I think you're right, but a lot of these things are dependent on how large of a project it is. The highest order bit is some sort of open, democratic-ish (at least nominally) governance and/or acceptance of patches from outside of the team, I think. It starts with "public issue tracker and responsive, professional developers" and then grows from there.