32 slides · use ← → · built from the report
existing-system audit
A well-engineered open-source commerce framework that has quietly lost its steward for the second time in ten years — and a competitor that came back from the dead with a business model behind it.
Solidus is not a hosted store: it is a set of Rails libraries you install into your own application — you run the servers, you own the database, you keep every customization.
observed
The arc in one line: forked from Spree in 2015, its creator gone by 2018, its steward's engineering gone by 2024 — and the machine still running on discipline the departed built.
observed
Solidus is technically healthy and strategically adrift. Both are true, and the gap between them is the whole story.
observed
inferred
Losing the steward is not a shock this project suffered once; it is its normal condition, and in ten years the governance never grew a mechanism for handling it.
observed
Spree's open source is a marketing cost carried on a real business; Solidus's is carried on a $25k donation pot.
observed
| Year | Paid out | Expenses | Where it went |
|---|---|---|---|
| 2019 | $11,768 | 10 | Conference costs — Sean Denny 43%, Cindy Backman 42% |
| 2020 | $35,736 | 24 | Peter Berkenbosch 80% — monthly "Development & Maintenance" |
| 2021 | $0 | 0 | nothing at all |
| 2022 | $500 | 1 | One conference video-editing invoice |
| 2023 | $45,760 | 7 | The admin — Nebulab 79%, Andrea Iurisci 21%. 100% of the year. |
| 2024 | $32,506 | 16 | Logicielle B.V. 100% — 16 development invoices, Aug–Dec |
| 2025 | $16,888 | 6 | "e.c441" 100% — 6 development invoices, Feb–Jul |
| 2026 | $0 | 0 | nothing at all |
observed
The money in one line: funded development stopped on 5 July 2025, twelve and a half months of income have arrived since, and $132,180 sits unspent.
observed
observed
The product in one line: three parallel rewrites read as systemic failure to finish, but promotions is a managed migration, the storefront a success — only the admin has stalled.
observed
| Person (organization) | 2022 | 2023 | 2024 | 2025 | 2026 |
|---|---|---|---|---|---|
| Elia Schito (Nebulab) | 133 | 696 | 46 | 4 | 0 |
| Alberto Vena (Nebulab) | 70 | 232 | 52 | 12 | 3 |
| Rainer Dema (Nebulab) | — | 168 | 2 | 0 | 0 |
| Super Good Software (all) | 34 | 3 | 140 | 62 | 136 |
observed
The people in one line: Nebulab supplied roughly 60% of all commits in 2023 and 0.8% over the last twelve months, and no announcement was ever made.
observed
The machine in one line: every change tested against four Ruby–Rails combinations including unreleased versions, deprecations failing the build, fixes back-ported automatically — top-decile delivery machinery for a project this size.
observed
The most expensive initiative in the project's history stopped without a sound: three years and $45,760 in, the new admin is at version 0.4 — and the architecture makes abandonment produce no symptom.
observed
| Metric | Solidus | Spree |
|---|---|---|
| Commits in the last 52 weeks | 400 | 2,190 — 5.5× |
| GitHub stars | 5,317 | 15,572 |
| Forks | 1,400 | 5,287 |
| Latest release | v4.7.0 · 15 Apr 2026 | v5.6.0 · 23 Jul 2026 |
| Releases in the last five weeks | 0 | 7 |
| Cumulative package downloads | 3.22M | 2.85M |
observed
The competitor in one line: Spree ships five and a half times Solidus's commit volume, seven releases in the last five weeks, and its free edition is the sales funnel for a paid enterprise product.
observed
| Rule | Written where? | Health | |
|---|---|---|---|
| S1 | Reject the JavaScript-framework direction on purpose. Simplicity, one stack, no fees, distributed governance. | on the lead maintainer's company blog | The project's actual strategy — stated, just not here |
| S2 | Never break an existing store. Deprecate before removing; back-port fixes to old versions. | ratified | Holding — at a cost nobody has priced |
| S3 | Ship replacements alongside the old version as opt-in, with a written migration guide; the old one stays until stores have moved. | in the gems, not the governance | Working — see the promotions migration guide |
| S4 | Core stays lean; capabilities live in separate extensions. | nowhere | Weakening — four official extensions dormant |
observed
| Rule | Written where? | Health | |
|---|---|---|---|
| S5 | Merge authority belongs to a self-appointing Core Team. Money buys votes on spending, never on code. | ratified | Yes — the separation is deliberate and healthy |
| S6 | Quality is enforced by machines; style is not argued about. | only in CI config | The best-functioning rule in the project |
| S7 | All delivery is done by humans. | by omission | Untested — no agent harness exists |
observed
The two causes compound into a single condition: an unfunded initiative sitting next to an unspent budget.
inferred
| Risk | Flag | Likelihood | Would you notice? | |
|---|---|---|---|---|
| R1 | Routine dependency drift between security releases | downgraded | Low for disclosed vulnerabilities — that path is covered. Medium for drift | For a disclosed CVE, yes. For gradual drift, no |
| R2 | Two firms are 78% of the money and most of the code | hard to detect | Medium — this has already happened twice | Not for months. A departure looks exactly like a quiet quarter |
| R3 | The half-built admin becomes a permanent third state | hard to detect | High — it is the current trajectory | No. Every signal a maintainer looks at is green |
| R4 | Spree takes the new-project market | easy to see coming | ||
| R5 | The new storefront breaks existing extensions by design |
inferred
inferred
| Debt | Kind | |
|---|---|---|
| D1 | Three unfinished rewrites | strategic |
| D2 | Governance describes a project that no longer exists | organizational |
| D3 | Architectural decisions are never recorded | knowledge |
| D4 | The agent harness, and two small automation gaps | technical |
observed
| Credit | Status | |
|---|---|---|
| C1 | Test matrix including unreleased Rails 8.1 and Ruby 4.0 | confirmed |
| C2 | Deprecation build gate | confirmed |
| C3 | Automated back-porting | confirmed |
| C4 | Automated code style | confirmed |
| C5 | Release and changelog automation | confirmed |
| C6 | Reproducible development environment | confirmed |
| C7 | The storefront | confirmed |
| C8 | solidus_promotions | overdue |
| C9 | solidus_admin | past the point of write-off |
inferred
The conclusion this evidence supports is a role, not a comeback: the commerce framework you can still own in ten years, serving the merchants who already chose it.
inferred
| Role | The move | The catch |
|---|---|---|
| A — Steward the installed base | No new initiatives; guarantee upgrades and security; finish promotions; cancel the admin and storefront | An explicit acceptance of managed decline — some contributors will leave |
| B — Contest the agent channel | Ship the missing agent harness; sell "one runtime, one test command" to agent-driven builders | Spree shipped theirs first — a modifier on Role A, not an alternative |
| C — Converge with Spree | Fold back into the project Solidus forked from | Nobody inside will propose it, which is exactly why it must be written down |
inferred
| Bet | Verdict | Addresses | Cost | |
|---|---|---|---|---|
| B2 | Restart funded development — buying an outcome, not sprints | Do | R3, D1 | one meeting agenda item |
| B3 | Routine dependency-update automation (security updates already run) | Cheap | R1 | a config file |
| B4 | Agent harness, scoped to executing B3 and B5 | Do | D4, S7, Role B | ~a day |
| B5 | Name the release that removes legacy promotions — a policy statement, not labour | Do | D1, RC1 | free |
| B6 | Decide the admin — by manufacturing the evidence, not deliberating without it | Decide | R3, D1 | one hard screen |
inferred
| Bet | Verdict | Addresses | Cost | |
|---|---|---|---|---|
| B7 | Match Spree's React storefront | Kill | R4 | — |
| B8 | GraphQL / headless surface | Wait | R4 | — |
| B9 | Dual asset-pipeline support, with an agent-executed migration | Do | R1, D3, D4 | see template |
| B10 | Publish technical decisions — restart the status posts, file forward-looking roadmap items | Do | D2, D3, S1, R4 | an hour a month |
inferred
inferred
The moves in one line: none of the first steps is expensive — publish the decisions being made, name the release that removes legacy promotions, and fund outcomes rather than sprints.
Nothing here asks to be believed: every factual claim in this report carries a tag saying how it was arrived at, and the tags are counted by the build, never authored.
Before the conclusions
How much of what you just heard was actually observed.