Am I doing Open Source wrong?

TL;DR: A lot of people contact me saying they'd like to help out with my Open Source project, but don't actually <i>do</i> anything. Can I fix this? When employers get an applicant who claims they worked on an Open Source project, does the employer actually verify this activity?

I have a small, niche Open Source project. Unnamed to protect the guilty :) It doesn't have a lot of followers but there is international interest.

My dilemma is I have received requests to become a "member" and "help out" since the beginning. But when I email back, saying "great! here are some bugs or areas you might help out with!", 99% of the time I get no further response. <p>For Open Source, my understanding has always been to work on a project, you must:

1. Dig in yourself, 2. Find something to fix or create, 3. Create a patch or set of files, 4. Submit it to the project moderators for approval, 5. Be invited to "join" based on your success in steps 1-4.

Have the "rules" changed? I explain to the requestors that I won't give "member" access right away: they have to write some code or make some other contribution, submit it for approval, and I'll consider letting them join. After that ... nothing.

Can I fix this? Am I doing this wrong? Is this exactly what I can expect?

I see other Open Source projects explicitly spell out the above join process. Do other projects have a better application/contribution ratio?

Related question: I've seen here on Hacker News that employers suggest candidates include pointers to Open Source projects they've done. Do employers actually _look_ at whether the candidate has actually _done_ anything?

I look at the profile of the people who contact me and most of the time they've done nothing even if they are a member of an Open Source project.