01The bar, in one sentence
Every Quilt repo — whether a 200-line CLI or a 50k-line monorepo — is held to the same standard. Not a different bar for "internal" vs "public", not a different bar for "research" vs "production", not a different bar for hardware vs software. One bar, one set of rules, audited quarterly.
The bar has eight layers. Each is a prerequisite for the next — you can't claim L5 (great docs) on a repo that fails L1 (no LICENSE). The layers stack bottom-up: foundation (L1) is the price of admission; ecosystem (L8) is the long game.
The hour-clock test
If a new contributor can't go from git clone to a merged PR in under 60 minutes, the bar has been failed. Not because the contributor is bad — because the repo is unprepared. Every gap between "I want to help" and "here is my PR" is a layer the repo is missing.
02The 8 layers
Each layer is named, scoped, and auditable. The pyramid below stacks them from L1 (foundation) to L8 (ecosystem). Click a layer to jump to its detail.
△ ╱ ╲ ╱ L8 ╲ Ecosystem — monorepo, Nix, fleet ops ╱─────────╲ ╱ L7 ╲ Operations — issues, security policy ╱─────────────╲ ╱ L6 ╲ Release — semver, SBOM, signing ╱─────────────────╲ ╱ L5 ╲ Docs — landing, API ref, tutorial ╱─────────────────────╲ ╱ L4 ╲ Quality — lint, types, security ╱─────────────────────────╲ ╱ L3 ╲ Test — unit, integration, e2e ╱─────────────────────────────╲ ╱ L2 ╲ Build — lockfile, reproducible ───────────────────────────────── L1 Hygiene — license, README, git ═════════════════════════════════ FOUNDATION
Hygiene
Build
Test
Quality
Docs
Release
Operations
Ecosystem
03The 15 repos — current state
Every repo in the Quilt ecosystem, audited against L1–L4. The score is a weighted average (25% per layer) of the four auditable layers. L5–L8 are tracked separately because they're harder to score numerically.
Status cells: ✓ = present and current · ~ = partial or stale · ✗ = missing.
| Repo | Type | License | CHANGELOG | CI | Tests | Examples | Score |
|---|---|---|---|---|---|---|---|
| quilt | TS core, monorepo | ✓ | ✓ | ✓ | ✓ (82) | ✓ | 9/10 |
| quilt-live | TS, single-file browser | ✓ | ✓ | ✓ | ✓ (146) | ✓ | 9/10 |
| quilt-rust | Rust, core bindings | ✓ | ✓ | ✓ | ✓ (68) | ✓ | 8/10 |
| quilt-cloudflare | TS, workers | ✓ | ✓ | ✓ | ✓ (5) | ✓ | 8/10 |
| quilt-ai | TS, model bridge | ✓ | ✓ | ✓ | ✓ (6) | ✓ (6) | 8/10 |
| quilt-evolve | TS, self-improve | ✓ | ✓ | ✓ | ✓ (13) | ✓ (3) | 8/10 |
| quilt-codespace | TS, Codespaces template | ✓ | ✓ | ✓ | ~ (smoke) | ✓ | 8/10 |
| quilt-time | TS, time-series | ✓ | ✓ | ✓ | ✓ (17) | ✗ | 7/10 |
| quilt-vault | TS, secrets | ✓ | ✓ | ✓ | ✓ (10) | ✗ | 7/10 |
| quilt-zk | TS, zero-knowledge | ✓ | ✓ | ✓ | ✓ (7) | ✗ | 7/10 |
| quilt-flow | TS, dataflow | ✓ | ✓ | ✓ | ✓ (8) | ✗ | 7/10 |
| quilt-agent | TS, agent class | ✓ | ✓ | ✓ | ~ | ✓ | 7/10 |
| quilt-mesh | TS, p2p mesh | ✓ | ✓ | ✓ | ~ | ✗ | 6/10 |
| quilt-vision | TS, vision bridge | ✓ | ✓ | ✓ | ~ | ✗ | 6/10 |
| quilt-esp32 | Rust, embedded (no_std) | ✓ | ✓ | ✓ | ~ (2) | ✗ | 6/10 |
The picture has lifted significantly. After the standards pass, all 15 repos now have LICENSE, CI, CODEOWNERS, SECURITY.md, Dependabot, and .editorconfig. The remaining gaps are real engineering work — examples that work, examples that run, docs sites, signed releases. Those are L5-L6 and the 1-year bar.
04The top 10 improvements
Ranked by leverage — repos affected divided by effort. Impact = repos touched. Effort = person-hours for a competent contributor.
Apache-2.0 LICENSE to 11 reposci.yml to all 15 reposCHANGELOG.md to 14 reposCODEOWNERS and SECURITY.md to 15 reposdependabot.yml per repo. Weekly group updates for npm + GitHub Actions. Dependabot opens the PRs; we just review and merge. Catches security advisories automatically.quilt corestrict: true, noUncheckedIndexedAccess: true, exactOptionalPropertyTypes: true. Fix what breaks. The core ships to the most users — worth the one-time pain to make the types actually mean something.cargo clippy -- -D warnings in Rust reposexamples/* directory, installs deps, and runs the example. Fail CI if any example errors.quilt, quilt-live, quilt-rust, quilt-time, quilt-vault. Each gets a VitePress site with: landing, getting-started, API ref generated from TSDoc/rustdoc, a working tutorial, a changelog mirror. The others link to these.05L1 — Hygiene
Foundation. The six files every repo must have. A repo that fails L1 can't be depended on, can't be vendored, can't be legally used. Tick the boxes below as you check each one off — the score at the bottom updates live.
Hygiene
price of admission- LICENSE — Apache-2.0 at the repo root. No exceptions, no "MIT for now". The full Apache-2.0 text, not a one-liner link.
- README — badges (CI, npm/crates, license), one-paragraph "what is this", quick-start that runs in <5 minutes, 1–3 code examples.
- CHANGELOG.md — or
RELEASE-v*.mdnotes. "Keep a Changelog" format. One line per change is enough; just keep it current. - .gitignore — language-appropriate, excludes
node_modules/target/.env/dist. Never commit a build artifact. - .editorconfig — UTF-8, LF line endings, 2-space indent (4 for Python), trailing newline. Contributors with different editors produce the same diff.
- CODE_OF_CONDUCT — or a link to the org-level one (Contributor Covenant is the default). A repo with no CoC is a repo where bad behavior becomes "the maintainer's problem" later.
06L2 — Build
Reproducibility. A repo that builds differently on your machine than on mine is broken. L2 is about removing "works on my machine" as an acceptable answer.
Build
reproducible, single-command- Lockfile committed —
package-lock.json,yarn.lock,pnpm-lock.yaml,Cargo.lock, orpoetry.lock. The lockfile is the build's memory; without it, "build" is a fresh guess every time. - Single command to build —
npm run build,cargo build,make. The README's quick-start must end with this command. Nocd src && ./configure && make && make install. - Single command to test —
npm test,cargo test,make test. One command, exit 0 = green, anything else = broken. - Reproducible builds — Two clones on two machines produce byte-identical artifacts. Requires deterministic timestamps (
SOURCE_DATE_EPOCH), no embedded machine paths, no non-deterministic ordering. - Versioned (semver) — Every release follows MAJOR.MINOR.PATCH. Breaking change = MAJOR bump. Version in the package manifest, in the tag, and (where the language allows) in the importable symbol.
- Pinned toolchain —
.nvmrcwith the exact Node version,rust-toolchain.tomlwith the exact Rust channel,.python-versionfor pyenv,go.modwith the Go directive. Even a README line is better than nothing.
07L3 — Test
Trust. A repo with no tests is a repo where every change is a roll of the dice. L3 is what turns "I think this works" into "CI says this works".
Test
unit, integration, e2e- Unit tests for every public function — Every exported function has at least one test covering the happy path. Edge cases (empty, null, max-int) get tests too, but happy path is non-negotiable.
- Integration tests for cross-module flows — Tests that touch two or more internal modules. Catches the bug where A and B both pass unit tests but together produce nonsense. Usually in
test/integration/. - End-to-end tests — At least one test that exercises the repo as a black box — runs the binary, calls the API, runs the CLI. Catches the bug where every unit test passes but the binary segfaults on startup.
- CI runs on every PR — GitHub Actions (or equivalent). Runs lint + test on every push and PR. Required status checks prevent merge if CI is red.
- Coverage reported —
nyc,cargo-tarpaulin,coverage.py, or language equivalent. Target 80% for core, 60% for adapters. Coverage is a smell-test, not a goal. - Smoke tests for binaries — If the repo produces a binary (CLI, server, daemon), a CI job that downloads the build artifact, runs
--version, and exits cleanly. Catches the "succeeded but non-functional" build.
08L4 — Quality
Discipline. A repo that builds and tests but emits 200 warnings and 47 TODOs is a repo that has stopped caring. L4 is what separates "works" from "is well-made".
Quality
lint, types, security, docs- Lint passes with zero warnings — ESLint with
--max-warnings=0, Clippy with-D warnings,golangci-lint run --max-issues-per-linter=0. Warnings in CI block the merge. - Type check passes with strict settings — TypeScript:
strict: true,noUncheckedIndexedAccess: true. Rust: deny onunsafe_codein the public API. Go:go vet+staticcheck. - No compiler warnings — C++:
-Wall -Wextra -Wpedantic -Werror. C#: treat warnings as errors. If a warning can't be fixed, an explicit// ignore: reasoncomment, not silence. - No security advisories —
npm audit/cargo audit/pip-auditclean. Dependabot enabled and not behind on updates. Critical and high CVEs fixed within 7 days. - Heavy header comments — Every public file starts with a 5–15 line block comment: what this file is, why it exists, what it depends on, who owns it. A maintainer can
catany file and know in 30 seconds. - Public API documented — TSDoc / rustdoc / JSDoc / godoc on every exported symbol. One-line summary, parameters with types, return value, errors, 1-line example. No
/** TODO */stubs.
09The 1-year bar — where we want to be
The audit is the floor, not the ceiling. The 1-year bar is what we hold ourselves to as a growing ecosystem. By the end of next year, every Quilt repo should pass the full L1–L8 audit.
-D warnings across the Rust. Zero-warning builds. Documented public APIs.The vision
By the end of next year, the Quilt ecosystem should be a peer to Rust, React, or Postgres in engineering quality. Not in users — in the calm confidence a senior engineer feels when they git clone a Quilt repo, run the tests, read the docs, and ship a change without ever needing to ask permission.
10What done right is not
The bar is easy to mistake for a checklist of good feelings. It is not. It is a checklist of measurable things a new contributor can verify in an hour. The following are all things that look like progress and aren't.
"It builds and tests pass"
- That's L2 (and maybe L3)
- Says nothing about docs, examples, security, or how the next contributor gets unblocked
- "Passes" with 0% coverage is a coin flip
- A passing CI is the floor, not the ceiling
Hour-clock test passes
- Clone → install → test in <10 min
- README points to a working example
- Example runs in <5 min on a fresh machine
- Docs answer "where do I start?" in one sentence
- The next contributor can ship in <60 min total
- Not: "It has a fancy landing page." A landing page with no working example is L5 with no L3 — it's marketing, not engineering. The first thing a contributor sees should be
git clone, not hero copy. - Not: "I rewrote it in Rust." A rewrite trades one set of maintenance costs for another, and unless the new implementation is also L1–L4 compliant, the rewrite reduces engineering quality. A TS repo that passes the bar is better than a Rust repo that doesn't.
- Not: "I added a logo." Decoration. The only thing a logo proves is that someone opened Figma. The bar measures whether a contributor can ship a change, not whether the repo looks good in a browser tab.
- Not: "It has a Discord." Community is downstream of the bar, not a substitute for it. People join Discords for repos that are worth depending on. Chasing the order is a fool's errand.
- Not: "Most of the warnings are pre-existing." There is no such thing as a "pre-existing" warning. Every warning in the codebase is a vote against the next contributor's time. The right number is zero.
The standard, restated
Clone, build, test, read docs, find an example, ship a change — in under an hour. If any of those six steps takes longer than 10 minutes, the bar has been failed. There is no other metric. The hour is the metric.
11Score yourself
Tick the boxes in the L1–L4 sections above as you check each item off in your own fork. The bar compliance score updates live — at 100%, your repo passes the L1–L4 audit and is eligible for the org-level quilt monorepo (L8).
Bar compliance · live
Until the score reads 100%, the repo is on the audit list and is reviewed against this bar on every quarterly cycle. The audit template lives at docs/audit-2026-q1.md in the org repo.
Where to go from here
Three doors, depending on what brought you here.