skills/renatocaliari/pi-product-workflow/cali-product-workflow/skills-domain-libraries/cali-product-open-source/SKILL.md
The Open Source Paradox — delivering value by giving up control. Explores business models, organizational structures, and strategies for competing in an open-source world.
npx skillsauth add renatocaliari/agent-sync-public-skills cali-product-open-sourceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
The belief that value resides in the secrecy of code creates constant friction:
The product is not the code — it's the living system. The strategy shifts from protection to curation. Open source becomes the ideal vehicle for this, accelerating distribution and building trust — which become the true differentials, harder to replicate.
Analogy: publishing the recipe for a complex dish. The recipe (the code) can be copied. Other restaurants can even use the recipe. But the value of the original restaurant lies in the consistency of execution, in the atmosphere, in the trust that customers have, and — perhaps most importantly — in the evolution of the menu. The free recipe didn't cannibalize the business; it created the market.
Open-core: the core software (which solves the problem for most users) is open and free. Monetization comes from "premium" closed-source features that solve corporate niche problems (advanced security, integrations, administration tools).
Managed Hosting (Software as a Service): sell convenience. "You can host this yourself, configure, update, worry about security. Or you can pay us a monthly fee to do it all for you." Examples: WordPress.com (vs. WordPress.org), GitLab.
Consulting, Support, and Training: the software is 100% free, but using it at scale requires deep knowledge. The company that created it sells that knowledge in the form of technical support, consulting, and training. Example: Red Hat on top of Linux.
Alternative Licenses (Fair Code, Source Available): hybrid models. Example: n8n — open source but with a license that restricts commercial use by third parties who want to offer n8n as a competing direct service. Attempt to have open source transparency without the risk of predatory competition.
Paid Access to Repositories or Builds: works like a "sponsorship" model, where companies pay to have access to more stable builds or private repository with priority fixes.
For-Profit Organizations and Venture Capital (VC): massive distribution and trust generated by open source can be the basis for accelerated growth. ⚠️ Pressure for quick financial return can conflict with building a long-term business and community interests.
Foundations or Non-Profit Associations: in Brazil, projects can be maintained by association or foundation, supported by donations from companies and the community. Reinforces trust that the project serves the public interest.
Other Structures:
development
PocketBase v0.39+ development - API rules, auth, collections, SDK, realtime, files, Go/JS extending, deployment, production tuning.
tools
Auto-initialize structured documentation for any project using lat.md (knowledge graph of markdown files with [[wiki links]], // @lat: code refs, and semantic search). Detects cali-product-workflow artifacts (spec-product.md, spec-tech.md, critiques) and uses them as seed material. Falls back to extracting business rules, architecture, and design decisions directly from the codebase. Use when a project lacks structured documentation or when lat.md/ is missing. After seeding, lat.md extension hooks keep documentation alive automatically.
testing
[Cali] Server security audit and hardening for private servers behind Tailscale. Use when: auditing server security, hardening SSH/firewall/Docker, checking for vulnerabilities, setting up fail2ban, reviewing port exposure, or responding to security alerts. Covers 6 layers: CloudFlare, UFW, Tailscale, SSH, Docker, Application. Triggers: "server security", "security audit", "harden server", "SSH hardening", "firewall rules", "UFW config", "fail2ban", "port security", "Docker security", "vulnerability check", "security review".
tools
Run supply chain security scans before installing packages or before releases. Triggers when: user installs a package (npm, pip, go get, brew), user asks to 'scan dependencies', 'check vulnerabilities', 'supply chain', 'security audit', 'run trivy', 'run socket', or before any release/deployment. Also triggers on mentions of: socket.dev, trivy, OSV-scanner, dotenvx, CVE, dependency audit. Covers all four tools with concrete commands.