Evidence ledger
One row per claim in When the internal fork wins: ten years of Netflix retiring its published platform libraries: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Field guide: When the internal fork wins: ten years of Netflix retiring the platform libraries it published. Research date 2026-09-21. Every row was fetched in this session.
Corpus limit, stated up front. This session's network policy reached github.com,
raw.githubusercontent.com and nothing else. netflixtechblog.com, medium.com,
netflix.github.io, usenix.org, arxiv.org, youtube.com and every other host tested
returned an egress block, including every host that carries Netflix's engineering writing, its
conference talks and its outage reports. There are therefore no engineering blog posts, no
talks, no papers and no production incident reports in this ledger, and none in the guide.
What remains is the repository record: READMEs, lifecycle metadata files, security advisories,
build files, commit history, issue threads and pull requests.
That record is a partial and biased witness, and the bias runs in a specific direction. It is unusually good on what a team told the public about a component's status, and when, and close to silent on what replaced it inside Netflix. Every replacement named in this guide, the gRPC-based RPC stack, the internal Conductor fork, the refactored ConsoleMe, the Kubernetes-based Titus, is described only by the sentence in a README that announces its existence. No Netflix repository describes its design. The guide says so rather than filling the gap.
Two grading notes. First, rows graded postmortem are not outage reports. They are
retrospective accounts, written by the team that operated the thing, of why a component stopped:
archival announcements that give a stated cause, an end-of-life notice, a security advisory whose
remediation section is a decision record, and a discontinuation statement for a rewrite. They are
graded at that tier because they carry the same payload as an incident review, the assumption that
turned out to be false and what changed afterwards, and the guide labels them as what they are.
Second, rows graded adr are files whose purpose is to record a decision (a lifecycle marker, a
build file that encodes what survived a deprecation), not prose arguments.
Tiers follow the skill's hierarchy: postmortem, source, adr, casestudy, blog, paper,
talk, vendor.
| # | Org | Title | Tier | Published | Checked | URL | Claim taken from it | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Netflix | Hystrix README, "Hystrix Status" | postmortem | notice added 2018-11-19 | 2026-09-21 | https://github.com/Netflix/Hystrix | The published artefact had run ahead of the internally used one, and the final release existed to pull them back together | "We have made a final release of Hystrix (1.5.18) per issue 1891 so that the latest version in Maven Central is aligned with the last known stable version used internally at Netflix (1.5.11)." |
| 2 | Netflix | Hystrix README, "Hystrix Status" | postmortem | notice added 2018-11-19 | 2026-09-21 | https://github.com/Netflix/Hystrix | The stated reason for stopping is a change of mechanism, from pre-configured settings to closed-loop control | "our focus has shifted towards more adaptive implementations that react to an application's real time performance rather than pre-configured settings"; "Netflix will no longer actively review issues, merge pull-requests, and release new versions of Hystrix." |
| 3 | Netflix | Hystrix README commit a7df971 |
source | 2018-11-19 | 2026-09-21 | https://github.com/Netflix/Hystrix/commit/a7df971cbaddd8c5e976b3cc5f14013fe6ad00e6 | The date the maintenance notice entered the public record | Commit "Update README.md" by qiangdavidliu, 19 November 2018, adding the lines "Hystrix is no longer in active development, and is currently in maintenance mode." and "Netflix will no longer actively review issues, merge pull-requests, and release new versions of Hystrix." |
| 4 | Netflix | Hystrix repository page | source | checked at HEAD | 2026-09-21 | https://github.com/Netflix/Hystrix | Eight years after the notice the repository is neither archived nor idle: the queue is what is dead, not the traffic | 24.5k stars, 4.7k forks, 6 open issues, 52 open pull requests, no archive banner |
| 5 | Netflix | Hystrix closed-and-unmerged pull requests | source | query run 2026-09-21 | 2026-09-21 | https://github.com/Netflix/Hystrix/pulls?q=is%3Apr+is%3Aclosed+is%3Aunmerged+sort%3Aupdated-desc | The volume of work the community sent to a repository that had announced it would not merge | "87" matching pull requests; most recent closures 2026-08-11, 2026-06-11, 2026-04-22, 2025-09-16 |
| 6 | Netflix | Hystrix PR #2033, "Fix Exception in HystrixThreadPoolDefault.touchConfig() on Java 11" | source | opened 2022-11-12, closed unmerged 2026-08-11 | 2026-09-21 | https://github.com/Netflix/Hystrix/pull/2033 | A real defect fix waited 1,368 days and was closed by the author's account activity, not by a maintainer decision | "Java 11 ThreadPoolExecutor.setCorePoolSize() throws an IllegalArgumentException if the new coreSize is larger than the current maximumPoolSize."; closed when the head repository was deleted; not merged |
| 7 | Netflix | NFLX-2018-001, Unauthenticated Server-Side Request Forgery in Hystrix-Dashboard | postmortem | 2018-01-10 | 2026-09-21 | https://raw.githubusercontent.com/Netflix/security-bulletins/master/advisories/nflx-2018-001.md | The published remediation for a Critical vulnerability was a repository move plus a label, not a code change | "Severity: Critical"; "The dashboard is vulnerable to server-side request forgery in the proxy.stream and monitor.html endpoints."; "Patch: Hystrix-dashboard is being moved from the main Netflix/Hystrix repository to the Netflix-Skunkworks organization to emphasize that it is an optional and unmaintained component." |
| 8 | Netflix-Skunkworks | hystrix-dashboard README | source | current at check | 2026-09-21 | https://github.com/Netflix-Skunkworks/hystrix-dashboard | The relocated component is still installable and still carries the advisory | "This project previously was a part of the Netflix/Hystrix project. It is now deprecated and no longer supported."; "hystrix-dashboard does not offer any default security protection and can perform server side requests based on user provided urls" |
| 9 | Netflix | Ribbon README, "Project Status: On Maintenance" | postmortem | notice added 2016-04-18 | 2026-09-21 | https://github.com/Netflix/ribbon | The earliest public admission of the pattern: the published library is wrapped internally and the wrapper is where the work goes | "some of which were replaced by non-OSS solutions over time"; "we have wrapped them in a Netflix internal http client and we are not adding new functionality since they've been stable for a while. Any new functionality has been added to internal wrappers on top of Ribbon (such as request tracing and metrics). We have not made an effort to make those components Netflix-agnostic under Ribbon." |
| 10 | Netflix | Ribbon README, "Project Status: On Maintenance" | adr | notice added 2016-04-18 | 2026-09-21 | https://github.com/Netflix/ribbon | The stated reason for leaving the client-library model, and the promise that followed it | "Our team has instead started building an RPC solution on top of gRPC. We are doing this transition for two main reasons: multi-language support and better extensibility/composability through request interceptors."; "The interceptors are Netflix-internal at the moment. When we reach that level of confidence we hope to open-source this new approach." |
| 11 | Netflix | Ribbon README commit history | source | 2016-04-18 | 2026-09-21 | https://github.com/Netflix/ribbon/commits/master/README.md | The date the estate's first divergence disclosure was published | Commit "Add maintenance project status to README" by Nikos Michalakis, 18 April 2016; the newest README commit on the page is 31 October 2017 |
| 12 | Netflix | Ribbon repository page | source | checked at HEAD | 2026-09-21 | https://github.com/Netflix/ribbon | Ten years after the maintenance notice the repository is still not archived | 4.6k stars, 1.2k forks, no archive banner, README still states "we are placing Ribbon in maintenance mode" |
| 13 | Netflix | Eureka wiki home, "Eureka 2.0 (Discontinued)" | postmortem | current at check | 2026-09-21 | https://github.com/Netflix/eureka/wiki | A published rewrite was abandoned and the 1.x line it was meant to replace is the thing that survived | "The existing open source work on eureka 2.0 is discontinued. The code base and artifacts that were released as part of the existing repository of work on the 2.x branch is considered use at your own risk."; "Eureka 1.x is a core part of Netflix's service discovery system and is still an active project" |
| 14 | Netflix | Eureka issue #1129, "Why was Eureka 2.0 discontinued?" | source | opened October 2018, closed | 2026-09-21 | https://github.com/Netflix/eureka/issues/1129 | The question was asked in public and the repository carries no published answer | Issue body: "this is not a bug a report but a question. Having read motivations for Eureka 2.0 and Eureka 2.0 architecture overview, I started wondering why the work was discontinued." No maintainer explanation is rendered on the thread. |
| 15 | Netflix | Eureka repository page | source | checked at HEAD | 2026-09-21 | https://github.com/Netflix/eureka | The survivor of the 2016 client-library stack is the one component Netflix never replaced in public | 12.7k stars, 3.8k forks, not archived, osslifecycle=active, README: "It plays a critical role in Netflix mid-tier infra." |
| 16 | Netflix | Conductor README announcement and archive banner | postmortem | 2023-12-13 | 2026-09-21 | https://github.com/Netflix/conductor | The stated cause of death is the internal fork, named as such by the team | "This repository was archived by the owner on Dec 13, 2023. It is now read-only."; "Effective December 13, 2023, Netflix will discontinue maintenance of Conductor OSS on GitHub. This strategic decision, while difficult, is essential for realigning our resources to better serve our business objectives with our internal Conductor fork."; 12.8k stars, 2.3k forks |
| 17 | Netflix | Conductor OSSMETADATA at HEAD |
adr | frozen at 2023-12-13 | 2026-09-21 | https://raw.githubusercontent.com/Netflix/conductor/HEAD/OSSMETADATA | The machine-readable lifecycle marker still reports the project alive, because archiving freezes the file that would have said otherwise | File contents: osslifecycle=active |
| 18 | Netflix | ConsoleMe README archive notice | postmortem | archive scheduled 2026-03-01 | 2026-09-21 | https://github.com/Netflix/consoleme | The same cause, stated more fully, ten years into the pattern: two forks are not sustainable for one team | "Over time, the internal versions of ConsoleMe and Weep at Netflix have evolved significantly, especially following a major refactor last year. As a result, the open-source versions now diverge substantially from our internal implementations and no longer reflect how we use or operate these tools."; "Maintaining two divergent versions of ConsoleMe and Weep is no longer sustainable for the team."; "now with 3,200+ GitHub stars" |
| 19 | Netflix | Dispatch README archive notice | postmortem | archive dated 2025-09-01 | 2026-09-21 | https://github.com/Netflix/dispatch | By 2025 the archival protocol is a dated announcement with fork guidance, not a silent status line | "This repository will be archived and marked as read-only on September 1, 2025."; 6.5k stars; readers are encouraged to fork if they wish to continue development |
| 20 | Netflix | Security Monkey README and archive banner | postmortem | EOL notice for 2020; archived 2021-09-17 | 2026-09-21 | https://github.com/Netflix/security_monkey | A component was retired by pointing users at the cloud provider's own service, which is the second destination a library leaves for | "NOTE: Security Monkey is in maintenance mode and will be end-of-life in 2020."; "For AWS users, please make use of AWS Config."; "This repository was archived by the owner on Sep 17, 2021."; 4.4k stars |
| 21 | Netflix | Simian Army README, "PROJECT STATUS: RETIRED" | postmortem | archived 2021-03-04 | 2026-09-21 | https://github.com/Netflix/SimianArmy | The library did not die, it was decomposed into services, and two of the three pieces left the Netflix organisation entirely | "The Simian Army project is no longer actively maintained. Some of the Simian Army functionality has been moved to other Netflix projects:"; "A newer version of Chaos Monkey is available as a standalone service."; "[Swabbie] is a new standalone service that will replace the functionality provided by Janitor Monkey."; "Conformity Monkey functionality will be rolled into other [Spinnaker] backend services."; archived 2021-03-04, 8.0k stars |
| 22 | Netflix | Titus and Titus Control Plane archive notices | source | archived 2022-05-14 | 2026-09-21 | https://github.com/Netflix/titus-control-plane | The container platform's public source stops in 2022, with no successor repository | "Titus Control Plane (ARCHIVED)"; "This repo has been archived and is no longer in active development."; "This repository was archived by the owner on May 14, 2022."; 319 stars |
| 23 | Netflix | Fenzo README and archive banner | source | archived 2023-03-31 | 2026-09-21 | https://github.com/Netflix/Fenzo | The scheduling library built for one ecosystem is archived when the platform above it moves to another | "Fenzo - ARCHIVED"; "Fenzo is a scheduler Java library for Apache Mesos frameworks"; "This repository was archived by the owner on Mar 31, 2023."; osslifecycle=archived; 698 stars |
| 24 | Netflix | Turbine archive banner | source | archived 2025-12-19 | 2026-09-21 | https://github.com/Netflix/Turbine | The aggregator outlived the library it aggregated by seven years before anyone archived it | "This repository was archived by the owner on Dec 19, 2025. It is now read-only."; 833 stars; Turbine aggregates the Hystrix metric streams |
| 25 | Netflix | Asgard README and archive banner | source | archived 2025-12-19 | 2026-09-21 | https://github.com/Netflix/asgard | Two repositories eleven years apart in relevance were archived on the same day, which is what estate cleanup looks like | "This repository was archived by the owner on Dec 19, 2025. It is now read-only."; "[Asgard is deprecated at Netflix. We use Spinnaker ( www.spinnaker.io ).]"; 2.2k stars |
| 26 | Netflix | Servo README, "# DEPRECATED" | source | current at check | 2026-09-21 | https://github.com/Netflix/servo | The in-place replacement: the library stays on the classpath and is turned into a no-op rather than removed | "This project receives minimal maintenance to keep software that relies on it working. There is no active development or planned feature improvement. For any new projects it is recommended to use the [Spectator] library instead."; "As of version 0.13.0, the default monitor registry is a no-op implementation to minimize the overhead for legacy apps that still happen to have some usage of Servo." |
| 27 | Netflix | concurrency-limits README | adr | current at check | 2026-09-21 | https://github.com/Netflix/concurrency-limits | The stated argument for replacing tuned constants with a control loop, and the mechanism borrowed to do it | "in large distributed systems that auto-scale this value quickly goes out of date and the service falls over by becoming non-responsive as it is unable to gracefully shed excess load"; "we borrow from common TCP congestion control algorithms by equating a system's concurrency limit to a TCP congestion window"; "Little's Law where Limit = Average RPS * Average Latency" |
| 28 | Netflix | Maestro README | casestudy | current at check | 2026-09-21 | https://github.com/Netflix/maestro | The 2024-era publication model: a managed platform service is published, not a library to embed | "provides a fully managed workflow-as-a-service (WAAS) to the data platform users at Netflix"; "It schedules hundreds of thousands of workflows, millions of jobs every day and operates with a strict SLO even when there are spikes in the traffic." |
| 29 | Netflix | Metaflow README | casestudy | current at check | 2026-09-21 | https://github.com/Netflix/metaflow | The successful exit: stewardship moves to a company whose product is the project, and the scale figures are published with it | "Originally developed at Netflix and now supported by Outerbounds"; "At Netflix alone, Metaflow supports over 3000 AI and ML projects, executes hundreds of millions of data-intensive high-performance compute jobs processing petabytes of data and manages tens of petabytes of models and artifacts for hundreds of users" |
| 30 | Netflix | DGS Framework README and releases | source | v12.1.0 dated 16 September | 2026-09-21 | https://github.com/Netflix/dgs-framework/releases | The library Netflix still maintains in public is the one whose upstream is somebody else's framework | "This is a major version release built on top of Spring Boot 4. If you are still using Spring Boot 3, please remain on v10.+ until your app is upgraded to Spring Boot 4." (v11.0.0); release v12.1.0; README support table: "5.x / Spring Boot 2 / No longer maintained" |
| 31 | Netflix | Zuul README | source | current at check | 2026-09-21 | https://github.com/Netflix/zuul | The edge gateway is the counter-example that stays public and active, and its architectural account lives off GitHub | 14.1k stars, 2.4k forks, not archived, osslifecycle=active; README links the Zuul 2 write-ups on netflixtechblog.com and talk slides on slideshare.net, none of which is reachable from a repository |
| 32 | Netflix | OSS Tracker README | source | current at check | 2026-09-21 | https://github.com/Netflix/osstracker | Netflix built and published a tool to measure exactly the signals this guide uses, and the signals it chose are the right ones | "the OSS tracker gives a daily summary as well as historical information on key repository metrics such as open issues and pull requests, days since last commit, and average time to resolve issues and pull requests"; 380 stars |
| 33 | Netflix | OSSMETADATA lifecycle markers across the estate |
adr | read at HEAD | 2026-09-21 | https://raw.githubusercontent.com/Netflix/Hystrix/HEAD/OSSMETADATA | The estate has a machine-readable lifecycle vocabulary with four observed values, and it disagrees with the archive flag | Read at HEAD: Hystrix maintenance, ribbon maintenance, servo maintenance, SimianArmy archived, Fenzo archived, conductor active (while archived), falcor active, eureka active, zuul active, atlas active, spectator active, concurrency-limits active; maestro, metaflow, dgs-framework and archaius carry no such file |
| 34 | GitHub / Netflix | Repository search, org:Netflix archived:true |
source | query run 2026-09-21 | 2026-09-21 | https://github.com/search?q=org%3ANetflix+archived%3Atrue&type=repositories | The size of the graveyard relative to the estate | 48 archived repositories returned; the organisation's repository list reports 239 repositories |
| 35 | Spring Cloud | spring-cloud-netflix pom.xml module list |
source | at HEAD | 2026-09-21 | https://raw.githubusercontent.com/spring-cloud/spring-cloud-netflix/HEAD/pom.xml | What is left downstream after the upstream deprecations: one component out of five | <modules> contains only spring-cloud-netflix-dependencies, spring-cloud-netflix-eureka-client, spring-cloud-netflix-eureka-server, the two matching starters, spring-cloud-netflix-eureka-client-tls-tests and docs |
| 36 | Spring Cloud | spring-cloud-netflix README | source | at HEAD | 2026-09-21 | https://github.com/spring-cloud/spring-cloud-netflix | The project named after a company now documents a single feature from it | "Features" section lists only: "Service Discovery: Eureka instances can be registered and clients can discover the instances using Spring-managed beans" and "Service Discovery: an embedded Eureka server can be created with declarative Java configuration" |
| 37 | resilience4j | resilience4j README | source | at HEAD | 2026-09-21 | https://github.com/resilience4j/resilience4j | The replacement the Hystrix README points at deliberately dropped the feature that made Hystrix expensive | "It is based on a semaphore, and unlike Hystrix, does not provide \"shadow\" thread pool option."; the README's talk list includes "Resilience patterns in the post-Hystrix world" and "Hystrix is dead, now what?" |
| 38 | conductor-oss / Orkes | conductor-oss/conductor README | source | at HEAD | 2026-09-21 | https://github.com/conductor-oss/conductor | The afterlife of an archived project is a vendor-stewarded fork that repositions the product | "It originated at Netflix and is actively maintained by Orkes and the [community]"; "Conductor is an open-source durable execution platform for microservices, AI agents, and adaptive workflow graphs." |
Where the record runs out
Named explicitly, because these gaps are where a reader's risk sits.
- No outage postmortems. Nothing in this corpus describes a production failure at Netflix. Any claim in the guide about operational consequence is an inference from a repository artefact and is labelled as one.
- No description of any replacement. The internal gRPC stack (2016), the internal Conductor fork (2023), the refactored ConsoleMe (2026) and whatever schedules containers after Titus (2022) are each named once, in the notice announcing that the public version is finished, and never described.
- No cost figures. Nothing on this estate carries a spend number, an instance count or a unit cost. The scale figures that exist (Maestro, Metaflow) are self-reported in a README with no date attached to the figure.
- Star and fork counts are adoption proxies, not measurements of use. They are used in the guide only to compare orders of magnitude, and they are dated to the check date.
falcoris not claimed to be dead. Its lifecycle marker saysactiveand it has 10.6k stars, but the repository has published no releases at all, so the guide reports that pair of facts and draws no conclusion from it.