A well-engineered open-source commerce framework that has quietly lost its steward for the second time in ten years — and a competitor that came back from the dead with a business model behind it.
Engineering strategy audit of Solidus, the Rails commerce framework. An existing-system audit run entirely on public evidence, with a proposed policy register.
The framework this report runs on (ESF v0.7 — see the notation note in Start Here) requires the mandate question to be answered before policy is proposed, so here it is, plainly. The author holds no mandate over Solidus. This is an outside audit; nothing below is accepted, and an outside analyst cannot accept it. Every PL row ships in the proposed state, addressed to the people the governance document actually empowers: the Core Team for anything touching code and releases, and the stakeholder vote for anything touching money
Solidus is volunteer-delivered: nobody can be assigned a deadline they are not paid to meet, so a policy demanding sustained labour from named volunteers would fail on arrival. What the project can enforce, it already enforces well — by machine. Deprecations fail the build; style is linted, not litigated; merges require Core Team review
One more obligation the framework imposes: check whether strategy work already exists before authoring any. It does. The lead maintainer published a coherent strategic position in May 2026 — governance breadth, licensing freedom, a deliberate rejection of the JavaScript-framework path
Every serious spending year funded a single engagement, and the one that failed — $45,760 for six "Agile Design Sprints" in 2023 — is the one that bought activity instead of an outcome (F1). The rule: a funded engagement names its deliverable, its completion criterion, and who carries the work after the money stops. The funding model itself is already settled and deliberate — independent developers paid from the collective while the maintaining firms stay on client work
The Core Team holds explicit technical authority and the community meets weekly, yet no decision reaches a public artifact: the roadmap board is a changelog wearing a roadmap's name, and the clearest statement of project strategy lives on a consultancy's marketing blog (S1). A prospective adopter finds a well-kept record that the project had a past and no evidence it has a future. The rule: each Core Team decision lands within a month as a status post or a forward-looking roadmap item. This is publication, not governance — the decisions may already be getting made; nothing about them is visible. The blog has already half-resumed on its own, with one release announcement in May 2026
When the 2025 funded developer stopped, seven admin pull requests went stale where they sat, and the project's only rescue so far was one contributor volunteering by hand a year later (F3). That rescue worked — it moved to a fresh pull request on 30 July 2026, with the reviewer's preferred approach adopted
Solidus is born. Stembolt, an agency, forks Spree 2.4 because it dislikes where Spree is heading. The founding promise is stability, easy upgrades and backwards compatibility
Spree is acquired by First Data and development stops entirely. The fork looks prescient; much of the Spree community migrates to Solidus
The first steward leaves. Stembolt is acquired by JUUL Labs and stops working on Solidus. Nebulab picks up stewardship
Funding runs through Open Collective. Agencies and merchants sponsor monthly. Sponsors also start cancelling — seven in 2019, seven in 2020, seven in 2021. This attrition never stops
The new admin begins. Work starts on solidus_admin to replace the ageing interface
$45,760 is spent on it. Six payments of $6,000 to Nebulab for "Agile Design Sprints," plus $9,760 for a redesign analysis. 2023 becomes the project's biggest year: 1,810 commits, roughly 60% from Nebulab's people
Nebulab's engineering collapses. Their lead developer goes from 696 commits to 46. Admin work drops from 618 commits to 205. No announcement is ever made
A second parallel rewrite starts: solidus_promotions, alongside the existing promotions engine. Neither becomes the default
Spree returns commercially. Version 5.0 splits into a free edition and a paid Enterprise Edition backed by Vendo
Solidus starts publishing monthly status updates. One person — Eugene Chaikin — is publicly named as the one advancing the new admin. He will write 78% of that year's admin commits
The last expense is paid. Funded development stops. Money keeps arriving; nothing goes out again
The monthly updates stop. After five issues, the status-post cadence ends. One release announcement follows in May 2026, then silence again
Solidus v4.7.0 ships — Ruby 3.2+, Rails 7.2+, with CI already covering Rails 8.1 and Ruby 4.0, each adopted within weeks of its release
solidus_starter_frontend — a storefront maintained as its own repository for years — is renamed and absorbed into the monorepo as storefront/, bringing a 64-file, 5,510-line test suite with it
Spree ships six platform releases in five weeks. Solidus has shipped none since April. The collective's balance sits unspent. Two firms supply 78% of the funding. The new admin is at version 0.4 with its main screens switched off
The project answers. The draft posted to the project's Slack draws a Core Team reply within the hour — "not 100% accurate… but it is definitely helpful to see how the public state of the project looks when taken in aggregate" — and the two most valuable unknowns get answers
Re-verified for this revision: still no outgoing expense — thirteen months now — with $133,750 held; the meta-gem unchanged; the orphaned-PR rescue moved to a fresh pull request on 30 July
Solidus's finances are entirely public, which is unusual and useful — this section rests on records rather than guesses. All figures from the Open Collective API
Host and payment-processing fees (residual, computed on the 25 Jul snapshot)
Cumulative totals flatter the picture badly, because they include sponsors who left years ago. The honest number is active recurring contributions, of which there are nine, totalling $1,931 per month — a set re-confirmed unchanged on the August 2026 billing cycle
Over thirty sponsors have cancelled, including large ones: Engine Commerce ($1,000/month), Modded Euros ($850 across three subscriptions), Firstleaf ($325), Magmalabs ($325) and Deseret Book ($200). Most are merchants rather than agencies — actual stores that stopped paying
In every year the project spent seriously, essentially all of it went to a single engagement
Six payments of $6,000 each to Nebulab, every one labelled "Solidus Admin Dashboard Agile Design Sprint 1–6," plus $9,760 to Andrea Iurisci for an "Admin Panel Redesign Analysis"
Funded development continued after that — $32,506 to a Dutch company across 16 invoices in late 2024, $16,888 to an anonymized payee across six invoices in the first half of 2025 — then stopped completely with the expense paid on 5 July 2025. Thirteen months of income have arrived since, with nothing going out. Re-checked 8 August 2026: the most recent debit in the ledger is still the July 2025 invoice
A first pass looked only at paid expenses, which would have missed money approved and awaiting payout. Querying every state returned 67 expenses: 64 paid, 3 rejected, and none pending, approved or processing. The most recent expense of any status is from July 2025. So nothing is committed and in flight
The 8 August re-check read the debit ledger again and found the same picture; the one thing it could not read unauthenticated is expenses submitted but not yet approved, a limit noted rather than hidden
Two reconciliation gaps remain open and are worth naming. The 64 paid expenses sum to $143,158, against a reported total spend of $154,612 — an $11,453 difference, most plausibly payout fees. And received-minus-spent exceeds the balance by $42,885, or 13% of everything received, consistent with a host fee plus payment processing. Neither is verified
Seven people are administrators on Open Collective and can approve expenses: tvdeyen, Gregor MacDougall, Alberto Vena (Nebulab), Matteo Latini, Andrea Iurisci, Alessandro Desantis (Nebulab co-founder) and Jared Norman (Super Good)
A related theory — that the sponsorship was a play for voting power — does not survive the mechanics. Voting weight equals monthly contribution, capped at 1000; Nebulab and Super Good are tied at $750 and neither has spent the extra $250 that would max the cap. Votes govern only how funds are spent and who becomes an advisor; they confer no authority over what code gets merged. And the economics run $44k the wrong way
At rev 25 the arm's-length standard this finding said was missing turned out to exist as a stated norm: maintainers prefer not to take collective money at all — "I prefer to avoid any perception that those of us maintaining Solidus are profiting directly from the OpenCollective funding" — and funds-to-agencies work is fine "as long as it's transparent and fairly priced," with skilled third parties preferred
The defaults column was re-checked on 8 August 2026: the meta-gem still names solidus_api, solidus_backend, solidus_core, solidus_legacy_promotions and solidus_sample, and still omits solidus_admin and solidus_promotions
The gem ships a 190-line migration guide covering installation, migrating existing promotion data, switching store behaviour, syncing legacy order promotions, handling custom storefronts, porting custom rules, and finally removing the legacy gem from the Gemfile
Eleven commits over six weeks, by four people from two organizations including Alberto Vena of Nebulab
What arrived with it was not a seven-week-old skeleton. solidus_starter_frontend had been maintained as its own repository for years, and it brought 64 spec files and 5,510 lines of tests — components, controllers, helpers, mailers, request specs including authorization, and 19 system specs covering authentication and caching. Those specs are copied into every generated store, and CI installs a store and runs them end to end on every push
The residual cost is real but narrower than earlier stated: two promotion engines account for 205 test files covering the same domain, and every new installation still carries two admins
For a commerce platform, the most persuasive evidence is a real store. A search of public repositories depending on Solidus returns roughly thirty results
Jared Norman named this himself in How to Fail at Solidus, observing that many Solidus implementations remain invisible to the community
Solidus keeps optional capabilities in separate repositories. Of the 35 in the official organization, those still worked on in 2026 are payments (Stripe, PayPal), subscriptions, authentication, translations and developer tooling. Dormant since October 2023: the GraphQL API, webhooks, and the old storefront
Nebulab supplied roughly 1,096 of 1,810 commits in 2023 — about 60% — and roughly 3 of 223 in 2026. No announcement of this transition was ever made publicly; extensive searching found nothing
They remain a 27-person operating consultancy and still pay the top sponsorship tier. But their services page now lists "Shopify Development" at exactly equal weight with "Solidus Development"
Two things in the governance document are worth quoting exactly, because together they define the gap precisely
The public roadmap board holds 76 items — 65 merged pull requests and 7 closed issues, against 3 open forward-looking ones. It records what was done
The blog ran monthly status updates from May to October 2025, went quiet, and has published one release announcement since — for v4.7, in May 2026
Limit of this finding: I did not establish whether meeting minutes exist somewhere non-public. The claim here is only that no record is discoverable from outside
Do not read all 40 open pull requests as maintainer neglect. In April 2026 Jared Norman posted an announcement explaining a sudden wave of first-time contributions: an online job board had been setting candidates the task of fixing Solidus issues as a screening step
The repository has no SECURITY.md, which invites the conclusion that a payments framework is running without a disclosure policy. It is not. The policy lives at organization level and points to a published process that is considerably stronger than most projects this size manage
There is a track record behind it: five published advisories between 2020 and 2022, severity-rated, one carrying a CVE
Two observations worth keeping. First, the supported-versions list is current — it names 4.7, released April 2026 — so this policy is being maintained while the roadmap is not. It is a fair signal of what this project keeps up when it judges the stakes high enough. Second, no advisory has been published since 2022. That is four quiet years, which could mean nothing was found or could mean the process has gone as quiet as the rest; nothing here distinguishes the two
github/CODEOWNERS contains one rule: * @solidusio/core-team
What I could not verify: branch-protection settings and core-team membership both require organization admin scope, and returned permission errors rather than absences. So the review requirement rests on the published policy
Rails 8 ships Propshaft as the default asset pipeline; Sprockets is the previous generation
The install path is already covered by continuous integration, and thoroughly. solidus_installer.yml runs on every push and pull request to main and it installs the native image library, runs the real installer with real flags, boots the application and asserts the homepage renders, verifies the resolved payment-gem version, and then runs the generated application's own test suite with coverage reporting. A second workflow covers the extension-generator path
Continuous integration is green on an install path the documentation does not describe. The official guide gives two commands. CI quietly performs three. A developer following the guide hits precisely the bug that CI works around — and the explanation lives in a code comment rather than anywhere a user reads
The fix Solidus is implicitly waiting on sits unmerged in a gem that has not shipped in two years and has already been superseded upstream
Solidus has no package.json, no lockfile, and no npm dependency graph anywhere in the repository
Spree, by contrast, carries package.json, pnpm-lock.yaml, a pnpm workspace, Turborepo and Biome, plus eleven JavaScript packages
The new admin's package definition declares a hard dependency on solidus_backend — the old admin — and its components link out to old-admin web addresses for adjustments, stock movements and store-credit history
What makes this sharper is that a completion checklist already existed. Issue #5391, opened September 2023 and still open, sets out the porting plan with an explicit sequencing rationale — "We want to tackle the easy pages first, so we can slowly improve and augment our UI kit components and then reuse it to migrate more complex pages (e.g. promotions)" — followed by a task list
Note what that checklist is: the six easiest screens in the application — and see below for why choosing them first was the mistake. The project did define what finished meant, published it, and then stopped tending the definition. Not one box has been ticked in three years, including for work that is demonstrably complete — re-confirmed on 8 August 2026, all six boxes still empty
There was also a public narrative: the Q2 2023 blog post reported that "the new admin experience required some upfront effort; now that the main components have been built, implementing the remaining sections will be easier and faster"
2023 authorship of the admin: Elia Schito 370, Rainer Dema 132, Marc Busqué 102, Alberto Vena 6 — roughly 98% from Nebulab's orbit. 2024 dispersed across six people as they wound down. 2025 was carried by a single individual, Eugene Chaikin (who commits as chaimann), with 151 of 193 commits. 2026 has 19 commits across five people and no owner at all
Seven pull requests open for a year invite the reading that finished work is waiting on reviewers. Reading the actual threads — commits, inline review comments and conversation — gives a more specific answer
The one PR marked ready for review has a live thread. After a conflict notice (July 2025) and a technical objection from a maintainer who preferred native Turbo behaviour over a new library dependency (August 2025), a different contributor stepped in
That is a healthy community doing something difficult well: a maintainer conceding a design argument rather than blocking on it, and a contributor volunteering to adopt someone else's stalled work while accepting the reviewer's preferred approach. And the promise was kept: on 30 July 2026 forkata opened #6528 — "Admin confirm modal without external dependency" — the same feature rebuilt the way the reviewer wanted it
Incidental observation: a Copilot pull-request reviewer bot left a review on #6232 in May 2025
The 132 existing components total 7,716 lines, covering roughly nineteen working screens. A list-only controller runs 30–36 lines with one or two component files
A second, independent measure agrees. Because both admins are server-rendered, view templates are a fair proxy for screen surface: the old admin carries 277 ERB templates against the new admin's 111
Will Larson's migration playbook — the standard reference on paying technical debt at scale — sets out three phases
Solidus's porting plan states the opposite strategy in its own words. Issue #5391: "We want to tackle the easy pages first, so we can slowly improve and augment our UI kit components and then reuse it to migrate more complex pages (e.g. promotions)"
The predicted failure is exactly the observed one. The easy settings pages were partially ported. Confidence ran ahead of reality — the Q2 2023 post reported that "the main components have been built, implementing the remaining sections will be easier and faster"
At rev 24 the Core Team answered this finding directly: partial concession on sequencing — "there's an argument to be made that we should have started with the hard stuff first, or at least got to it faster" — but a dispute on the stakes: "viability isn't a concern… I don't think anyone is worried that building them isn't possible. As the project is pre-1.0, churn isn't that big of a deal"
A reasonable theory, and the evidence does not support it. The open issues about the admin are overwhelmingly requests for missing features — "introduce taxonomy creation," "add product specifications," "edit product stock quantity," "enable creating option types" — the signature of incomplete, not disliked. Two usability tickets exist. The May 2025 status update was positive about the work
One correction of the folk narrative, from the Core Team at rev 24: there never was a founding feud. After the split the projects collaborated directly for a while — especially on security issues that affected both — and the lines broke down later, with strategy shifts and the changeover in who ran this project. "The only real 'drama' is just that they use Solidus projects as case studies on the Spree site"
The present tense, from the same voice at rev 25: "very different approaches," disagreement on licensing and technical strategy, and "no beef these days, though. Just different directions"
Spree's free edition includes the storefront, checkout, sales channels, stock reservations, order routing and the APIs. The Enterprise Edition adds three separately licensed commercial modules — marketplace, B2B, multi-tenant — plus a support tier with graded response-time guarantees, long-term support releases and 24/7 monitoring
No pricing is published; one third-party estimate puts year-one licence and implementation in the five-to-six figures
This is structural, not circumstantial. Spree's open-source work is a marketing and R&D cost carried on an enterprise profit-and-loss; Solidus's is carried on a donation pot taking in about $25k a year. A community-governed collective cannot replicate that model without ceasing to be one
Spree publishes AI-agent skills installable in one command, runs a documentation MCP server, and advertises its command-line tool as working "hands-free for AI agents." Internally it carries agent instruction files, committed permissions, hooks and version-locked skills
Solidus has none of this — re-confirmed 8 August 2026: the repository root still carries no agent instruction file of any kind
Fair caveat: causation is unproven. Spree also has commercial funding, so the harness may be a symptom of resources rather than a cause of throughput. And one third-party article claims Spree's activity surge is "primarily driven by LLM-generated contributions"
Spree relaunched commercially in April 2025. Solidus's sponsor cancellations run 7 · 7 · 7 · 4 · 5 · 2 · 5 · 2 per year from 2019 — with 2024 and 2026 the two lowest years on record. There is no post-relaunch exodus. Nebulab's engineering had already collapsed in 2024, a full year before Spree 5.0
Solidus's technical direction is not unwritten, and it is easy to miss because of where it lives. The lead maintainer published it on 12 May 2026, in a post comparing Solidus and Spree
The May 2025 status update promised to "double-down on the existing GitHub project called Roadmap" for transparency. They did keep it alive — it was updated in June 2026. But of its 76 items, 65 are merged pull requests and 7 are closed issues. Exactly three open issues and one open pull request are forward-looking, and one of those three is a housekeeping item last touched in May 2025
The project plainly can run a migration well. Promotions ships a 190-line guide covering data migration, behaviour switching, custom rules and legacy removal, plus an explicit advisory to migrate now. The storefront was absorbed cleanly in six weeks by four people from two organizations
Nebulab went from ~60% of commits to ~1%, with no public announcement
And this is the second occurrence. Stembolt was acquired in 2018 and walked away too. The 2018 handover succeeded only because a willing successor happened to exist. The custody chain reads Stembolt → Nebulab → nobody
Narrower than a repository-only reading suggests. Solidus runs a HackerOne disclosure program, automated security dependency updates, an 18-month patch window across three supported versions, two mandatory reviews before merge, and multi-factor authentication on release accounts (§07)
What remains is the gap around it: no automated routine version bumps and no bundler-audit step in the build, so ordinary dependency drift accumulates between security events and is caught only when someone looks
Code concentration and funding concentration are the same dependency seen from two sides. The largest individual contributor commits from a personal address with no organization behind him. One of the two firms now markets Shopify work at equal weight with Solidus
Three years, version 0.4, 19 commits so far in 2026, both admins in every installation, and the architecture actively hides the problem. Rev 24, from the Core Team: the admin is alive and deliberately paced — real stores run it incomplete today, and work "will resume at pace once we have our new candidate in place"
That is exactly the answer §22 said would move this risk from high to low, and it does — with one reservation: the drop rests on a stated intention, and only the falsifier closes the risk. The next outgoing ledger expense is the observable that confirms the candidate, and as of 8 August 2026 it has not appeared — the ledger's last debit is still July 2025
At rev 25 the intention gained a second leg: "The Admin is a priority," and the candidate model is deliberate — independent devs funded from the collective while the maintaining firm stays on client work
Measured in §09. Note this ranks below R1–R3 despite high impact, precisely because it is loud and public — the project will see it happening. What I cannot establish is whether merchants are actually switching: cumulative downloads still favour Solidus, and per-release download rates are distorted by Spree's faster release cadence
Its own README states that extensions relying on the old storefront "will not work with this storefront." Impact medium, likelihood certain — a stated property rather than a hazard
Solidus, from its own documentation: create a Rails app, add the gem, hand-write an asset manifest file, run a generator, and possibly hand-build the CSS because "this issue typically occurs when you bundle from a branch." Then arrive in an admin that cannot open an order
More decisively, the project's own largest contributor publicly disclaims this segment. Jared Norman's How to Fail at Solidus (Nov 2024) states that Solidus suits high-volume stores, large catalogs and marketplaces — not simple small shops
Tick the boxes on #5391 that the code shows are already done — Settings > Zones has had full CRUD for some time. A checklist nobody updates says the work stopped; the same checklist current says it did not. Re-confirmed still unticked on 8 Aug 2026
The Core Team already holds technical authority. The stakeholder group already meets weekly. The project already owns two channels built to carry public direction — a roadmap board and a blog. Nothing needs to be created; two dormant things need restarting. The blog has even stirred on its own: one release announcement in May 2026, then quiet again
Why the 2025 engagement was not renewed. The most valuable unknown in the report. The project has funded a developer three separate times (2020, 2024, 2025) and stopped three separate times, with completely dry years in between. So the question is not "why did funding stop" — stopping is normal here — but why this gap has run thirteen months when previous ones were eventually filled. Budget caution, a contractor moving on, a deliberate pause, or simply nobody proposing the next engagement all produce an identical ledger and imply opposite responses. Answered at rev 24: "No candidate. We have a new candidate in the works right now, but don't have anything to share other than that we are working on it"
Who "Logicielle B.V." and "e.c441" are. Together they received $49,394 — nearly a third of all money ever disbursed — across 2024 and 2025. Identity is not resolvable from public records, and it determines whether that spending bought continuity or one-off work. Context at rev 25: external payees are the stated preference, not an anomaly — the collective deliberately funds independent devs with Solidus experience so maintainers stay clear of the money
Whether the Core Team considers the new admin alive. Inferred entirely from commit decay. A maintainer might say it is intentionally paced. This single answer moves R3 from high to low. Answered at rev 24: alive and deliberately paced — real stores use the incomplete admin in production today, a usage signal invisible to this audit's commit-decay reading
Targeted searches for reporting on Solidus stalling, being abandoned, or losing ground to Spree returned nothing — re-run on 8 August 2026 with the same result
The courtesy window narrowed the limit without removing it. One Core Team member — Jared Norman, Super Good — answered in the project's Slack, and his verdict on the report doubles as its epistemic status: "Being based on publicly available information, it's not 100% accurate and I don't necessarily agree with all of the assessments here, but it is definitely helpful to see how the public state of the project looks when taken in aggregate"
Routine dependency drift between security releases
Stale transitive dependencies age quietly; the exposure window before a disclosed issue is noticed widens
Low for disclosed vulnerabilities — that path is covered. Medium for drift
For a disclosed CVE, yes. For gradual drift, no
A Renovate or Dependabot version-update config landing, which would close this entirely
Two firms are 78% of the money and most of the code
Losing either firm removes ~39% of funding and a large share of throughput at once
Medium — this has already happened twice
Not for months. A departure looks exactly like a quiet quarter
Six consecutive months where no single party exceeds 25% of merged commits
The half-built admin becomes a permanent third state
The primary evaluation surface for new adopters stays broken, and the maintenance bill doubles indefinitely
No. Every signal a maintainer looks at is green
Version 1.0 becoming the default — or a recorded decision to cancel it
The new storefront breaks existing extensions by design
Governance describes a project that no longer exists
Architectural decisions are never recorded
The agent harness, and two small automation gaps
Test matrix including unreleased Rails 8.1 and Ruby 4.0
Migrations are engineered but never scheduled
A migration can stall indefinitely without anyone noticing
The steward changed in the code but not in the governance
That one of the stalled migrations is exactly what happens next
Treat this as an existing-system audit, with single-decision depth on t…
A deliberate strategy does exist — compatibility, merge authority and m…
Open with agent-harness engineering, on the grounds that no deliberate strategy exists.
The policy exists at organization level and was found by widening the s…
Report “no security policy for a payments framework” as a risk.
File the governance/reality mismatch as a debt, not a risk. (Accepted —…
67 expenses totalling $154,612 say the mechanism works and was already…
Frame the $132,180 balance as capital nobody has a mechanism to spend.
Corrected against the API — $329,677 received, $154,612 spent, and the…
Cite “$26,322 annual budget” and “$287,359 raised” from the rendered donation page.
Wrong. Six of seven pull requests are drafts never submitted for review…
The stalled 2025 admin work is finished and blocked at review; reviewer capacity is the bottleneck.
Misleading — order and product editing are switched off, six controller…
Report the new admin as “64% complete by controller count.”
Wrong measure. There is no package.json, no lockfile and no npm graph.…
Describe Solidus as paying polyglot costs, citing 246 JavaScript files.
Count correct, implication wrong — it reads as a recent exodus. It is s…
“Thirty-plus sponsors have cancelled, so the base rate is not hypothetical.”
Reject the theory that Nebulab's sponsorship was a play for voting powe…
Decline to characterize the Nebulab payments as extraction. (Net contri…
Reject "Spree caused the decline." (Cancellations are steady from 2019…
Decline to claim new merchants are choosing Spree over Solidus. (Not me…
Reframe the report from "how to recover" to "choose a role." (Accepted…
Over-generalized from one case. Promotions ships a 190-line migration g…
“Three unfinished rewrites” as a systemic pattern, generating root cause RC1.
It is written — the lead maintainer published it on 12 May 2026. This r…
Treat the project's technical direction as unwritten and derive it.
Vector removed entirely. "Director" covers business and organizational…
Treat the governance document's description of Nebulab's role as a finding at all (the governance-title strategy row, its bet, and its pre-mortem entry).
Partly external. A job board was setting candidates Solidus issues as a…
Read the 40 open pull requests as evidence of review neglect.
Wrong prescription for the mode. Unowned, undated work is the normal co…
RC1: “the gates were built; nobody is accountable for closing them, and no calendar says when.”
Metadata was misleading; the threads say more. Five chaimann drafts hav…
All seven stalled admin PRs characterized from API metadata: “the author never returned,” “reviewers engaged wherever they were asked.”
Wrong twice. The file exists and works, so marking it absent was incorr…
“Differentiated code ownership ✗ — CODEOWNERS is a single catch-all line.”
Diagnose the admin's sequencing against Larson's migration playbook, an…
A definition existed. Issue #5391 (open since Sept 2023) publishes the…
The $45,760 admin purchase shows “the project's missing completion gate appearing in a purchase order rather than in code” — no definition of finished existed.
Wrong, and it was the top-ranked risk. The published security policy sh…
R1, ranked first: “no automated dependency updating and no vulnerability audit step — a vulnerable dependency reaches every store, and you would learn from a downstream report.”
Every one double-counted. The count included _spec.rb, so the Ruby and…
Component table “Ruby files” figures: 855 / 328 / 278 / 193 / 166 / 98.
Overstated. The document assigns the Core Team "final decision as to wh…
“The governance document defines no mechanism whatsoever for deciding technical direction, so no forum has the standing to decide the admin's fate.”
Wrong, and it inverted the finding. It holds 64 spec files and 5,510 li…
Misleading — reading across a row produced false statements ("2020 · Lo…
Present spending as one table combining year-by-year totals with all-time recipient totals.
Re-verify the $132,180 balance under challenge. (Survived, and strength…
Softened. That figure covers the Open Collective account only. Donated…
“$132,180 sitting idle” as a characterization of the project's investment.
Wrong — it already exists and is stronger. The installer workflow boots…
Recommend adding CI that verifies the installation path.
Locate the real gap: CI is green on an undocumented install path. (The…
Ten of the twelve are view templates responding to AJAX requests, which…
Count 12 ERB asset files as Propshaft blockers.
Add the Rails-generation gap as a distinct finding. (Rails 8 defaults t…
Reject the JavaScript-framework direction on purpose. Simplicity, one s…
The project's actual strategy — stated, just not here
Never break an existing store. Deprecate before removing; back-port fix…
Ship replacements alongside the old version as opt-in, with a written m…
Working — see the promotions migration guide
Core stays lean; capabilities live in separate extensions.
Weakening — four official extensions dormant
Merge authority belongs to a self-appointing Core Team. Money buys vote…
Yes — the separation is deliberate and healthy
Quality is enforced by machines; style is not argued about.
The best-functioning rule in the project
Restart funded development — buying an outcome, not sprints
Routine dependency-update automation (security updates already run)
Agent harness, scoped to executing →B3 (Routine dependency-update autom…
Name the release that removes legacy promotions — a policy statement, n…
Decide the admin — by manufacturing the evidence, not deliberating with…
Dual asset-pipeline support, with an agent-executed migration
Publish technical decisions — restart the status posts, file forward-lo…
A definition of "finished" existed, and the money was not wired to it
Built by one organization, handed to nobody
The last developer's work was abandoned mid-flight
solidusio/solidus @ cdcdfaf (audited checkout)
The hard screen gets deferred for an easy one
The first screen attempted is one already on the #5391 checklist
Name the screen before starting, in public; treat "we learned it does not work" as a successful outcome
Nobody puts the funding decision on an agenda
Two stakeholder meetings pass with no agenda item
Send it as a one-page multiple-choice ballot over the three migrations
The harness gets built and nobody uses it
No pull request references it within two release cycles
Scope it narrowly to B3 and B5; if those land, it paid for itself
The funded migration is chosen by money, not readiness
Multiple choice, producing a ranked list
The diagnosis is wrong and the constraint is attention, not money
A second, outcome-shaped funding round also fails to ship
If money tied to a completion criterion fails too, cancel the admin
Why was the 2025 engagement not renewed?
Is the balance reserved against something?
Does the Core Team consider the new admin alive?
Branch-protection settings and core-team membership
Does Spree's commit volume reflect human or generated work?
solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023
solidusio/solidus #5410 — new admin breaks asset compilation when the host app has Tailwind
solidusio/solidus #6035 — installer may fail silently
solidusio/solidus #6228 — store create/edit draft PR
solidusio/solidus #6232 — shipping methods draft PR
solidusio/solidus #6236 — option types draft PR
solidusio/solidus #6295 — confirmation dialog PR, adopted July 2026
solidusio/solidus #6296 — product categories draft PR
solidusio/solidus #6298 — tax rate create/edit draft PR
solidusio/solidus #6302 — payment methods create/edit draft PR
solidusio/solidus #6327 — installer fails with a Sprockets error
solidusio/solidus #6516 — align the install instructions with the storefront
rails/sprockets-rails #546 — warn instead of raising on missing manifest.js
Solidus Slack — courtesy-window thread: draft posted, Core Team reply
Record the courtesy-window answers; stakeholders none reached to partial (rev 24)
Record the follow-up answers: admin a priority, funding model deliberate (rev 25)
GitHub API re-verification sweep 2026-08-08
Open Collective ledger re-check 2026-08-08
solidus.io blog — status update Solidus v4.7, 5 May 2026
Superseded: last blog post October 2025 / nine months of silence
Record the rev-26 re-verification, evidence window 2026-08-08
Rails and Ruby release dates plus Solidus CI adoption commits
Superseded: tested against unreleased Rails and Ruby versions