The law, held in common.
A free, decentralized commons of case law — for any jurisdiction. No accounts, no billing, no hosted service. Universities, firms and individuals run nodes. Nobody bills anybody.
A node is one binary over one SQLite file, and it works fully offline. A judgment's identity is the hash of its text, the citation graph can be rebuilt byte-for-byte by anyone, and a release is valid only when a quorum of independent organisations has signed it — never published by any single party, this project included.
serve ingest demo verify stats) with full-text search, judgments, citations and the graph.
molao demo seeds a synthetic corpus of fictional judgments so the software has something to show.
A commons, not a product.
There is nothing to sign up for and nothing to buy. There is no hosted Molao service, so there is nothing to be a customer of — and the release mechanism means this project could not take control of the corpus even if it later wanted to.
Free, forever
No accounts, no telemetry, no licence check, no subscription tiers, no "free for individuals" asterisk. A node makes no outbound requests of its own — there is no telemetry code to disable, because none was written.
Hosted by institutions
Law faculties, law societies, legal-aid organisations and individuals run nodes. This is what the LII network has done for decades under the Free Access to Law Movement — AustLII, CanLII, BAILII, SAFLII, NZLII, the ~16 AfricanLII members.
Molao joins that tradition rather than inventing it. What it adds is content-addressed identity, threshold-signed releases, and a citator whose mechanical layer anyone can check.
Offline by default
A node with a corpus on disk needs no peers, no relay and no internet. Pull the plug and it keeps serving the law. This is a hard guarantee, not a degraded mode: peer-to-peer distribution will never be required to read a judgment.
Regions are data, not code.
No country is hardcoded. Court codes, court names, hierarchy tiers, authority weights and law-report series ship as region profiles — TOML a node picks, never an assumption baked into the parser. This works because the free-access-to-law world already converged on one citation convention.
ZA — populated
South Africa is the first fully-populated profile: court registry, tiers, authority weights, report series. It is the first profile, never a special case in the parser.
Adding a jurisdiction means writing a TOML file — an LII, a law faculty, a bar council or a ministry of justice can stand Molao up for its own corpus and touch no core logic.
Ships populatedGENERIC — works anywhere
The generic profile parses neutral citations anywhere on day one, flagging every court code as unknown rather than dropping it — because a citator that quietly discards what it cannot resolve tells a lawyer the case cites less than it does.
Its limit, stated plainly: GENERIC finds only neutral citations and case numbers. Reported citations need an enumerated report-series list, which is precisely what a dedicated profile supplies.
Verifiable by recomputation.
Nothing enters a release that cannot be rebuilt and compared. That single rule decides most of the architecture — including, most importantly, what is left out of it.
Judgment ids are hashes
A judgment's id is the BLAKE3 hash of its canonical text. Alter a paragraph and the id no longer matches, which is what makes a judgment received from an untrusted peer safe to keep.
Canonicalisation is aggressive on purpose: judgments arrive as RTF, PDF and HTML, and every converter disagrees about whitespace. Without it, two honest nodes would compute different ids and the network would silently fork.
RunningThe graph can be rebuilt
Citations are extracted by a pinned, versioned, deterministic extractor. Any node can re-run that exact version over the same corpus and must get a byte-identical graph. Any change to extraction behaviour — including adding a court — bumps the version.
So a graph can be contributed by anyone and checked by everyone, with no trust in the contributor at all.
RunningEmbeddings are excluded on purpose
Float inference is not reproducible across hardware, so a contributed vector index could never be verified — only trusted.
And a poisoned index is worse than a poisoned document. A tampered judgment fails its hash check immediately; a tampered index leaves every judgment byte-perfect and simply never returns the case that would have lost you the argument. The text stays correct while retrieval quietly steers.
Excluded on purposeProvenance is plural
Contributed documents are corroborated by k-of-n independent re-fetch: witnesses fetch from the canonical source and sign the bytes they saw. One person's upload is not evidence.
Every judgment shows its class — Corroborated, Single source or Manually entered — because lawyers already reason in reported versus unreported terms and will not accept a system that flattens the distinction.
RunningOne binary, one SQLite file.
The web UI is embedded in the same executable that serves the API. Every screen below is captured against the demo corpus — synthetic judgments with a real citation graph between them. The case names are fictional; the machinery underneath them is not.
Search the corpus
Full-text search over SQLite FTS5, with court, year-from and year-to filters and highlighted snippets. Every result carries its court, its neutral citation, its provenance class and its authority weight.
Authority is inbound citations weighted by the citing court's tier — an appellate judgment relying on a case says more than a first-instance one does.
molao demo.
A judgment as printed
Structured, not scraped into a blob: parties, court, case numbers, date, coram, parallel reported citations, and paragraphs numbered as the court numbered them — which is what a pinpoint citation has to land on.
The provenance class sits on the document itself, so a reader never has to guess whether anyone else fetched the same bytes.
Citations, both directions
Cases this judgment cites and cases citing it, each with the paragraph it was cited from and the pinpoint it pointed at.
Unresolved citations appear as written, never hidden. If the corpus does not hold the cited case, the reference is still shown verbatim — dropping it would misrepresent what the judgment actually relies on.
The citation neighbourhood
Three lanes around one judgment: what it cites, the judgment itself, and what cites it. Edges are weighted by the citing court's place in the hierarchy, so the lane on the right is a rough map of how much the case has come to matter.
Every edge in this view is mechanical and deterministic — extracted by the pinned extractor, and reproducible by anyone holding the same corpus. Nothing in this picture is a judgement call.
The node says what it holds
Release number, quorum and threshold, provenance breakdown, court coverage, and whether verification passed. A reader can see the shape of what they are searching before they trust an answer from it.
Exposed publicly at /api/status on purpose: federations decay quietly when the person running a node moves on, and a node that has gone stale should be visibly stale.
No single publisher — including us.
"No central server" is achievable, and Molao achieves it. "No central authority" is not, and claiming otherwise would be dishonest.
Somebody has to attest that a particular hash is the real judgment. Content addressing proves bytes have not changed; it cannot prove the bytes were ever the judgment in the first place.
So the trust root is a quorum plus a public append-only log, not one operator. A release is valid only when at least threshold distinct independent organisations have signed its manifest — one signer, one vote, outsiders ignored however valid their signature — and threshold < 2 is refused in code. A threshold of one is a single point of authority wearing a quorum's clothes.
Releases chain by hash, so a fork is detectable against any known head. What this buys is that capturing the corpus means capturing several institutions across several jurisdictions and going undetected, rather than compromising one server. That is a large improvement over one database with one administrator. It is not the same thing as trustlessness, and it will never be described here as though it were.
| Role | Does what | Ongoing effort |
|---|---|---|
| Mirror | Holds a release and serves it. Reading the law. | Nearly none — fetch new releases. |
| Witness | Fetches judgments from canonical sources and signs the bytes it saw. | Low. Key custody, and noticing if it stops. |
| Builder | Assembles a release: canonicalises, extracts citations, computes roots. | Per release. Requires no trust — anyone can rebuild and compare. |
| Attestor | Holds a key in the signer set and signs manifests. | Per release, plus judgement — and a willingness to refuse. |
The citator is the real prize.
A corpus that does not know case A was overruled by case B will hand a lawyer dead authority. The citator splits cleanly in two, and only one half is built.
Mechanical edges
Who cited whom, from which paragraph, pointing at which pinpoint. Deterministic, verifiable, and rebuildable by anyone from the corpus and the pinned extractor version.
Unresolved citations are shown as written, never hidden.
RunningTreatment labels
Whether a case was followed, distinguished or overruled is interpretation. It cannot be verified by recomputation, so it is modelled as signed attestations that may conflict — showing the disagreement rather than resolving it.
Two scholars can read the same judgments and differ. A system that picks a winner and hides the argument is lying about how law works. Until this lands, check currency yourself.
Designed, not builtRust, Node, and nothing else.
Rust 1.85+ and Node 20+ for the web UI. SQLite is bundled, so there is no database to install, no connection string to configure, no credentials and no account. The node binds 127.0.0.1 — serving a network is a deliberate flag, not an accident.
# clone and prove the guarantees hold $ git clone https://github.com/vul-os/molao $ cd molao $ cargo build --workspace $ cargo test --workspace # build the embedded web UI $ npm ci && npm run build # a node starts EMPTY — seed the demo corpus $ cargo run -p molao-node -- demo # serve search, judgments, citations, graph $ cargo run -p molao-node -- serve
- 01Run the tests firstThey are the fastest way to see what the project actually guarantees: that canonicalisation is idempotent, that tampering with a judgment breaks its id, that one signer cannot reach a quorum by signing repeatedly, and that ordinary prose extracts no citations.
- 02Seed the demo corpusThere is no bundled corpus and no public signed release.
demowrites a small synthetic corpus of fictional judgments with a real citation graph between them, so search, judgments, citations and the graph have something to work on. - 03Or use one crate aloneThe core crates work with no node and no network. If all you want is a citation parser for your jurisdiction,
molao-citeplus a region profile is exactly that. - 04Before ingesting real documentsRead the sourcing rules first. They are a deliberate ethical position: courts and gazettes directly, licensed bulk where it exists, and an LII that declines bulk supply is a citation-resolution target — not a scrape target.
The hard parts, stated plainly.
A project that only lists its wins is marketing. These are the limits — the things a reader could reasonably assume work, or assume are protected against, and which are not.
-
No corpus, no releaseNothing published yet
Molao ships no bundled corpus and no public signed release exists. A node starts empty. Everything you see pictured above ran against
molao demo— a synthetic corpus of fictional judgments, seeded so the software can be evaluated at all. - Treatment labelsDesigned, not built The interpretive half of the citator does not exist yet. Mechanical edges are there and are verifiable; followed / distinguished / overruled is not. Until it lands, check currency yourself — do not treat a Molao citation list as a currency check.
- Peer-to-peer distributionDesigned, not built Releases are plain files today and mirroring is manual. Every node holds a full copy and there is no hub. When P2P does land it will be a convenience — it will never be required to read the law.
- Semantic searchExcluded on purpose Not a gap on a roadmap: a refusal. Float inference is not reproducible, so a contributed vector index could never be verified — and a poisoned index steers retrieval while leaving every judgment byte-perfect. No embedding or vector index appears anywhere in a release.
- A quorum can still colludeNot defended by cryptography If k of n signers agree to publish something false, every check passes. The defence is institutional independence and jurisdictional spread — governance, not maths. Saying otherwise would be the exact dishonesty this design exists to avoid.
- Sources, not truthA hard boundary Molao attests to what the source served, not to what the court meant. If a court publishes the wrong file, witnesses will faithfully corroborate the wrong file. The node verifies bytes and signatures and never claims a judgment is verified law.
- Reader privacy has a limitNo anonymity claim A node's operator can see what its users search for. Molao makes no anonymity claim whatsoever. If your research is sensitive, run your own node — it is free, it is one binary, and it works offline.
- Federations decayA social problem Every distributed academic network has watched nodes go dark because a postgraduate graduated. The mitigations are deliberately unglamorous: a zero-maintenance single binary with no external database and nothing to rotate, and network health exposed publicly.
Listed alongside the Vulos suite
Vulos is a family of open, self-hostable software. Molao is fully standalone — it runs on hardware you control, needs no Vulos account and no Vulos infrastructure, and depends on no Vulos service. It is also neither of the two things Vulos charges for: it bills nothing, hosts nothing, and has no paid tier. It runs by itself, or as an app hosted by the Vulos OS.
Explore Vulos →