Solidus was forked from Spree in 2015. In 2025 Spree came back from the dead with money and AI tooling, so I went to check whether the fork was in trouble. What I found was stranger: a healthy delivery machine, a full treasury, and nobody left whose job it was to decide anything. Then I posted the draft where the project lives — and it answered.
Cold Opening
Last month I needed a test subject. I maintain a method for engineering-strategy audits, and I wanted worked examples I could publish. I can't publish anything from my job, so I turned to open source, where the code, the money and the people are all public.
I picked Solidus for its famous (but already settled) drama with Spree. Solidus is a Ruby on Rails e-commerce framework: a set of libraries under BSD-3 license you build an online store on, self-hosted, you own everything. It was born in 2015 when an agency called Stembolt forked Spree (the biggest Rails commerce project of that era) because it didn't like where Spree was heading. Months later Spree got acquired and development stopped. Most of the community moved over to Solidus.
Then, ten years later, the plot inverted. In 2025 Spree came back from the dead. This time with VC money behind it to upsell a paid enterprise edition. It now ships five times Solidus's volume of code by pivoting into TypeScript and LLM-backed SDLC observed. So my question was simple: what happens to the fork when the original resurrects with capital behind it? Is Solidus in trouble?
At first glance — no. The engineering is genuinely excellent: every change is tested against edge Ruby and Rails web, and fixes flow automatically to five older release lines observed. This is better machinery than most funded companies run.
But the project's blog stopped its monthly updates in October 2025. Its public roadmap shows no future plans. And all its public communication in 2026 amounts to one release announcement in May. What happened?
Follow the Money
Solidus's finances are completely public, so I pointed my data-sweep agent at the ledger.
The account holds $132,180. The last time any money left it was 5 July 2025. Donations still arrive every month, though observed.
Scrolling back through the history: Solidus hired a maintainer in 2020, and paid contract developers through 2024 and 2025. And the biggest purchase of all was in 2023: $45,760 for a new admin interface, billed as six "Agile Design Sprints" observed.
Where is that admin now? Three years later it's at version 0.4, and if you install Solidus today, the new admin can show you a list of your orders but cannot open one. Its main screens ship switched off observed.
The project's biggest funded effort had quietly failed. And then I looked at who the $45,760 was paid to.
Nebulab. Wait — Nebulab is the steward. The consultancy that has run Solidus since 2018. The project paid its own steward for its biggest failure.
Fraud?
That was my first theory too, so I checked it before anything else. But it just does not make any sense: over the years Nebulab has put $80,750 into the project and taken $36,419 out. They're net contributors by $44,000 observed, not counting the free engineer-hours they donated to the project. Also, their invoices go through an independent nonprofit, and all the records are public and transparent.
Not a heist, then. Something duller, and stranger.
The Rewrites that Didn't Fail
Next question: was this admin rewrite just typical open-source overreach? Do their big migrations always die like this?
No. That's what makes it interesting. Solidus rewrote its entire promotions engine, successfully (they should've announced the deprecation date of the previous one, though).
Also, the project replaced its storefront in just six weeks observed. Solidus can finish things.
Only the admin died. So what was different about the admin? Note: an admin is super important for an e-commerce framework. Merchants may rewrite their storefronts, but they usually stick with whatever admin the framework provides. The old admin Solidus ships by default is jQuery-era, built on long-deprecated technology.
The Commit Log Answers
The admin rewrite was Nebulab's project. 2023 was the biggest year in Solidus history — 1,810 commits, roughly 60% of them from Nebulab's engineers observed.
Then, year by year, the volume of Nebulab-backed commits dropped to almost zero observed. No announcement was ever made — I searched hard for one web. The only trace is on Nebulab's own website, which now advertises Shopify development at exactly equal weight with Solidus web.
They didn't abandon the project — they still pay the top sponsorship tier every month, and they seem to take part in the weekly decision-making meetings. So the money (and probably the governance) stayed; the engineers left. And since the admin was their project, it seems it never got cancelled or handed over. It just stopped.
One developer (Eugene Chaikin) kept carrying it through 2025, nearly alone (151 of the year's 193 admin commits) observed. It seems this work was paid: the treasury records six invoices to "e.c441" over those same months, and I believe "e.c" stands for "Eugene Chaikin" inferred. The last paid invoice is dated 5 July 2025 — not just Chaikin's last, Solidus's last observed. Eugene left the project and nobody picked up his work: his unfinished code sits in draft pull requests, exactly where he left it observed.
The project publicly asked for "another developer to pick up this work" web while holding $132,180 to pay one. Nobody came: the drafts sat untouched until this July, when a volunteer finally adopted one of the six observed. The monthly updates, meanwhile, had stopped altogether back in October. No code, no public communication, no steward.
Well, this isn't the first time the project has lost its steward. Stembolt, the agency that created Solidus, was acquired in 2018 and walked away the same way. That's OK for an open source project, I guess. The only problem is that its governance never grew a mechanism for it.
Why No Alarm Ever Sounded
The unfinished admin ships disabled by default and leans on the old admin for everything it lacks. So a half-built, abandoned rewrite looks perfectly healthy from every angle: tests pass, releases ship, no page errors, no merchant complains.
Also, its stewards have walked away multiple times. Seems like:
The system is built so that abandonment produces no symptom.
Well, it's a volunteer-run project after all: volunteers sustain what automates. They can't sustain what needs a full-time focus. Solidus's community built a superb machine. It just needs a successor.
One more suspect to clear, because every reader reaches for it: did Spree's comeback cause this? No. Paid sponsors have been leaving at a steady drip since 2019, with no spike after Spree's return. Nebulab's withdrawal started a full year before it observed. The decline is homegrown. It is not Spree. They compete on very different levels now: DIY-own-everything vs GitLab-like monetization. Spree is backed by VC money. Solidus is backed by independent agencies that build e-commerce stores for their customers.
So is Solidus in Trouble?
Not the way I expected. Nothing is on fire, and that's exactly the problem: there is money ($132,180), there is discipline, there is even a written plan for finishing the admin hidden somewhere in GitHub issues observed. Everything is present except a party whose job it is to decide and implement.
The condition in one line: an unfunded initiative sitting next to an unspent budget.
Solidus can't outspend Spree and doesn't need to try. It holds one claim its rivals structurally can't make: it's BSD-licensed with no company that could ever relicense it, runs on one runtime with no JavaScript supply chain to audit, and its upgrade safety is enforced by machines, not promises. That's a real thing to be: the commerce framework you can still own in ten years for the stores that already run on it.
And the pitch already works. This June a developer choosing between the two picked Solidus for exactly those reasons. The license and the single Rails stack matter. He had a store running in an afternoon, an AI agent doing the setup web.
My only advice is to pay someone out of the $132,180 to port the hardest admin screen first, and let the result decide whether the admin gets funded or cancelled — either answer beats a fourth year of nothing.
The rest I ended up writing down as Policies & Operations. Five policies, each with the cheapest enforcement that would actually hold:
- Whatever replaces something names the release that removes the old thing (for the promotions engine that's one sentence in a README, free, two years overdue).
- The treasury buys outcomes, not hours (time and materials is fine, but tied to a KPI, not just hours spent).
- Decisions get published where an outsider can read them (the blog and the roadmap are both sitting there, dormant).
- Every parallel rewrite gets a public verdict four times a year: progressing, funded, paused until a named date, or cancelled (the rule that would have caught the admin in 2024).
- When a contributor leaves, their open work is adopted or closed within a release (instead of waiting a year for a volunteer to wander past).
The core team must decide and publish. Volunteers have no power and no will to do it.
Stakeholder Answered
All of this was done from the outside, so before publishing I posted the draft to the Solidus public Slack. Jared Norman (a core team maintainer, CEO of SuperGood Software, one of the backing agencies) replied within the hour stakeholder.
The reason nobody was paid for a year turned out to be that there was nobody to pay: no candidate since Eugene Chaikin left, and a new one "in the works." The slow admin is deliberate, but it is a priority, he said. Real stores already run the unfinished screens in production (a fact only someone who serves real merchants could know). Also, the maintainer agencies prefer paying independent developers "to avoid any perception that those of us maintaining Solidus are profiting directly from the OpenCollective funding" — which is why they didn't hire internally to finish the admin.
These are cleaner answers than any of my theories. Alas, they are also written down nowhere a future Solidus adopter would ever read them. They live in one maintainer's head and now in a chat thread, which is half of why the rules above exist.
The main Solidus selling point is the commerce framework you can still own in ten years. The clear blind spot: a ten-year promise needs a public roadmap that new adopters can actually see.
If someone from Solidus reads this: corrections are welcome. You can reach me in Slack or by email. Every claim above is sourced in the full audit, and the remaining open questions are listed at the end.