GitHub optimizes for contribution volume. Weft optimizes for maintainer attention.
The scarce resource in open source is not pull requests. It is the hour a maintainer has on a Sunday, and how much of it gets spent reading generated code that was never going to land. Weft is a forge built the other way round: a contribution spends machine time before it spends yours, and what reaches your review queue has already proved it applies, passes your checks, and is not the fourth copy of the same patch this week.
Public repositories are free, forever. Not free for now, and not free until you grow: our cost for a repository nobody touched this month is a few objects in cold storage, so there is no bill for us to eventually pass on to you.
The maintainer firewall
On a popular repository somewhere between a third and a half of inbound pull requests are low-effort model output. Reading them is not review; it is triage a machine should have done. So a contribution from someone we do not know yet is admitted in stages, and each stage is a check you can read the result of rather than a score you have to trust.
It fast-forwards, or it does not arrive
The same ancestry check the land queue uses, run at the door instead of at the end. A change that cannot be applied to your trunk never becomes a tab you have to close. The firewall and the queue cannot disagree about it, because it is one function.
CI, reported before a human looks
A .weft/*.yml file in the repository runs on our runners — one throwaway container per job, and a log you can read while it is still being written. CI you already run elsewhere posts its verdicts over the API instead. Either way the change is held at the door until the checks land.
Slop travels in herds
A fingerprint over the normalized diff and the sorted set of changed paths, compared against the recent open changes on the same repository. Six near-identical patches to the same file arrive as one thread with five siblings attached, not as six notifications.
Rules in a file, evaluated at the door
Maximum file size, forbidden paths, a required trailer, line endings — declared in the repository, enforced before review. The refusal names the rule it broke, so a first-time contributor learns something instead of being ignored.
Then the ladder: a collaborator, or anyone an OWNERS file already trusts with the paths they touched, skips the firewall entirely and goes straight to review — which is exactly how the review product behaves for private repositories today, so nothing about an enterprise repository changes. A contributor with landed changes behind them gets the short path. Everyone else gets the full gate.
Your contribution graph is not GitHub’s to keep
A contribution graph that only counts what happened on one company’s servers is a lock-in mechanism wearing a résumé’s clothes. Weft computes yours from verified commit authorship instead: we walk the history we are already storing for you and count the commits whose author address you have verified, or that you pushed yourself.
The practical consequence is the one that matters on moving day. Mirror your repositories over, verify the addresses you have committed under, and a decade of history renders — not a green wall that starts the day you signed up.
Anything we cannot verify counts for nothing. A graph you can inflate by setting user.email to a stranger’s address is not a credential, and we would rather ship a smaller number that means something.
Forks are instant and cost nothing
Forking a large repository on most forges means copying a large repository. Here a fork is a pointer: the new repository refers to the upstream’s existing objects and gets its own namespace, its own permissions and its own push path. It completes in milliseconds and occupies nothing until your history and the upstream’s diverge — at which point you are storing exactly the difference.
That is the same storage engine the paid products run on, wearing open-source defaults. It is also why fork-and-send-a-patch is cheap enough to be the default door for strangers rather than a favour we ration.
A fork of a private repository is private, and stays that way. Visibility is the security boundary here, not a display preference.
We do not train on your code, period
Not for models of our own, not by sale, not by a research partnership, and not under a setting that defaults on. Code being public does not make it ours to feed to anything. The full policy says what we do instead.
Agents are labeled, not banned
An agent gets its own principal and its own identity; it never borrows a human’s name. Each repository picks its own policy — agents welcome, agents labeled, or human-only — and a human-only repository refuses an agent principal at the door with a sentence naming the policy rather than failing silently.
No lock-in, stated as a feature
Every repository is standard git, clonable with stock clients and exportable as a plain git bundle at any time. Keeping a read-only mirror pointing back at GitHub is a supported configuration and not a defection; the migration page explains how it is set up.
What this is not, yet
This site publishes what the review queue cannot do as plainly as what it can, and the open-source layer gets the same treatment. Four things people reasonably expect from a forge are not here, or not here in the shape you would expect them:
- Actions compatibility. There is a runner now, and a.weft/*.yml file of shell commands runs on it. It is not Actions: uses: is refused by name and by line rather than ignored, so a workflow assembled out of marketplace actions has to be rewritten as the commands it was running. That rewrite is still the largest cost of a move, and calling it anything else would waste your afternoon.
- Federation. No ForgeFed. The specification is young and the implementations that ship it ship it experimental, with moderation and access control unbuilt. We would rather adopt it late than advertise it early.
- Sponsorship rails of our own. We link to Open Collective, Polar, Liberapay and Ko-fi, and import an existing funding file so those links follow you over. We do not take a cut, because we never touch the money.
- Trending. Ranking a week of traffic produces a random number with a confident face. Discover publishes the rule it sorts by instead, and gains a trending view when there is a month of signal behind it.