Solidus
type: Report
alternative headline: A well-engineered open-source commerce framework that has quietly lost its steward for the second time in ten years — and a competitor that came back from the dead with a business model behind it.
abstract: Engineering strategy audit of Solidus, the Rails commerce framework. An existing-system audit run entirely on public evidence, with a proposed policy register.
date modified: 2026-08-09
version: 27
author: Vit Panchuk
language: en
claim: claim-1
claim: claim-2
claim: claim-3
claim: claim-4
claim: claim-5
claim: claim-6
claim: claim-7
claim: claim-8
claim: claim-9
claim: claim-10
claim: claim-11
claim: claim-12
claim: claim-13
claim: claim-14
claim: claim-15
claim: claim-16
claim: claim-17
claim: claim-18
claim: claim-19
claim: claim-20
claim: claim-21
claim: claim-22
claim: claim-23
claim: claim-24
claim: claim-25
claim: claim-26
claim: claim-27
claim: claim-28
claim: claim-29
claim: claim-30
claim: claim-31
claim: claim-32
claim: claim-33
claim: claim-34
claim: claim-35
claim: claim-36
claim: claim-37
claim: claim-38
claim: claim-39
claim: claim-40
claim: claim-41
claim: claim-42
claim: claim-43
claim: claim-44
claim: claim-45
claim: claim-46
claim: claim-47
claim: claim-48
claim: claim-49
claim: claim-50
claim: claim-51
claim: claim-52
claim: claim-53
claim: claim-54
claim: claim-55
claim: claim-56
claim: claim-57
claim: claim-58
claim: claim-59
claim: claim-60
claim: claim-61
claim: claim-62
claim: claim-63
claim: claim-64
claim: claim-65
claim: claim-66
claim: claim-67
claim: claim-68
claim: claim-69
claim: claim-70
claim: claim-71
claim: claim-72
claim: claim-73

claim-1
type: Claim
text: The framework this report runs on (ESF v0.7 — see the notation note in Start Here) requires the mandate question to be answered before policy is proposed, so here it is, plainly. The author holds no mandate over Solidus. This is an outside audit; nothing below is accepted, and an outside analyst cannot accept it. Every PL row ships in the proposed state, addressed to the people the governance document actually empowers: the Core Team for anything touching code and releases, and the stakeholder vote for anything touching money
evidence: observed

claim-2
type: Claim
text: Solidus is volunteer-delivered: nobody can be assigned a deadline they are not paid to meet, so a policy demanding sustained labour from named volunteers would fail on arrival. What the project can enforce, it already enforces well — by machine. Deprecations fail the build; style is linted, not litigated; merges require Core Team review
evidence: observed

claim-3
type: Claim
text: One more obligation the framework imposes: check whether strategy work already exists before authoring any. It does. The lead maintainer published a coherent strategic position in May 2026 — governance breadth, licensing freedom, a deliberate rejection of the JavaScript-framework path
evidence: web

claim-4
type: Claim
text: Every serious spending year funded a single engagement, and the one that failed — $45,760 for six "Agile Design Sprints" in 2023 — is the one that bought activity instead of an outcome (F1). The rule: a funded engagement names its deliverable, its completion criterion, and who carries the work after the money stops. The funding model itself is already settled and deliberate — independent developers paid from the collective while the maintaining firms stay on client work
evidence: user

claim-5
type: Claim
text: The Core Team holds explicit technical authority and the community meets weekly, yet no decision reaches a public artifact: the roadmap board is a changelog wearing a roadmap's name, and the clearest statement of project strategy lives on a consultancy's marketing blog (S1). A prospective adopter finds a well-kept record that the project had a past and no evidence it has a future. The rule: each Core Team decision lands within a month as a status post or a forward-looking roadmap item. This is publication, not governance — the decisions may already be getting made; nothing about them is visible. The blog has already half-resumed on its own, with one release announcement in May 2026
evidence: web

claim-6
type: Claim
text: When the 2025 funded developer stopped, seven admin pull requests went stale where they sat, and the project's only rescue so far was one contributor volunteering by hand a year later (F3). That rescue worked — it moved to a fresh pull request on 30 July 2026, with the reviewer's preferred approach adopted
evidence: observed

claim-7
type: Claim
text: Solidus is born. Stembolt, an agency, forks Spree 2.4 because it dislikes where Spree is heading. The founding promise is stability, easy upgrades and backwards compatibility
evidence: web

claim-8
type: Claim
text: Spree is acquired by First Data and development stops entirely. The fork looks prescient; much of the Spree community migrates to Solidus
evidence: web

claim-9
type: Claim
text: The first steward leaves. Stembolt is acquired by JUUL Labs and stops working on Solidus. Nebulab picks up stewardship
evidence: web

claim-10
type: Claim
text: Funding runs through Open Collective. Agencies and merchants sponsor monthly. Sponsors also start cancelling — seven in 2019, seven in 2020, seven in 2021. This attrition never stops
evidence: observed

claim-11
type: Claim
text: The new admin begins. Work starts on solidus_admin to replace the ageing interface
evidence: observed

claim-12
type: Claim
text: $45,760 is spent on it. Six payments of $6,000 to Nebulab for "Agile Design Sprints," plus $9,760 for a redesign analysis. 2023 becomes the project's biggest year: 1,810 commits, roughly 60% from Nebulab's people
evidence: observed

claim-13
type: Claim
text: Nebulab's engineering collapses. Their lead developer goes from 696 commits to 46. Admin work drops from 618 commits to 205. No announcement is ever made
evidence: observed

claim-14
type: Claim
text: A second parallel rewrite starts: solidus_promotions, alongside the existing promotions engine. Neither becomes the default
evidence: observed

claim-15
type: Claim
text: Spree returns commercially. Version 5.0 splits into a free edition and a paid Enterprise Edition backed by Vendo
evidence: web

claim-16
type: Claim
text: Solidus starts publishing monthly status updates. One person — Eugene Chaikin — is publicly named as the one advancing the new admin. He will write 78% of that year's admin commits
evidence: web

claim-17
type: Claim
text: Solidus starts publishing monthly status updates. One person — Eugene Chaikin — is publicly named as the one advancing the new admin. He will write 78% of that year's admin commits
evidence: observed

claim-18
type: Claim
text: The last expense is paid. Funded development stops. Money keeps arriving; nothing goes out again
evidence: observed

claim-19
type: Claim
text: The monthly updates stop. After five issues, the status-post cadence ends. One release announcement follows in May 2026, then silence again
evidence: web

claim-20
type: Claim
text: Solidus v4.7.0 ships — Ruby 3.2+, Rails 7.2+, with CI already covering Rails 8.1 and Ruby 4.0, each adopted within weeks of its release
evidence: observed

claim-21
type: Claim
text: Solidus v4.7.0 ships — Ruby 3.2+, Rails 7.2+, with CI already covering Rails 8.1 and Ruby 4.0, each adopted within weeks of its release
evidence: web

claim-22
type: Claim
text: solidus_starter_frontend — a storefront maintained as its own repository for years — is renamed and absorbed into the monorepo as storefront/, bringing a 64-file, 5,510-line test suite with it
evidence: observed

claim-23
type: Claim
text: Spree ships six platform releases in five weeks. Solidus has shipped none since April. The collective's balance sits unspent. Two firms supply 78% of the funding. The new admin is at version 0.4 with its main screens switched off
evidence: observed

claim-24
type: Claim
text: The project answers. The draft posted to the project's Slack draws a Core Team reply within the hour — "not 100% accurate… but it is definitely helpful to see how the public state of the project looks when taken in aggregate" — and the two most valuable unknowns get answers
evidence: user

claim-25
type: Claim
text: Re-verified for this revision: still no outgoing expense — thirteen months now — with $133,750 held; the meta-gem unchanged; the orphaned-PR rescue moved to a fresh pull request on 30 July
evidence: observed

claim-26
type: Claim
text: Solidus's finances are entirely public, which is unusual and useful — this section rests on records rather than guesses. All figures from the Open Collective API
evidence: observed

claim-27
type: Claim
text: Host and payment-processing fees (residual, computed on the 25 Jul snapshot)
evidence: inferred

claim-28
type: Claim
text: Cumulative totals flatter the picture badly, because they include sponsors who left years ago. The honest number is active recurring contributions, of which there are nine, totalling $1,931 per month — a set re-confirmed unchanged on the August 2026 billing cycle
evidence: observed

claim-29
type: Claim
text: Over thirty sponsors have cancelled, including large ones: Engine Commerce ($1,000/month), Modded Euros ($850 across three subscriptions), Firstleaf ($325), Magmalabs ($325) and Deseret Book ($200). Most are merchants rather than agencies — actual stores that stopped paying
evidence: observed

claim-30
type: Claim
text: In every year the project spent seriously, essentially all of it went to a single engagement
evidence: observed

claim-31
type: Claim
text: Six payments of $6,000 each to Nebulab, every one labelled "Solidus Admin Dashboard Agile Design Sprint 1–6," plus $9,760 to Andrea Iurisci for an "Admin Panel Redesign Analysis"
evidence: observed

claim-32
type: Claim
text: Funded development continued after that — $32,506 to a Dutch company across 16 invoices in late 2024, $16,888 to an anonymized payee across six invoices in the first half of 2025 — then stopped completely with the expense paid on 5 July 2025. Thirteen months of income have arrived since, with nothing going out. Re-checked 8 August 2026: the most recent debit in the ledger is still the July 2025 invoice
evidence: observed

claim-33
type: Claim
text: A first pass looked only at paid expenses, which would have missed money approved and awaiting payout. Querying every state returned 67 expenses: 64 paid, 3 rejected, and none pending, approved or processing. The most recent expense of any status is from July 2025. So nothing is committed and in flight
evidence: observed

claim-34
type: Claim
text: The 8 August re-check read the debit ledger again and found the same picture; the one thing it could not read unauthenticated is expenses submitted but not yet approved, a limit noted rather than hidden
evidence: observed

claim-35
type: Claim
text: Two reconciliation gaps remain open and are worth naming. The 64 paid expenses sum to $143,158, against a reported total spend of $154,612 — an $11,453 difference, most plausibly payout fees. And received-minus-spent exceeds the balance by $42,885, or 13% of everything received, consistent with a host fee plus payment processing. Neither is verified
evidence: inferred

claim-36
type: Claim
text: Seven people are administrators on Open Collective and can approve expenses: tvdeyen, Gregor MacDougall, Alberto Vena (Nebulab), Matteo Latini, Andrea Iurisci, Alessandro Desantis (Nebulab co-founder) and Jared Norman (Super Good)
evidence: observed

claim-37
type: Claim
text: A related theory — that the sponsorship was a play for voting power — does not survive the mechanics. Voting weight equals monthly contribution, capped at 1000; Nebulab and Super Good are tied at $750 and neither has spent the extra $250 that would max the cap. Votes govern only how funds are spent and who becomes an advisor; they confer no authority over what code gets merged. And the economics run $44k the wrong way
evidence: observed

claim-38
type: Claim
text: At rev 25 the arm's-length standard this finding said was missing turned out to exist as a stated norm: maintainers prefer not to take collective money at all — "I prefer to avoid any perception that those of us maintaining Solidus are profiting directly from the OpenCollective funding" — and funds-to-agencies work is fine "as long as it's transparent and fairly priced," with skilled third parties preferred
evidence: user

claim-39
type: Claim
text: The defaults column was re-checked on 8 August 2026: the meta-gem still names solidus_api, solidus_backend, solidus_core, solidus_legacy_promotions and solidus_sample, and still omits solidus_admin and solidus_promotions
evidence: observed

claim-40
type: Claim
text: The gem ships a 190-line migration guide covering installation, migrating existing promotion data, switching store behaviour, syncing legacy order promotions, handling custom storefronts, porting custom rules, and finally removing the legacy gem from the Gemfile
evidence: observed

claim-41
type: Claim
text: Eleven commits over six weeks, by four people from two organizations including Alberto Vena of Nebulab
evidence: observed

claim-42
type: Claim
text: What arrived with it was not a seven-week-old skeleton. solidus_starter_frontend had been maintained as its own repository for years, and it brought 64 spec files and 5,510 lines of tests — components, controllers, helpers, mailers, request specs including authorization, and 19 system specs covering authentication and caching. Those specs are copied into every generated store, and CI installs a store and runs them end to end on every push
evidence: observed

claim-43
type: Claim
text: The residual cost is real but narrower than earlier stated: two promotion engines account for 205 test files covering the same domain, and every new installation still carries two admins
evidence: observed

claim-44
type: Claim
text: For a commerce platform, the most persuasive evidence is a real store. A search of public repositories depending on Solidus returns roughly thirty results
evidence: observed

claim-45
type: Claim
text: Jared Norman named this himself in How to Fail at Solidus, observing that many Solidus implementations remain invisible to the community
evidence: web

claim-46
type: Claim
text: Solidus keeps optional capabilities in separate repositories. Of the 35 in the official organization, those still worked on in 2026 are payments (Stripe, PayPal), subscriptions, authentication, translations and developer tooling. Dormant since October 2023: the GraphQL API, webhooks, and the old storefront
evidence: observed

claim-47
type: Claim
text: Nebulab supplied roughly 1,096 of 1,810 commits in 2023 — about 60% — and roughly 3 of 223 in 2026. No announcement of this transition was ever made publicly; extensive searching found nothing
evidence: web

claim-48
type: Claim
text: They remain a 27-person operating consultancy and still pay the top sponsorship tier. But their services page now lists "Shopify Development" at exactly equal weight with "Solidus Development"
evidence: web

claim-49
type: Claim
text: Two things in the governance document are worth quoting exactly, because together they define the gap precisely
evidence: observed

claim-50
type: Claim
text: The public roadmap board holds 76 items — 65 merged pull requests and 7 closed issues, against 3 open forward-looking ones. It records what was done
evidence: observed

claim-51
type: Claim
text: The blog ran monthly status updates from May to October 2025, went quiet, and has published one release announcement since — for v4.7, in May 2026
evidence: web

claim-52
type: Claim
text: Limit of this finding: I did not establish whether meeting minutes exist somewhere non-public. The claim here is only that no record is discoverable from outside
evidence: inferred

claim-53
type: Claim
text: Do not read all 40 open pull requests as maintainer neglect. In April 2026 Jared Norman posted an announcement explaining a sudden wave of first-time contributions: an online job board had been setting candidates the task of fixing Solidus issues as a screening step
evidence: observed

claim-54
type: Claim
text: The repository has no SECURITY.md, which invites the conclusion that a payments framework is running without a disclosure policy. It is not. The policy lives at organization level and points to a published process that is considerably stronger than most projects this size manage
evidence: observed

claim-55
type: Claim
text: The repository has no SECURITY.md, which invites the conclusion that a payments framework is running without a disclosure policy. It is not. The policy lives at organization level and points to a published process that is considerably stronger than most projects this size manage
evidence: web

claim-56
type: Claim
text: There is a track record behind it: five published advisories between 2020 and 2022, severity-rated, one carrying a CVE
evidence: observed

claim-57
type: Claim
text: Two observations worth keeping. First, the supported-versions list is current — it names 4.7, released April 2026 — so this policy is being maintained while the roadmap is not. It is a fair signal of what this project keeps up when it judges the stakes high enough. Second, no advisory has been published since 2022. That is four quiet years, which could mean nothing was found or could mean the process has gone as quiet as the rest; nothing here distinguishes the two
evidence: inferred

claim-58
type: Claim
text: github/CODEOWNERS contains one rule: * @solidusio/core-team
evidence: observed

claim-59
type: Claim
text: What I could not verify: branch-protection settings and core-team membership both require organization admin scope, and returned permission errors rather than absences. So the review requirement rests on the published policy
evidence: web

claim-60
type: Claim
text: Rails 8 ships Propshaft as the default asset pipeline; Sprockets is the previous generation
evidence: web

claim-61
type: Claim
text: Solidus core hard-requires Sprockets
evidence: observed

claim-62
type: Claim
text: The install path is already covered by continuous integration, and thoroughly. solidus_installer.yml runs on every push and pull request to main and it installs the native image library, runs the real installer with real flags, boots the application and asserts the homepage renders, verifies the resolved payment-gem version, and then runs the generated application's own test suite with coverage reporting. A second workflow covers the extension-generator path
evidence: observed

claim-63
type: Claim
text: Continuous integration is green on an install path the documentation does not describe. The official guide gives two commands. CI quietly performs three. A developer following the guide hits precisely the bug that CI works around — and the explanation lives in a code comment rather than anywhere a user reads
evidence: observed

claim-64
type: Claim
text: The fix Solidus is implicitly waiting on sits unmerged in a gem that has not shipped in two years and has already been superseded upstream
evidence: observed

claim-65
type: Claim
text: The fix Solidus is implicitly waiting on sits unmerged in a gem that has not shipped in two years and has already been superseded upstream
evidence: web

claim-66
type: Claim
text: Solidus has no package.json, no lockfile, and no npm dependency graph anywhere in the repository
evidence: observed

claim-67
type: Claim
text: Spree, by contrast, carries package.json, pnpm-lock.yaml, a pnpm workspace, Turborepo and Biome, plus eleven JavaScript packages
evidence: observed

claim-68
type: Claim
text: The new admin's package definition declares a hard dependency on solidus_backend — the old admin — and its components link out to old-admin web addresses for adjustments, stock movements and store-credit history
evidence: observed

claim-69
type: Claim
text: What makes this sharper is that a completion checklist already existed. Issue #5391, opened September 2023 and still open, sets out the porting plan with an explicit sequencing rationale — "We want to tackle the easy pages first, so we can slowly improve and augment our UI kit components and then reuse it to migrate more complex pages (e.g. promotions)" — followed by a task list
evidence: observed

claim-70
type: Claim
text: Note what that checklist is: the six easiest screens in the application — and see below for why choosing them first was the mistake. The project did define what finished meant, published it, and then stopped tending the definition. Not one box has been ticked in three years, including for work that is demonstrably complete — re-confirmed on 8 August 2026, all six boxes still empty
evidence: observed

claim-71
type: Claim
text: There was also a public narrative: the Q2 2023 blog post reported that "the new admin experience required some upfront effort; now that the main components have been built, implementing the remaining sections will be easier and faster"
evidence: web

claim-72
type: Claim
text: 2023 authorship of the admin: Elia Schito 370, Rainer Dema 132, Marc Busqué 102, Alberto Vena 6 — roughly 98% from Nebulab's orbit. 2024 dispersed across six people as they wound down. 2025 was carried by a single individual, Eugene Chaikin (who commits as chaimann), with 151 of 193 commits. 2026 has 19 commits across five people and no owner at all
evidence: observed

claim-73
type: Claim
text: Seven pull requests open for a year invite the reading that finished work is waiting on reviewers. Reading the actual threads — commits, inline review comments and conversation — gives a more specific answer
evidence: observed

claim-74
type: Claim
text: The one PR marked ready for review has a live thread. After a conflict notice (July 2025) and a technical objection from a maintainer who preferred native Turbo behaviour over a new library dependency (August 2025), a different contributor stepped in
evidence: observed

claim-75
type: Claim
text: That is a healthy community doing something difficult well: a maintainer conceding a design argument rather than blocking on it, and a contributor volunteering to adopt someone else's stalled work while accepting the reviewer's preferred approach. And the promise was kept: on 30 July 2026 forkata opened #6528 — "Admin confirm modal without external dependency" — the same feature rebuilt the way the reviewer wanted it
evidence: observed

claim-76
type: Claim
text: Incidental observation: a Copilot pull-request reviewer bot left a review on #6232 in May 2025
evidence: observed

claim-77
type: Claim
text: The 132 existing components total 7,716 lines, covering roughly nineteen working screens. A list-only controller runs 30–36 lines with one or two component files
evidence: observed

claim-78
type: Claim
text: A second, independent measure agrees. Because both admins are server-rendered, view templates are a fair proxy for screen surface: the old admin carries 277 ERB templates against the new admin's 111
evidence: observed

claim-79
type: Claim
text: Will Larson's migration playbook — the standard reference on paying technical debt at scale — sets out three phases
evidence: web

claim-80
type: Claim
text: Solidus's porting plan states the opposite strategy in its own words. Issue #5391: "We want to tackle the easy pages first, so we can slowly improve and augment our UI kit components and then reuse it to migrate more complex pages (e.g. promotions)"
evidence: observed

claim-81
type: Claim
text: The predicted failure is exactly the observed one. The easy settings pages were partially ported. Confidence ran ahead of reality — the Q2 2023 post reported that "the main components have been built, implementing the remaining sections will be easier and faster"
evidence: web

claim-82
type: Claim
text: At rev 24 the Core Team answered this finding directly: partial concession on sequencing — "there's an argument to be made that we should have started with the hard stuff first, or at least got to it faster" — but a dispute on the stakes: "viability isn't a concern… I don't think anyone is worried that building them isn't possible. As the project is pre-1.0, churn isn't that big of a deal"
evidence: user

claim-83
type: Claim
text: A reasonable theory, and the evidence does not support it. The open issues about the admin are overwhelmingly requests for missing features — "introduce taxonomy creation," "add product specifications," "edit product stock quantity," "enable creating option types" — the signature of incomplete, not disliked. Two usability tickets exist. The May 2025 status update was positive about the work
evidence: observed

claim-84
type: Claim
text: A reasonable theory, and the evidence does not support it. The open issues about the admin are overwhelmingly requests for missing features — "introduce taxonomy creation," "add product specifications," "edit product stock quantity," "enable creating option types" — the signature of incomplete, not disliked. Two usability tickets exist. The May 2025 status update was positive about the work
evidence: web

claim-85
type: Claim
text: One correction of the folk narrative, from the Core Team at rev 24: there never was a founding feud. After the split the projects collaborated directly for a while — especially on security issues that affected both — and the lines broke down later, with strategy shifts and the changeover in who ran this project. "The only real 'drama' is just that they use Solidus projects as case studies on the Spree site"
evidence: user

claim-86
type: Claim
text: The present tense, from the same voice at rev 25: "very different approaches," disagreement on licensing and technical strategy, and "no beef these days, though. Just different directions"
evidence: user

claim-87
type: Claim
text: Spree's free edition includes the storefront, checkout, sales channels, stock reservations, order routing and the APIs. The Enterprise Edition adds three separately licensed commercial modules — marketplace, B2B, multi-tenant — plus a support tier with graded response-time guarantees, long-term support releases and 24/7 monitoring
evidence: web

claim-88
type: Claim
text: No pricing is published; one third-party estimate puts year-one licence and implementation in the five-to-six figures
evidence: web

claim-89
type: Claim
text: This is structural, not circumstantial. Spree's open-source work is a marketing and R&D cost carried on an enterprise profit-and-loss; Solidus's is carried on a donation pot taking in about $25k a year. A community-governed collective cannot replicate that model without ceasing to be one
evidence: inferred

claim-90
type: Claim
text: Spree publishes AI-agent skills installable in one command, runs a documentation MCP server, and advertises its command-line tool as working "hands-free for AI agents." Internally it carries agent instruction files, committed permissions, hooks and version-locked skills
evidence: observed

claim-91
type: Claim
text: Spree publishes AI-agent skills installable in one command, runs a documentation MCP server, and advertises its command-line tool as working "hands-free for AI agents." Internally it carries agent instruction files, committed permissions, hooks and version-locked skills
evidence: web

claim-92
type: Claim
text: Solidus has none of this — re-confirmed 8 August 2026: the repository root still carries no agent instruction file of any kind
evidence: observed

claim-93
type: Claim
text: Fair caveat: causation is unproven. Spree also has commercial funding, so the harness may be a symptom of resources rather than a cause of throughput. And one third-party article claims Spree's activity surge is "primarily driven by LLM-generated contributions"
evidence: web

claim-94
type: Claim
text: Spree relaunched commercially in April 2025. Solidus's sponsor cancellations run 7 · 7 · 7 · 4 · 5 · 2 · 5 · 2 per year from 2019 — with 2024 and 2026 the two lowest years on record. There is no post-relaunch exodus. Nebulab's engineering had already collapsed in 2024, a full year before Spree 5.0
evidence: observed

claim-95
type: Claim
text: Solidus's technical direction is not unwritten, and it is easy to miss because of where it lives. The lead maintainer published it on 12 May 2026, in a post comparing Solidus and Spree
evidence: web

claim-96
type: Claim
text: The May 2025 status update promised to "double-down on the existing GitHub project called Roadmap" for transparency. They did keep it alive — it was updated in June 2026. But of its 76 items, 65 are merged pull requests and 7 are closed issues. Exactly three open issues and one open pull request are forward-looking, and one of those three is a housekeeping item last touched in May 2025
evidence: observed

claim-97
type: Claim
text: The project plainly can run a migration well. Promotions ships a 190-line guide covering data migration, behaviour switching, custom rules and legacy removal, plus an explicit advisory to migrate now. The storefront was absorbed cleanly in six weeks by four people from two organizations
evidence: observed

claim-98
type: Claim
text: Nebulab went from ~60% of commits to ~1%, with no public announcement
evidence: observed

claim-99
type: Claim
text: Nebulab went from ~60% of commits to ~1%, with no public announcement
evidence: web

claim-100
type: Claim
text: And this is the second occurrence. Stembolt was acquired in 2018 and walked away too. The 2018 handover succeeded only because a willing successor happened to exist. The custody chain reads Stembolt → Nebulab → nobody
evidence: inferred

claim-101
type: Claim
text: Narrower than a repository-only reading suggests. Solidus runs a HackerOne disclosure program, automated security dependency updates, an 18-month patch window across three supported versions, two mandatory reviews before merge, and multi-factor authentication on release accounts (§07)
evidence: web

claim-102
type: Claim
text: What remains is the gap around it: no automated routine version bumps and no bundler-audit step in the build, so ordinary dependency drift accumulates between security events and is caught only when someone looks
evidence: observed

claim-103
type: Claim
text: Code concentration and funding concentration are the same dependency seen from two sides. The largest individual contributor commits from a personal address with no organization behind him. One of the two firms now markets Shopify work at equal weight with Solidus
evidence: observed

claim-104
type: Claim
text: Code concentration and funding concentration are the same dependency seen from two sides. The largest individual contributor commits from a personal address with no organization behind him. One of the two firms now markets Shopify work at equal weight with Solidus
evidence: web

claim-105
type: Claim
text: Three years, version 0.4, 19 commits so far in 2026, both admins in every installation, and the architecture actively hides the problem. Rev 24, from the Core Team: the admin is alive and deliberately paced — real stores run it incomplete today, and work "will resume at pace once we have our new candidate in place"
evidence: user

claim-106
type: Claim
text: That is exactly the answer §22 said would move this risk from high to low, and it does — with one reservation: the drop rests on a stated intention, and only the falsifier closes the risk. The next outgoing ledger expense is the observable that confirms the candidate, and as of 8 August 2026 it has not appeared — the ledger's last debit is still July 2025
evidence: observed

claim-107
type: Claim
text: At rev 25 the intention gained a second leg: "The Admin is a priority," and the candidate model is deliberate — independent devs funded from the collective while the maintaining firm stays on client work
evidence: user

claim-108
type: Claim
text: Measured in §09. Note this ranks below R1–R3 despite high impact, precisely because it is loud and public — the project will see it happening. What I cannot establish is whether merchants are actually switching: cumulative downloads still favour Solidus, and per-release download rates are distorted by Spree's faster release cadence
evidence: observed

claim-109
type: Claim
text: Its own README states that extensions relying on the old storefront "will not work with this storefront." Impact medium, likelihood certain — a stated property rather than a hazard
evidence: observed

claim-110
type: Claim
text: Solidus, from its own documentation: create a Rails app, add the gem, hand-write an asset manifest file, run a generator, and possibly hand-build the CSS because "this issue typically occurs when you bundle from a branch." Then arrive in an admin that cannot open an order
evidence: observed

claim-111
type: Claim
text: More decisively, the project's own largest contributor publicly disclaims this segment. Jared Norman's How to Fail at Solidus (Nov 2024) states that Solidus suits high-volume stores, large catalogs and marketplaces — not simple small shops
evidence: web

claim-112
type: Claim
text: Tick the boxes on #5391 that the code shows are already done — Settings > Zones has had full CRUD for some time. A checklist nobody updates says the work stopped; the same checklist current says it did not. Re-confirmed still unticked on 8 Aug 2026
evidence: observed

claim-113
type: Claim
text: The Core Team already holds technical authority. The stakeholder group already meets weekly. The project already owns two channels built to carry public direction — a roadmap board and a blog. Nothing needs to be created; two dormant things need restarting. The blog has even stirred on its own: one release announcement in May 2026, then quiet again
evidence: web

claim-114
type: Claim
text: Why the 2025 engagement was not renewed. The most valuable unknown in the report. The project has funded a developer three separate times (2020, 2024, 2025) and stopped three separate times, with completely dry years in between. So the question is not "why did funding stop" — stopping is normal here — but why this gap has run thirteen months when previous ones were eventually filled. Budget caution, a contractor moving on, a deliberate pause, or simply nobody proposing the next engagement all produce an identical ledger and imply opposite responses. Answered at rev 24: "No candidate. We have a new candidate in the works right now, but don't have anything to share other than that we are working on it"
evidence: user

claim-115
type: Claim
text: Who "Logicielle B.V." and "e.c441" are. Together they received $49,394 — nearly a third of all money ever disbursed — across 2024 and 2025. Identity is not resolvable from public records, and it determines whether that spending bought continuity or one-off work. Context at rev 25: external payees are the stated preference, not an anomaly — the collective deliberately funds independent devs with Solidus experience so maintainers stay clear of the money
evidence: user

claim-116
type: Claim
text: Whether the Core Team considers the new admin alive. Inferred entirely from commit decay. A maintainer might say it is intentionally paced. This single answer moves R3 from high to low. Answered at rev 24: alive and deliberately paced — real stores use the incomplete admin in production today, a usage signal invisible to this audit's commit-decay reading
evidence: user

claim-117
type: Claim
text: Targeted searches for reporting on Solidus stalling, being abandoned, or losing ground to Spree returned nothing — re-run on 8 August 2026 with the same result
evidence: web

claim-118
type: Claim
text: The courtesy window narrowed the limit without removing it. One Core Team member — Jared Norman, Super Good — answered in the project's Slack, and his verdict on the report doubles as its epistemic status: "Being based on publicly available information, it's not 100% accurate and I don't necessarily agree with all of the assessments here, but it is definitely helpful to see how the public state of the project looks when taken in aggregate"
evidence: user

Routine dependency drift between security releases
type: risk
code: R1
status: open
checked at: 2026-07-25
flag: downgraded
happens: Stale transitive dependencies age quietly; the exposure window before a disclosed issue is noticed widens
likelihood: Low for disclosed vulnerabilities — that path is covered. Medium for drift
notice: For a disclosed CVE, yes. For gradual drift, no
cost: Moderate, not critical
falsifier: A Renovate or Dependabot version-update config landing, which would close this entirely

Two firms are 78% of the money and most of the code
type: risk
code: R2
status: open
checked at: 2026-07-25
flag: hard to detect
happens: Losing either firm removes ~39% of funding and a large share of throughput at once
likelihood: Medium — this has already happened twice
notice: Not for months. A departure looks exactly like a quiet quarter
cost: High
falsifier: Six consecutive months where no single party exceeds 25% of merged commits

The half-built admin becomes a permanent third state
type: risk
code: R3
status: open
checked at: 2026-07-25
flag: hard to detect
happens: The primary evaluation surface for new adopters stays broken, and the maintenance bill doubles indefinitely
likelihood: High — it is the current trajectory
notice: No. Every signal a maintainer looks at is green
cost: High and rising as the old admin ages
falsifier: Version 1.0 becoming the default — or a recorded decision to cancel it

Spree takes the new-project market
type: risk
code: R4
status: open
checked at: 2026-07-25
flag: easy to see coming

The new storefront breaks existing extensions by design
type: risk
code: R5
status: open
checked at: 2026-07-25

Three unfinished rewrites
type: debt
code: D1
status: open
checked at: 2026-07-25
kind: strategic

Governance describes a project that no longer exists
type: debt
code: D2
status: open
checked at: 2026-07-25
kind: organizational

Architectural decisions are never recorded
type: debt
code: D3
status: open
checked at: 2026-07-25
kind: knowledge

The agent harness, and two small automation gaps
type: debt
code: D4
status: open
checked at: 2026-07-25
kind: technical

Test matrix including unreleased Rails 8.1 and Ruby 4.0
type: credit
code: C1
status: settled
checked at: 2026-07-25

Deprecation build gate
type: credit
code: C2
status: settled
checked at: 2026-07-25

Automated back-porting
type: credit
code: C3
status: settled
checked at: 2026-07-25

Automated code style
type: credit
code: C4
status: settled
checked at: 2026-07-25

Release and changelog automation
type: credit
code: C5
status: settled
checked at: 2026-07-25

Reproducible development environment
type: credit
code: C6
status: settled
checked at: 2026-07-25

The storefront
type: credit
code: C7
status: settled
checked at: 2026-07-25

solidus_promotions
type: credit
code: C8
status: open
checked at: 2026-07-25
realized: false
realization: overdue

solidus_admin
type: credit
code: C9
status: open
checked at: 2026-07-25
realized: false
realization: past the point of write-off

Migrations are engineered but never scheduled
type: root-cause
code: RC1
status: open
checked at: 2026-07-25
ensures: A migration can stall indefinitely without anyone noticing

The steward changed in the code but not in the governance
type: root-cause
code: RC2
status: open
checked at: 2026-07-25
ensures: That one of the stalled migrations is exactly what happens next

Treat this as an existing-system audit, with single-decision depth on t…
type: decision
code: DEC01
status: standing
checked at: 2026-07-25

A deliberate strategy does exist — compatibility, merge authority and m…
type: decision
code: DEC02
status: superseded
checked at: 2026-07-25
was: Open with agent-harness engineering, on the grounds that no deliberate strategy exists.

The policy exists at organization level and was found by widening the s…
type: decision
code: DEC03
status: withdrawn
checked at: 2026-07-25
was: Report “no security policy for a payments framework” as a risk.

File the governance/reality mismatch as a debt, not a risk. (Accepted —…
type: decision
code: DEC04
status: standing
checked at: 2026-07-25

67 expenses totalling $154,612 say the mechanism works and was already…
type: decision
code: DEC05
status: superseded
checked at: 2026-07-25
was: Frame the $132,180 balance as capital nobody has a mechanism to spend.

Corrected against the API — $329,677 received, $154,612 spent, and the…
type: decision
code: DEC06
status: superseded
checked at: 2026-07-25
was: Cite “$26,322 annual budget” and “$287,359 raised” from the rendered donation page.

Wrong. Six of seven pull requests are drafts never submitted for review…
type: decision
code: DEC07
status: superseded
checked at: 2026-07-25
was: The stalled 2025 admin work is finished and blocked at review; reviewer capacity is the bottleneck.

Misleading — order and product editing are switched off, six controller…
type: decision
code: DEC08
status: superseded
checked at: 2026-07-25
was: Report the new admin as “64% complete by controller count.”

Wrong measure. There is no package.json, no lockfile and no npm graph.…
type: decision
code: DEC09
status: superseded
checked at: 2026-07-25
was: Describe Solidus as paying polyglot costs, citing 246 JavaScript files.

Count correct, implication wrong — it reads as a recent exodus. It is s…
type: decision
code: DEC10
status: superseded
checked at: 2026-07-25
was: “Thirty-plus sponsors have cancelled, so the base rate is not hypothetical.”

Reject the theory that Nebulab's sponsorship was a play for voting powe…
type: decision
code: DEC11
status: standing
checked at: 2026-07-25

Decline to characterize the Nebulab payments as extraction. (Net contri…
type: decision
code: DEC12
status: standing
checked at: 2026-07-25

Reject "Spree caused the decline." (Cancellations are steady from 2019…
type: decision
code: DEC13
status: standing
checked at: 2026-07-25

Decline to claim new merchants are choosing Spree over Solidus. (Not me…
type: decision
code: DEC14
status: standing
checked at: 2026-07-25

Reframe the report from "how to recover" to "choose a role." (Accepted…
type: decision
code: DEC15
status: standing
checked at: 2026-07-25

Over-generalized from one case. Promotions ships a 190-line migration g…
type: decision
code: DEC16
status: superseded
checked at: 2026-07-25
was: “Three unfinished rewrites” as a systemic pattern, generating root cause RC1.

It is written — the lead maintainer published it on 12 May 2026. This r…
type: decision
code: DEC17
status: superseded
checked at: 2026-07-25
was: Treat the project's technical direction as unwritten and derive it.

Vector removed entirely. "Director" covers business and organizational…
type: decision
code: DEC18
status: withdrawn
checked at: 2026-07-25
was: Treat the governance document's description of Nebulab's role as a finding at all (the governance-title strategy row, its bet, and its pre-mortem entry).

Partly external. A job board was setting candidates Solidus issues as a…
type: decision
code: DEC19
status: superseded
checked at: 2026-07-25
was: Read the 40 open pull requests as evidence of review neglect.

Wrong prescription for the mode. Unowned, undated work is the normal co…
type: decision
code: DEC35
status: superseded
checked at: 2026-07-25
was: RC1: “the gates were built; nobody is accountable for closing them, and no calendar says when.”

Metadata was misleading; the threads say more. Five chaimann drafts hav…
type: decision
code: DEC34
status: superseded
checked at: 2026-07-25
was: All seven stalled admin PRs characterized from API metadata: “the author never returned,” “reviewers engaged wherever they were asked.”

Wrong twice. The file exists and works, so marking it absent was incorr…
type: decision
code: DEC33
status: superseded
checked at: 2026-07-25
was: “Differentiated code ownership ✗ — CODEOWNERS is a single catch-all line.”

Diagnose the admin's sequencing against Larson's migration playbook, an…
type: decision
code: DEC32
status: standing
checked at: 2026-07-25

A definition existed. Issue #5391 (open since Sept 2023) publishes the…
type: decision
code: DEC31
status: superseded
checked at: 2026-07-25
was: The $45,760 admin purchase shows “the project's missing completion gate appearing in a purchase order rather than in code” — no definition of finished existed.

Wrong, and it was the top-ranked risk. The published security policy sh…
type: decision
code: DEC30
status: superseded
checked at: 2026-07-25
was: R1, ranked first: “no automated dependency updating and no vulnerability audit step — a vulnerable dependency reaches every store, and you would learn from a downstream report.”

Every one double-counted. The count included _spec.rb, so the Ruby and…
type: decision
code: DEC29
status: superseded
checked at: 2026-07-25
was: Component table “Ruby files” figures: 855 / 328 / 278 / 193 / 166 / 98.

Overstated. The document assigns the Core Team "final decision as to wh…
type: decision
code: DEC28
status: superseded
checked at: 2026-07-25
was: “The governance document defines no mechanism whatsoever for deciding technical direction, so no forum has the standing to decide the admin's fate.”

Wrong, and it inverted the finding. It holds 64 spec files and 5,510 li…
type: decision
code: DEC27
status: superseded
checked at: 2026-07-25
was: The new storefront has zero tests.

Misleading — reading across a row produced false statements ("2020 · Lo…
type: decision
code: DEC26
status: superseded
checked at: 2026-07-25
was: Present spending as one table combining year-by-year totals with all-time recipient totals.

Re-verify the $132,180 balance under challenge. (Survived, and strength…
type: decision
code: DEC24
status: standing
checked at: 2026-07-25

Softened. That figure covers the Open Collective account only. Donated…
type: decision
code: DEC25
status: superseded
checked at: 2026-07-25
was: “$132,180 sitting idle” as a characterization of the project's investment.

Wrong — it already exists and is stronger. The installer workflow boots…
type: decision
code: DEC21
status: superseded
checked at: 2026-07-25
was: Recommend adding CI that verifies the installation path.

Locate the real gap: CI is green on an undocumented install path. (The…
type: decision
code: DEC22
status: standing
checked at: 2026-07-25

Ten of the twelve are view templates responding to AJAX requests, which…
type: decision
code: DEC23
status: superseded
checked at: 2026-07-25
was: Count 12 ERB asset files as Propshaft blockers.

Add the Rails-generation gap as a distinct finding. (Rails 8 defaults t…
type: decision
code: DEC20
status: standing
checked at: 2026-07-25

Reject the JavaScript-framework direction on purpose. Simplicity, one s…
type: strategy
code: S1
status: standing
checked at: 2026-07-25
state: on the lead maintainer's company blog
health: The project's actual strategy — stated, just not here

Never break an existing store. Deprecate before removing; back-port fix…
type: strategy
code: S2
status: standing
checked at: 2026-07-25
state: ratified
health: Holding — at a cost nobody has priced

Ship replacements alongside the old version as opt-in, with a written m…
type: strategy
code: S3
status: standing
checked at: 2026-07-25
state: in the gems, not the governance
health: Working — see the promotions migration guide

Core stays lean; capabilities live in separate extensions.
type: strategy
code: S4
status: standing
checked at: 2026-07-25
state: nowhere
health: Weakening — four official extensions dormant

Merge authority belongs to a self-appointing Core Team. Money buys vote…
type: strategy
code: S5
status: standing
checked at: 2026-07-25
state: ratified
health: Yes — the separation is deliberate and healthy

Quality is enforced by machines; style is not argued about.
type: strategy
code: S6
status: standing
checked at: 2026-07-25
state: only in CI config
health: The best-functioning rule in the project

All delivery is done by humans.
type: strategy
code: S7
status: standing
checked at: 2026-07-25
state: by omission
health: Untested — no agent harness exists

Restart funded development — buying an outcome, not sprints
type: bet
code: B2
status: open
checked at: 2026-07-25
verdict: Do
cost: one meeting agenda item

Routine dependency-update automation (security updates already run)
type: bet
code: B3
status: open
checked at: 2026-07-25
verdict: Cheap
cost: a config file

Agent harness, scoped to executing →B3 (Routine dependency-update autom…
type: bet
code: B4
status: open
checked at: 2026-07-25
verdict: Do
cost: ~a day

Name the release that removes legacy promotions — a policy statement, n…
type: bet
code: B5
status: open
checked at: 2026-07-25
verdict: Do
cost: free

Decide the admin — by manufacturing the evidence, not deliberating with…
type: bet
code: B6
status: open
checked at: 2026-07-25
verdict: Decide
cost: one hard screen

Match Spree's React storefront
type: bet
code: B7
status: open
checked at: 2026-07-25
verdict: Kill
cost: —

GraphQL / headless surface
type: bet
code: B8
status: open
checked at: 2026-07-25
verdict: Wait
cost: —

Dual asset-pipeline support, with an agent-executed migration
type: bet
code: B9
status: open
checked at: 2026-07-25
verdict: Do
cost: see template
review date: 2027-01-25

Publish technical decisions — restart the status posts, file forward-lo…
type: bet
code: B10
status: open
checked at: 2026-07-25
verdict: Do
cost: an hour a month

withdrawn — numbering keeps the gap
type: bet
code: B1
status: withdrawn
checked at: 2026-07-25

A definition of "finished" existed, and the money was not wired to it
type: factor
code: F1
status: open
checked at: 2026-07-25

Built by one organization, handed to nobody
type: factor
code: F2
status: open
checked at: 2026-07-25

The last developer's work was abandoned mid-flight
type: factor
code: F3
status: open
checked at: 2026-07-25

solidusio/solidus @ cdcdfaf (audited checkout)
type: source
code: src-checkout
status: settled
mirror: https://github.com/solidusio/solidus/tree/cdcdfaf333c196c746d538c155762d0237189444
checked at: 2026-07-21
uri: https://github.com/solidusio/solidus/tree/cdcdfaf333c196c746d538c155762d0237189444

slack.solidus.io
type: source
code: src-slack-solidus-io
status: settled
uri: http://slack.solidus.io
checked at: 2026-07-25

github.com/solidusio/solidus
type: source
code: src-github-com-solidusio-solidus
status: settled
uri: https://github.com/solidusio/solidus
checked at: 2026-07-25

github.com/solidusio/solidus/commits/main
type: source
code: src-github-com-solidusio-solidus-commits-mai
status: settled
uri: https://github.com/solidusio/solidus/commits/main
checked at: 2026-07-25

github.com/solidusio/solidus/releases
type: source
code: src-github-com-solidusio-solidus-releases
status: settled
uri: https://github.com/solidusio/solidus/releases
checked at: 2026-07-25

guides.solidus.io/policies/security
type: source
code: src-guides-solidus-io-policies-security
status: settled
uri: https://guides.solidus.io/policies/security
checked at: 2026-07-25

jardo.dev/how-to-fail-at-solidus
type: source
code: src-jardo-dev-how-to-fail-at-solidus
status: settled
uri: https://jardo.dev/how-to-fail-at-solidus
checked at: 2026-07-25

nebulab.com/services
type: source
code: src-nebulab-com-services
status: settled
uri: https://nebulab.com/services
checked at: 2026-07-25

nebulab.com/team
type: source
code: src-nebulab-com-team
status: settled
uri: https://nebulab.com/team
checked at: 2026-07-25

opencollective.com/solidus
type: source
code: src-opencollective-com-solidus
status: settled
uri: https://opencollective.com/solidus
checked at: 2026-07-25

raw.githubusercontent.com/solidusio/solidus/main/GOVERNANCE.md
type: source
code: src-githubusercontent-com-solidusio-solidus-
status: settled
uri: https://raw.githubusercontent.com/solidusio/solidus/main/GOVERNANCE.md
checked at: 2026-07-25

rubygems.org/gems/solidus
type: source
code: src-rubygems-org-gems-solidus
status: settled
uri: https://rubygems.org/gems/solidus
checked at: 2026-07-25

solidus.io/
type: source
code: src-solidus-io
status: settled
uri: https://solidus.io/
checked at: 2026-07-25

solidus.io/blog
type: source
code: src-solidus-io-blog
status: settled
uri: https://solidus.io/blog
checked at: 2026-07-25

solidus.io/blog/project-status-may-2025
type: source
code: src-solidus-io-blog-project-status-may-2025
status: settled
uri: https://solidus.io/blog/project-status-may-2025
checked at: 2026-07-25

solidus.io/community/
type: source
code: src-solidus-io-community
status: settled
uri: https://solidus.io/community/
checked at: 2026-07-25

solidus.io/security
type: source
code: src-solidus-io-security
status: settled
uri: https://solidus.io/security
checked at: 2026-07-25

spreecommerce.org/enterprise/
type: source
code: src-spreecommerce-org-enterprise
status: settled
uri: https://spreecommerce.org/enterprise/
checked at: 2026-07-25

spreecommerce.org/pricing/
type: source
code: src-spreecommerce-org-pricing
status: settled
uri: https://spreecommerce.org/pricing/
checked at: 2026-07-25

supergood.software/solidus-versus-spree/
type: source
code: src-supergood-software-solidus-versus-spree
status: settled
uri: https://supergood.software/solidus-versus-spree/
checked at: 2026-07-25

The hard screen gets deferred for an easy one
type: premortem
code: P1
status: open
checked at: 2026-07-25
note: most likely
warning: The first screen attempted is one already on the #5391 checklist
mitigation: Name the screen before starting, in public; treat "we learned it does not work" as a successful outcome

Nobody puts the funding decision on an agenda
type: premortem
code: P2
status: open
checked at: 2026-07-25
warning: Two stakeholder meetings pass with no agenda item
mitigation: Send it as a one-page multiple-choice ballot over the three migrations

The harness gets built and nobody uses it
type: premortem
code: P3
status: open
checked at: 2026-07-25
warning: No pull request references it within two release cycles
mitigation: Scope it narrowly to B3 and B5; if those land, it paid for itself

The funded migration is chosen by money, not readiness
type: premortem
code: P4
status: open
checked at: 2026-07-25
warning: A single-choice ballot
mitigation: Multiple choice, producing a ranked list

The diagnosis is wrong and the constraint is attention, not money
type: premortem
code: P5
status: open
checked at: 2026-07-25
note: partly observed already
warning: A second, outcome-shaped funding round also fails to ship
mitigation: If money tied to a completion criterion fails too, cancel the admin

Role A — Steward the installed base
type: option
code: Role-A
status: open
checked at: 2026-07-25

Role B — Contest the agent channel
type: option
code: Role-B
status: open
checked at: 2026-07-25

Role C — Converge with Spree
type: option
code: Role-C
status: open
checked at: 2026-07-25

Why was the 2025 engagement not renewed?
type: question
code: q01
status: open
checked at: 2026-07-25
rank: 1

Why did Nebulab wind down?
type: question
code: q02
status: open
checked at: 2026-07-25
rank: 2

Who are Logicielle B.V. and e.c441?
type: question
code: q03
status: open
checked at: 2026-07-25
rank: 3

Is the balance reserved against something?
type: question
code: q04
status: open
checked at: 2026-07-25
rank: 4

Does the Core Team consider the new admin alive?
type: question
code: q05
status: open
checked at: 2026-07-25
rank: 5

Branch-protection settings and core-team membership
type: question
code: q06
status: open
checked at: 2026-07-25
rank: 6

Does Spree's commit volume reflect human or generated work?
type: question
code: q07
status: open
checked at: 2026-07-25
rank: 7

solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023
type: source
code: src-recon-solidus-5391
status: settled
uri: https://github.com/solidusio/solidus/pull/5391
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #5410 — new admin breaks asset compilation when the host app has Tailwind
type: source
code: src-recon-solidus-5410
status: settled
uri: https://github.com/solidusio/solidus/pull/5410
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6035 — installer may fail silently
type: source
code: src-recon-solidus-6035
status: settled
uri: https://github.com/solidusio/solidus/pull/6035
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6228 — store create/edit draft PR
type: source
code: src-recon-solidus-6228
status: settled
uri: https://github.com/solidusio/solidus/pull/6228
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6232 — shipping methods draft PR
type: source
code: src-recon-solidus-6232
status: settled
uri: https://github.com/solidusio/solidus/pull/6232
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6236 — option types draft PR
type: source
code: src-recon-solidus-6236
status: settled
uri: https://github.com/solidusio/solidus/pull/6236
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6295 — confirmation dialog PR, adopted July 2026
type: source
code: src-recon-solidus-6295
status: settled
uri: https://github.com/solidusio/solidus/pull/6295
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6296 — product categories draft PR
type: source
code: src-recon-solidus-6296
status: settled
uri: https://github.com/solidusio/solidus/pull/6296
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6298 — tax rate create/edit draft PR
type: source
code: src-recon-solidus-6298
status: settled
uri: https://github.com/solidusio/solidus/pull/6298
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6302 — payment methods create/edit draft PR
type: source
code: src-recon-solidus-6302
status: settled
uri: https://github.com/solidusio/solidus/pull/6302
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6327 — installer fails with a Sprockets error
type: source
code: src-recon-solidus-6327
status: settled
uri: https://github.com/solidusio/solidus/pull/6327
reconstructed: true
checked at: 2026-07-29

solidusio/solidus #6516 — align the install instructions with the storefront
type: source
code: src-recon-solidus-6516
status: settled
uri: https://github.com/solidusio/solidus/pull/6516
reconstructed: true
checked at: 2026-07-29

rails/sprockets-rails #546 — warn instead of raising on missing manifest.js
type: source
code: src-recon-sprockets-rails-546
status: settled
uri: https://github.com/rails/sprockets-rails/pull/546
reconstructed: true
checked at: 2026-07-29

Solidus Slack — courtesy-window thread: draft posted, Core Team reply
type: source
code: src-slack-courtesy-2026-08
status: settled
uri: http://slack.solidus.io
checked at: 2026-08-03

Record the courtesy-window answers; stakeholders none reached to partial (rev 24)
type: decision
code: DEC36
status: standing
checked at: 2026-08-03

Record the follow-up answers: admin a priority, funding model deliberate (rev 25)
type: decision
code: DEC37
status: standing
checked at: 2026-08-03

GitHub API re-verification sweep 2026-08-08
type: source
code: src-gh-recheck-2026-08
status: settled
uri: https://api.github.com/repos/solidusio/solidus
checked at: 2026-08-08

Open Collective ledger re-check 2026-08-08
type: source
code: src-oc-ledger-2026-08
status: settled
uri: https://opencollective.com/solidus/transactions
checked at: 2026-08-08

solidus.io blog — status update Solidus v4.7, 5 May 2026
type: source
code: src-blog-v47
status: settled
uri: https://solidus.io/blog/project-status-solidus-v4-7
checked at: 2026-08-08

Superseded: last blog post October 2025 / nine months of silence
type: decision
code: DEC38
status: superseded
checked at: 2026-08-08

Record the rev-26 re-verification, evidence window 2026-08-08
type: decision
code: DEC39
status: standing
checked at: 2026-08-08

Restructure to framework v0.7 at rev 26
type: decision
code: DEC40
status: standing
checked at: 2026-08-08

Rails and Ruby release dates plus Solidus CI adoption commits
type: source
code: src-release-dates
status: settled
uri: https://endoflife.date/rails
checked at: 2026-08-09

Superseded: tested against unreleased Rails and Ruby versions
type: decision
code: DEC41
status: superseded
checked at: 2026-08-09

from: Spree takes the new-project market
rel: DERIVED_FROM
to: Routine dependency drift between security releases

from: Spree takes the new-project market
rel: DERIVED_FROM
to: The half-built admin becomes a permanent third state

from: Architectural decisions are never recorded
rel: DERIVED_FROM
to: Ship replacements alongside the old version as opt-in, with a written m…

from: The steward changed in the code but not in the governance
rel: DERIVED_FROM
to: Never break an existing store. Deprecate before removing; back-port fix…

from: Reject "Spree caused the decline." (Cancellations are steady from 2019…
rel: DERIVED_FROM
to: Match Spree's React storefront

from: Over-generalized from one case. Promotions ships a 190-line migration g…
rel: DERIVED_FROM
to: Migrations are engineered but never scheduled

from: Vector removed entirely. "Director" covers business and organizational…
rel: DERIVED_FROM
to: The steward changed in the code but not in the governance

from: Vector removed entirely. "Director" covers business and organizational…
rel: DERIVED_FROM
to: Built by one organization, handed to nobody

from: Wrong prescription for the mode. Unowned, undated work is the normal co…
rel: DERIVED_FROM
to: Name the release that removes legacy promotions — a policy statement, n…

from: Diagnose the admin's sequencing against Larson's migration playbook, an…
rel: DERIVED_FROM
to: Decide the admin — by manufacturing the evidence, not deliberating with…

from: Wrong, and it was the top-ranked risk. The published security policy sh…
rel: DERIVED_FROM
to: Routine dependency drift between security releases

from: Wrong, and it was the top-ranked risk. The published security policy sh…
rel: DERIVED_FROM
to: The half-built admin becomes a permanent third state

from: Wrong, and it was the top-ranked risk. The published security policy sh…
rel: DERIVED_FROM
to: Two firms are 78% of the money and most of the code

from: Overstated. The document assigns the Core Team "final decision as to wh…
rel: DERIVED_FROM
to: Publish technical decisions — restart the status posts, file forward-lo…

from: Locate the real gap: CI is green on an undocumented install path. (The…
rel: DERIVED_FROM
to: Dual asset-pipeline support, with an agent-executed migration

from: Restart funded development — buying an outcome, not sprints
rel: DERIVED_FROM
to: The half-built admin becomes a permanent third state

from: Restart funded development — buying an outcome, not sprints
rel: DERIVED_FROM
to: Three unfinished rewrites

from: Routine dependency-update automation (security updates already run)
rel: DERIVED_FROM
to: Routine dependency drift between security releases

from: Agent harness, scoped to executing →B3 (Routine dependency-update autom…
rel: DERIVED_FROM
to: The agent harness, and two small automation gaps

from: Agent harness, scoped to executing →B3 (Routine dependency-update autom…
rel: DERIVED_FROM
to: All delivery is done by humans.

from: Agent harness, scoped to executing →B3 (Routine dependency-update autom…
rel: DERIVED_FROM
to: Routine dependency-update automation (security updates already run)

from: Agent harness, scoped to executing →B3 (Routine dependency-update autom…
rel: DERIVED_FROM
to: Name the release that removes legacy promotions — a policy statement, n…

from: Name the release that removes legacy promotions — a policy statement, n…
rel: DERIVED_FROM
to: Three unfinished rewrites

from: Name the release that removes legacy promotions — a policy statement, n…
rel: DERIVED_FROM
to: Migrations are engineered but never scheduled

from: Decide the admin — by manufacturing the evidence, not deliberating with…
rel: DERIVED_FROM
to: The half-built admin becomes a permanent third state

from: Decide the admin — by manufacturing the evidence, not deliberating with…
rel: DERIVED_FROM
to: Three unfinished rewrites

from: Match Spree's React storefront
rel: DERIVED_FROM
to: Spree takes the new-project market

from: GraphQL / headless surface
rel: DERIVED_FROM
to: Spree takes the new-project market

from: Dual asset-pipeline support, with an agent-executed migration
rel: DERIVED_FROM
to: Routine dependency drift between security releases

from: Dual asset-pipeline support, with an agent-executed migration
rel: DERIVED_FROM
to: Architectural decisions are never recorded

from: Dual asset-pipeline support, with an agent-executed migration
rel: DERIVED_FROM
to: The agent harness, and two small automation gaps

from: Publish technical decisions — restart the status posts, file forward-lo…
rel: DERIVED_FROM
to: Governance describes a project that no longer exists

from: Publish technical decisions — restart the status posts, file forward-lo…
rel: DERIVED_FROM
to: Architectural decisions are never recorded

from: Publish technical decisions — restart the status posts, file forward-lo…
rel: DERIVED_FROM
to: Reject the JavaScript-framework direction on purpose. Simplicity, one s…

from: Publish technical decisions — restart the status posts, file forward-lo…
rel: DERIVED_FROM
to: Spree takes the new-project market

from: Vector removed entirely. "Director" covers business and organizational…
rel: SUPERSEDES
to: withdrawn — numbering keeps the gap

from: The hard screen gets deferred for an easy one
rel: DERIVED_FROM
to: Decide the admin — by manufacturing the evidence, not deliberating with…

from: Nobody puts the funding decision on an agenda
rel: DERIVED_FROM
to: Restart funded development — buying an outcome, not sprints

from: The harness gets built and nobody uses it
rel: DERIVED_FROM
to: Agent harness, scoped to executing →B3 (Routine dependency-update autom…

from: The funded migration is chosen by money, not readiness
rel: DERIVED_FROM
to: Restart funded development — buying an outcome, not sprints

from: The diagnosis is wrong and the constraint is attention, not money
rel: DERIVED_FROM
to: Restart funded development — buying an outcome, not sprints

from: Role A — Steward the installed base
rel: DERIVED_FROM
to: Reframe the report from "how to recover" to "choose a role." (Accepted…

from: Role B — Contest the agent channel
rel: DERIVED_FROM
to: Reframe the report from "how to recover" to "choose a role." (Accepted…

from: Role C — Converge with Spree
rel: DERIVED_FROM
to: Reframe the report from "how to recover" to "choose a role." (Accepted…

from: Agent harness, scoped to executing →B3 (Routine dependency-update autom…
rel: DERIVED_FROM
to: Role B — Contest the agent channel

from: Why was the 2025 engagement not renewed?
rel: BLOCKS
to: Migrations are engineered but never scheduled

from: Does the Core Team consider the new admin alive?
rel: BLOCKS
to: The half-built admin becomes a permanent third state

from: Does Spree's commit volume reflect human or generated work?
rel: BLOCKS
to: Spree takes the new-project market

from: Publish technical decisions — restart the status posts, file forward-lo…
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: Decide the admin — by manufacturing the evidence, not deliberating with…
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: A definition existed. Issue #5391 (open since Sept 2023) publishes the…
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: Diagnose the admin's sequencing against Larson's migration playbook, an…
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: A definition of "finished" existed, and the money was not wired to it
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: The hard screen gets deferred for an easy one
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: Migrations are engineered but never scheduled
rel: DERIVED_FROM
to: solidusio/solidus #5391 — new admin porting checklist, open since Sept 2023

from: Dual asset-pipeline support, with an agent-executed migration
rel: DERIVED_FROM
to: solidusio/solidus #5410 — new admin breaks asset compilation when the host app has Tailwind

from: Dual asset-pipeline support, with an agent-executed migration
rel: DERIVED_FROM
to: solidusio/solidus #6327 — installer fails with a Sprockets error

from: Dual asset-pipeline support, with an agent-executed migration
rel: DERIVED_FROM
to: solidusio/solidus #6516 — align the install instructions with the storefront

from: Metadata was misleading; the threads say more. Five chaimann drafts hav…
rel: DERIVED_FROM
to: solidusio/solidus #6295 — confirmation dialog PR, adopted July 2026

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6295 — confirmation dialog PR, adopted July 2026

from: Metadata was misleading; the threads say more. Five chaimann drafts hav…
rel: DERIVED_FROM
to: solidusio/solidus #6232 — shipping methods draft PR

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6232 — shipping methods draft PR

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6228 — store create/edit draft PR

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6236 — option types draft PR

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6296 — product categories draft PR

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6298 — tax rate create/edit draft PR

from: The last developer's work was abandoned mid-flight
rel: DERIVED_FROM
to: solidusio/solidus #6302 — payment methods create/edit draft PR

from: Record the courtesy-window answers; stakeholders none reached to partial (rev 24)
rel: DERIVED_FROM
to: Solidus Slack — courtesy-window thread: draft posted, Core Team reply

from: Record the follow-up answers: admin a priority, funding model deliberate (rev 25)
rel: DERIVED_FROM
to: Solidus Slack — courtesy-window thread: draft posted, Core Team reply

from: Superseded: last blog post October 2025 / nine months of silence
rel: DERIVED_FROM
to: solidus.io blog — status update Solidus v4.7, 5 May 2026

from: Record the rev-26 re-verification, evidence window 2026-08-08
rel: DERIVED_FROM
to: GitHub API re-verification sweep 2026-08-08

from: Record the rev-26 re-verification, evidence window 2026-08-08
rel: DERIVED_FROM
to: Open Collective ledger re-check 2026-08-08

from: Superseded: tested against unreleased Rails and Ruby versions
rel: DERIVED_FROM
to: Rails and Ruby release dates plus Solidus CI adoption commits

total: 118
observed: 68
web: 32
user: 12
inferred: 6