# Abandonment

> How inspect.software decides a project has been left unmaintained — why silence alone is never the finding, what counts as an unmet obligation, and what holds the assessment back.


Every tool in this field answers the question with one number — days since the
last commit — and every one of them is wrong about the same projects. A small,
complete library that has needed no changes in three years is not abandoned. It
is finished. Marking it dead costs a record its credibility precisely on the
software that deserves the most confidence.

So silence is never the finding here. The assessment rests on a different
proposition:

> Abandonment is an unmet obligation, not an absence of noise.

A project incurs obligations when work arrives from outside it — a pull request
that wants review, an issue that wants an answer, a published fix for a
vulnerability in something it ships. A quiet project with no such demands owes
nobody anything and cannot be failing them. A quiet project with fifteen pull
requests nobody has looked at in two years, and a year-old advisory whose patch
shipped the same week, is not resting.

- **Category:** [Vitality](/wiki/vitality) (0% within category)
- **Effect:** a multiplier on the overall rating, and a ceiling in the severest
  states
- **Metric key:** `abandonment`

## What the assessment reads

**Declared.** The maintainer said so. GitHub's archive flag, or a registry
deprecation covering every package the repository publishes. Nothing is
inferred and nothing needs corroborating — the record is quoting its subject.

**Drought.** No *human* commit for a long time. Deliberately not the repository's
push recency, which counts a dependency bot's version bump as a sign of life:
projects whose only activity for a year was automated updates report a last
push measured in days. Commit authorship is read per commit, and automated
authors are excluded. Drought is a necessary condition and never a finding on
its own.

**Unmet obligations.** The corroborating signals — pull requests left
unanswered, issues left unanswered, a published fix left unapplied, releases
stalled, continuous integration broken, a sole maintainer absent, or OpenSSF
Scorecard independently reporting the project unmaintained. Each is a duty the
project is visibly not discharging.

**Guards.** Evidence that someone is still there, or that nothing is being
asked of them: a maintainer still replying, nothing open to answer, a release
within the year, no affected dependency. Two guards hold the result short of a
finding however many obligations fired, because both readings — "someone is
answering" and "nobody is asking" — fully explain the silence.

## What the states mean

| State | Meaning |
| ----- | ------- |
| `maintained` | Human work is recent; no finding |
| `unverified` | The collected evidence cannot answer the question |
| `dormant` | Quiet, but explained — held there by guards, or nothing is owed |
| `abandoned` | Drought plus unmet obligations, uncontested |
| `declared` | The maintainer archived it or deprecated its packages |

Anything the data cannot answer is `unverified` and costs the repository
nothing. An unauthenticated scan reads no commit sample and no tracker queues,
so it can reach no conclusion — recorded as an absence of evidence rather than
evidence of absence.

## Reading the result

- **The alert names its evidence.** The drought length is stated with the
  obligations beside it, so the finding can be checked rather than trusted.
- **The drought may be a floor.** The commit sample is bounded; when it holds no
  human commit at all, the true gap predates the window and is reported as "at
  least" that long.
- **A finding is not a verdict on the maintainers.** Projects are abandoned for
  ordinary reasons — jobs change, interest moves, people fall ill. The record
  states what a consumer would find, not why.
- **Automation does not rescue a project here, and does not condemn it
  either.** Bot commits are excluded from the drought calculation, so a
  repository kept warm by a dependency bot reads as quiet as it truly is. Heavy
  automation beside recent human work is not a signal at all — see
  [development activity](/wiki/development-activity).

## Improving the value

- Answer what is open, or close it. An unanswered queue is the single strongest
  contributor to a finding.
- Apply published security fixes to dependencies, or state why they do not
  apply.
- If the project is finished rather than abandoned, say so — archiving it, or
  marking its packages deprecated, replaces an inference with a fact.

Related: [development activity](/wiki/development-activity) ·
[maintainer resilience](/wiki/maintainer-resilience) · [Vitality](/wiki/vitality)