Isn't the allegation that they made changes to the deployed version of their production server that were not pushed to the GitHub project? (i.e., that they stop

Isn't the allegation that they made changes to the deployed version of their production server that were not pushed to the GitHub project? (i.e., that they stopped updating the server repository for around a year, but not just implausible but contradicted by evidence that they never changed the server code for about a year?) If so, then the code quite simply is not open source by any possible definition. I agree with you that a project that is dormant, or even receiving internal development that is still under review, can defensibly be called "open source" even if the development isn't happening in the open. (For instance, your favorite begrudgingly-GPL-compliant hardware vendor who releases .zip files every time they release a new product is releasing "open source" code.) But if the source code to the Signal server isn't even published, it can't be open.