Symbiont journal. That can show what PHALUS did; it cannot prove the model had no training-time exposure or that the output is non-infringing. Whether the evidence satisfies your lawyers depends on your lawyers and jurisdiction.
The run fails. PHALUS does not silently downgrade process or container isolation, and requested syntax or test checks must execute before validation can pass. Unsafe same-context execution and local test fallback exist only as explicit opt-ins for people who enjoy signing their own incident reports.
The validator flags anything above your configured threshold (default: 0.70). Some things — like left-pad — have very few correct implementations. If two separate authors independently write the same eleven lines, is that infringement or mathematics? Ask a philosopher. Or a judge. PHALUS just reports the number.
Private Headless Automated License Uncoupling System. The acronym is unfortunate. The name is accurate. We considered alternatives but decided that if you're going to build a tool for ethically ambiguous license circumvention, you might as well commit to the bit.
There are no robots. There is a documentation-analysis agent, an isolated governed implementation loop, an evidence-gated validator, and more cryptographic bookkeeping than anyone asked for. You can see exactly what happens by reading the source code, which is 100% open, unlike whatever you're about to do with the output.
Join the zero people who've publicly admitted to using this tool.