spring-projects/spring-petclinic
0.60
integrability index over 10 applicable dimensions
service
surfaces · owns data
$25k → $15k
classic COCOMO → neosloc value (60% survives)
buy
make / buy = 17.23 over 3 years
Dimensions
Interface surface 1 ad hoc A network surface exists: HTTP routes, an MCP server, or a standard protocol listener.
Can another program use it through a documented, machine-readable surface?
- next: L2 A contract exists: a checked-in OpenAPI/GraphQL/protobuf/AsyncAPI spec, a framework-generated spec, MCP tool schemas, or a standard application protocol that off-the-shelf clients speak (RESP, MQTT, gRPC, PostgreSQL wire, …). (no machine-readable contract)
service ladder · level 1
- ✓ L1 A network surface exists: HTTP routes, an MCP server, or a standard protocol listener. src/main/java/org/springframework/samples/petclinic/owner/OwnerController.java spring/jax-rs: 18 route declarations
- ✗ L2 A contract exists: a checked-in OpenAPI/GraphQL/protobuf/AsyncAPI spec, a framework-generated spec, MCP tool schemas, or a standard application protocol that off-the-shelf clients speak (RESP, MQTT, gRPC, PostgreSQL wire, …). no machine-readable contract
- ✗ L3 A contract covers its transport: an HTTP contract covers at least 80% of declared routes (generated contracts do), or the application layer over a standard protocol (commands, topics, payloads) is specified in a protocol document or AsyncAPI. no contract
- ✗ L4 A second surface: another transport (HTTP and a protocol, two protocols), an MCP server, a CLI with JSON output, or an SDK. only one programmatic surface
Contract stability 1 ad hoc Releases are versioned (semver tags or versioned changelog sections).
Can integrators rely on it not changing under them?
- next: L2 A changelog exists and marks breaking changes. (no changelog)
all ladder · level 1
- ✓ L1 Releases are versioned (semver tags or versioned changelog sections). 1 semver tags, latest 1.5.x
- ✗ L2 A changelog exists and marks breaking changes. no changelog
- ✗ L3 A deprecation mechanism is used in code (warnings, @deprecated, Deprecation/Sunset headers) or the API is versioned. no deprecation mechanism or API versioning
- ✗ L4 Across tagged releases, no OpenAPI operation, CLI option or __all__ symbol was removed without first being deprecated. fewer than two tagged releases to compare
Events 0 absent Not yet: Internal events exist (signals, queues, an outbox, emitters).
Can others react to state changes without polling?
- next: L1 Internal events exist (signals, queues, an outbox, emitters). (no internal events)
service ladder · level 0
- ✗ L1 Internal events exist (signals, queues, an outbox, emitters). no internal events
- ✗ L2 Webhooks sent by this system, or a streaming endpoint (SSE, WebSocket). no outbound webhooks or streams
- ✗ L3 Signed webhooks registrable through the API, or two mechanisms (webhooks, streams, a broker). one delivery mechanism, or webhooks that are unsigned or not registrable through the API
- ✗ L4 Events are described by AsyncAPI or CloudEvents. no AsyncAPI or CloudEvents contract
Identity 0 absent Not yet: Programmatic authentication (bearer tokens, API keys).
Can a machine act with its own revocable, least-privilege identity?
- next: L1 Programmatic authentication (bearer tokens, API keys). (no token auth)
service ladder · level 0
- ✗ L1 Programmatic authentication (bearer tokens, API keys). no token auth
- ✗ L2 Per-client, revocable credentials (managed API keys, service accounts) or OAuth2. no managed keys or OAuth
- ✗ L3 Credentials carry scopes or permissions. no scopes or permissions
- ✗ L4 Standard provisioning or federation (OIDC client credentials, SCIM). no OIDC client credentials or SCIM
Data portability 1 ad hoc The data schema is explicit (migrations, DDL, schema files).
Can its data get in and out, in bulk, in open formats, with an explicit schema?
- next: L2 An export exists (endpoint or command, not only the UI). (no export)
all ladder · level 1
- ✓ L1 The data schema is explicit (migrations, DDL, schema files). src/main/resources/db/h2/schema.sqlsrc/main/resources/db/mysql/schema.sql
- ✗ L2 An export exists (endpoint or command, not only the UI). no export
- ✗ L3 A bulk export in an open format, and a bulk import. no open export format
- ✗ L4 The export format is documented and the round trip is tested. the export format isn't documented
Agent ergonomics 0 absent Not yet: Errors are machine-readable: consistent JSON over HTTP, or a standard protocol's native error replies (RESP errors, MQTT reason codes, gRPC status, SQLSTATE).
Can an automated caller use it without guessing, and recover from failure?
- next: L1 Errors are machine-readable: consistent JSON over HTTP, or a standard protocol's native error replies (RESP errors, MQTT reason codes, gRPC status, SQLSTATE). (no machine-readable errors)
service ladder · level 0
- ✗ L1 Errors are machine-readable: consistent JSON over HTTP, or a standard protocol's native error replies (RESP errors, MQTT reason codes, gRPC status, SQLSTATE). no machine-readable errors
- ✗ L2 Field-level validation errors, and paginated lists. no request validation
- ✗ L3 Typed errors (RFC 9457 over HTTP, or a standard protocol's typed error codes), idempotent writes (Idempotency-Key), and rate-limit signals. no typed errors
- ✗ L4 Dry-run or validate-only, conditional requests, and agent docs. no dry-run
Embeddability 1 ad hoc Runnable from source with documented steps (a README with commands).
Can another system run and compose it without a human?
- next: L2 Configured through environment variables, documented: a .env example, a config schema, or docs naming at least half of the variables the code reads. (configuration isn't read from the environment)
service ladder · level 1
- ✓ L1 Runnable from source with documented steps (a README with commands). README.md
- ✗ L2 Configured through environment variables, documented: a .env example, a config schema, or docs naming at least half of the variables the code reads. configuration isn't read from the environment
- ✓ L3 A container image. .devcontainer/Dockerfile
- ✓ L4 Composition artifacts (compose, Helm, IaC). docker-compose.ymlk8s/db.yml 1 match
Extensibility 0 absent Not yet: Internal seams: a registry, registration function or plugin manager.
Can behaviour be added without modifying the code?
- next: L1 Internal seams: a registry, registration function or plugin manager. (no registry or registration function)
all ladder · level 0
- ✗ L1 Internal seams: a registry, registration function or plugin manager. no registry or registration function
- ✗ L2 The docs show how to add behaviour through those seams (even in-tree). no registration functions to document
- ✗ L3 Out-of-tree extensions are discovered (entry points, a plugin directory, configuration) without editing the package. extensions must be added inside the package
- ✗ L4 The extension API is versioned, has lifecycle hooks, and has example extensions. the extension API isn't versioned
Observability 1 ad hoc A health or readiness endpoint, or a container healthcheck.
Can an operator, or an orchestrating agent, tell whether it works and why not?
- next: L2 Structured logs. (no structured logging)
service ladder · level 1
- ✓ L1 A health or readiness endpoint, or a container healthcheck. k8s/db.yml 2 matchesk8s/petclinic.yml 2 matches
- ✗ L2 Structured logs. no structured logging
- ✗ L3 Metrics. no metrics
- ✗ L4 Distributed tracing (OpenTelemetry). no tracing
Change legibility 1 ad hoc A README and some tests.
Can an agent change it safely with limited context?
- next: L2 CI runs the tests; applications pin dependencies (libraries and zero-dependency projects are exempt). (no lockfile (applications should pin dependencies))
all ladder · level 1
- ✓ L1 A README and some tests. README.mdsrc/test/java/org/springframework/samples/petclinic/MySqlIntegrationTests.java 20 test files
- ✗ L2 CI runs the tests; applications pin dependencies (libraries and zero-dependency projects are exempt). no lockfile (applications should pin dependencies)
- ✓ L3 At least 90% of modules fit 32k tokens and no file exceeds 12k; test/source token ratio at least 0.3; at least 70% of the code is typed. src/test/java/org/springframework/samples/petclinic/MySqlIntegrationTests.java test ratio 1.36, 100% typed, modules fit
- ✗ L4 No import cycles, and agent docs (AGENTS.md, CLAUDE.md, llms.txt). no agent docs (AGENTS.md, CLAUDE.md, llms.txt)
Make or buy
Make with agents
106,707 output + 2,667,675 input tokens
on anthropic:claude-opus-5-5 ≈ $4.
1.2 agent-hours · 29.8 human days (1.0 steering + 28.8 rediscovering history).
$23,131 over 3 years
Buy (adopt as is)
240 min to running (via service) + 240 min to first use (via service).
240 min/year of upgrades; price $0/year.
$1,342 over 3 years
Buying wins below $7,263 per year. How this is estimated.
Classic COCOMO vs neosloc value
Classic COCOMO (sloccount)
0.92 KSLOC → 2.2 person-months over 3.4 months.
$25k
The effort to write it by hand, as COCOMO priced it in 1981.
neosloc value (neoCOCOMO)
Reproduce with agents: 0.4 PM (×0.19 of classic; 81% of behaviour captured by tests, contract and docs).
Rediscover uncaptured history: 1.4 PM (120 fixes in 962 commits by 167 authors).
× leverage 0.82 (integrability) × obsolescence 0.9.
$15k (1.3 PM)
What survives
60% of the classic figure
77% of the replacement cost lives only in code and history.
History
| Evaluated | Commit | neosloc | Index | Make or buy |
|---|---|---|---|---|
| 2026-10-07 | 500158f73241 | 0.8.0 | 0.60 | buy |
| 2026-10-07 | 500158f73241 | 0.7.4 | 0.60 | buy |
| 2026-10-07 | 500158f73241 | 0.7.3 | 0.60 | buy |
| 2026-10-07 | 500158f73241 | 0.7.2 | 0.50 | buy |