Evincia
SocialGoal — Modernization Readiness Profile
A readiness profile produced with the Evincia diagnostic engine against a public, unmaintained codebase. It describes where modernization risk concentrates and what a modernization effort would have to absorb. SocialGoal is a Marlabs reference application: an ASP.NET MVC 5 and Entity Framework 6 teaching sample built to demonstrate DDD, the Repository and Unit-of-Work pattern, and dependency injection, read here as a modernization subject and on those terms.
What leaders should take away
- Cleaner layering does not remove platform risk.
System.Weband net45 create a rewrite boundary before feature work.- Existing tests and service boundaries improve sequencing confidence.
- Controllers use the service layer today, but the codebase does not prevent a future developer from accessing the data layer directly.
- EF, identity, and package decisions should precede AI-assisted refactoring.
Check it yourself
Nothing here rests on trust alone. Clone the repository at the pinned commit and check every cited finding against the source. The engine that produced these findings is Evincia's and the run is deterministic -- pinned to the engine commit below -- so the output is fixed and the evidence is inspectable, even though re-running the engine end to end is ours to do. The 0–100 score on top of the findings is senior architect judgment, as the score section below spells out.
| Repository | github.com/MarlabsInc/SocialGoal |
|---|---|
| Pinned commit | 42cfdb4 · full 42cfdb48c5a450793c19c0503ea0ce786eb8e46a · last commit 2014-06-09 · unmaintained (a 2014 HEAD; not formally archived) |
| License | MIT · attribution preserved: "Copyright (c) 2014 Marlabs. MIT." (architecture inspired by EFMVC) |
| Engine commit | 73d9f87 · Roslyn-based; nine automated categories (1–9), three senior architect review categories (10–12) |
| Run | evincia-SocialGoal-2026-06-12-183458-8d3c33 · source/SocialGoal.sln · Engagement mode (RequireFullCoverage) · 2026-06-12 |
| Coverage | A3 Full coverage: Yes -- 7 of 7 projects loaded via solution load, 0 syntax-only fallback, 0 skipped (confidence impact: None) -- with a host-toolchain qualification; see Confidence & coverage below |
Inspect the evidence: git clone https://github.com/MarlabsInc/SocialGoal.git and git checkout 42cfdb4, then open the files each finding cites and read them against the source. (Re-running the diagnostic end to end points the Evincia engine, commit 73d9f87, at source/SocialGoal.sln in Engagement mode -- the engine is ours, so that step stays in-house. Install the .NET Framework 4.5 targeting pack on the build host first for the cleanest semantic load; without it MSBuild cannot resolve the net45 reference assemblies, detailed below.) Findings paraphrase the source and cite file/project locations; no substantial verbatim code is reproduced.
Executive summary
SocialGoal is a small, deliberately layered ASP.NET MVC 5 application on .NET Framework 4.5: a social goal-tracking reference app built by Marlabs, with seven projects (SocialGoal.Model, SocialGoal.Data, SocialGoal.Core, SocialGoal.Service, SocialGoal.Web.Core, SocialGoal.Web, and SocialGoal.Tests) that follow a recognizable DDD and Repository / Unit-of-Work separation. It uses ASP.NET Identity over OWIN middleware for authentication, Entity Framework 6 for data access, and AutoMapper between layers. It is a teaching sample, and the structure shows intentional design. The modernization difficulty here is not sloppiness -- it is the depth and certainty of the platform dependency.
The dominant risks are all platform-bound and certain. Every project targets net45, which reached end of support in 2016 (RULE-001, Pri 25), and System.Web is imported across 98 locations spanning SocialGoal.Web, SocialGoal.Web.Core, SocialGoal.Model, and SocialGoal.Tests (RULE-002, Pri 25): System.Web.Mvc, Routing, Optimization, Security, and SessionState -- a hosting and request-pipeline rewrite, not a retarget.
Forms authentication over the OWIN identity stack (RULE-036, Pri 16) and the MvcMailer library are bound to classic ASP.NET with no direct ASP.NET Core equivalent. The one critical-band structural finding the engine surfaced is SocialGoal.Web's direct reference to SocialGoal.Data (RULE-003, Pri 20) -- rated Critical by the rule, contested by the senior architect, and resolved by the sample LMRR's v1.1 code read as composition-root wiring (with one paging type leaked through service signatures) rather than an active service-layer bypass, re-rated Low. What it leaves behind is a convention-only boundary the rewrite must hold. On top of the platform, the dependency layer carries real debt: 14 deprecated packages (RULE-011, Pri 16), eight flagged vulnerable (RULE-027, Pri 12; five carry published advisories), and Entity Framework 6 pinned at three different versions across three projects, one a pre-release beta (RULE-022, Pri 16; RULE-025, Pri 9).
What it can absorb today is limited and sequential, but the starting position is genuinely better than its legacy peers. Because everything is downstream of the platform decision, the system cannot meaningfully absorb modernization or AI-assisted refactoring until the target platform is chosen and the EF path is set. But SocialGoal arrives with a real NUnit test project, clean DDD layering -- a dedicated service layer, IRepository/IDataStore, and DI registration are all detected (Signal 2.5), with no god classes (Signal 2.6) -- and only two categories flagged for immediate attention: Platform Obsolescence and Structural Coupling. Its directional read is Red, but the mildest Red of the legacy cohort. The thing that breaks first is the build: all seven projects share net45, and a single retarget cascades through the reference graph.
Modernization Readiness Score
The score is the senior architect's synthesis of the engine's signals: the architect assigns the 0-to-100 number from the dimension reads, then labels it with the Red/Yellow/Green band on the canonical Evincia scale (Red 0–49 / Yellow 50–79 / Green 80–100). The engine did not compute it.
Red because the platform dimension is total net45 lock-in with a System.Web rewrite and no in-place path. The mildest of the legacy cohort because only two categories are flagged for immediate attention (Platform Obsolescence, Structural Coupling), only three findings are critical, and -- unlike the eShop and Kooboo profiles -- SocialGoal ships a real NUnit test project, so the no-tests rule does not fire. Its change-safety and architecture read visibly better than the other legacy apps. Each dimension below is read on a 0–25 scale (higher = more ready); they sum to 44. The reads are senior architect judgment, not engine-computed values.
| Dimension | Architect read (0–25) | What drives it here |
|---|---|---|
| Platform Obsolescence | Severe · 6/25 | All 7 projects on net45 (RULE-001, Pri 25); System.Web across 98 locations (RULE-002, Pri 25); Forms auth over OWIN (RULE-036, Pri 16); [ComVisible] to confirm (Signal 1.3). The DDD port feasibility (Cat 10) is senior architect review. |
| Architectural Coupling | Elevated · 13/25 | SocialGoal.Web references SocialGoal.Data directly (RULE-003, Pri 20; resolved as composition-root wiring in the sample LMRR v1.1); EF6 version split across 3 projects (RULE-022, Pri 16); web/test fan-out (RULE-018, Pri 12). But the positive structural signals are real -- a dedicated service layer, IRepository/IDataStore, and DI registration are all detected (Signal 2.5), and no god classes (Signal 2.6). Cat 11 senior architect review. |
| Dependency Risk | Elevated · 10/25 | 14 deprecated packages incl. the OWIN and EF stack (RULE-011, Pri 16); 8 packages flagged vulnerable (RULE-027, Pri 12; five with published advisories); cross-project SDK coupling incl. MvcMailer (RULE-016, Pri 12); EF version conflict (RULE-025, Pri 9). Category 8 is clean (0 findings). |
| Change Safety | Moderate · 15/25 | A real NUnit test project exists -- but the 0.17 production test ratio (Signal 7.1) is flagged for review; a hardcoded placeholder URL in test code (RULE-014, Pri 16, SocialGoal.Tests); ELMAH observability (Signal 7.4); database triggers unknown (Signal 5.2). Cat 12 senior architect review. |
This profile first published at 43/100. A later re-read of Change Safety against measured test coverage (OpenCover, 2026-06-17) raised that dimension from 14 to 15, moving the composite to 44. The Red band (0–49) is unchanged.
Risk register — representative critical rows
Presented in the 12-field LMRR schema; only the representative columns are shown here, and the corrected false positives are excluded. Priority is the engine's severity score for each finding -- Probability (1–5) × Impact (1–5), so it runs 1–25 and a higher number is more severe; the rows below are all in the engine's Critical band (Priority 20–25). The column keeps the engine's number even after a ruling: where the senior architect re-rated a finding, the action cell carries the resolved severity (R-003: re-rated Low, 6). Confidence and automation level are senior architect estimates; type-resolution-dependent findings carry the semantic caveat in Confidence & coverage.
| ID | Finding | Category | Priority | Recommended action |
|---|---|---|---|---|
| R-001 | All 7 projects target .NET Framework 4.5 (end of support 2016) | Platform Obsolescence | 25 | Decide the target framework first; net45 has no in-place path, so all 7 projects retarget together. |
| R-002 | System.Web saturation across 98 locations | Platform Obsolescence | 25 | Rewrite the System.Web surface onto the ASP.NET Core pipeline; it is excluded from modern .NET. |
| R-003 | Web layer references the data layer directly | Structural Coupling | 20 | Resolved by senior-architect code read (sample LMRR v1.1): composition-root wiring, with one paging type leaked through service signatures; no bypass; re-rated Low (6). Keep controllers service-mediated through the migration. |
Consolidation. The Entity Framework story is one work item carried across three rule fires for traceability -- the EF6-to-EF Core upgrade (RULE-022), the version conflict across the three projects (RULE-025), and the code-first determination that needs manual confirmation (Signal 4.4). The deprecated-package (RULE-011) and vulnerable-package (RULE-027) clusters overlap on the OWIN/EF surface and are kept distinct only because their remediation timelines differ (deprecation versus CVE). RULE-014 (Pri 16) fires only in SocialGoal.Tests on the placeholder URL http://yoursite/, so it is test-infrastructure hygiene, not a production-coupling blocker; the production session abstraction (Helpers/SocialGoalSessionFacade.cs) is the artifact to inspect for scale-out concerns, and that is a senior architect review item rather than an engine fire on this run. Unlike the other legacy profiles in this program, SocialGoal carries a genuine change-safety advantage, and Category 8 (Internal Integration Complexity) is clean.
Modernization Risk Profile
Illustrative assessment based on observed patterns. These are qualitative risk levels, not measured client scores.
What will break first
- The build, on the first retarget. All seven projects share net45, and the workspace already cannot find the net45 reference assemblies on a modern machine (A3, all 7 projects). Retarget one project and its dependents break in a cascade:
SocialGoal.Websits on Core, Data, Model, Service, and Web.Core (RULE-018), so the graph has to move together. A team picking this up hits a reference-assembly and retarget wall before any code runs. - The request pipeline and identity, on the first port off System.Web. The moment the project leaves System.Web (R-002), MVC controllers, routing, bundling, Forms authentication (RULE-036), and the OWIN identity middleware all lose their host at once. These are not config tweaks; the hosting model and the identity system both have to be rebuilt on ASP.NET Core, and MvcMailer (RULE-016) has no equivalent to port to.
- The data layer, on the EF move. The three EF6 versions (6.0.0 / 6.0.1 / 6.0.2-beta1, RULE-022) can interact subtly at runtime today, and EF6 to EF Core changes lazy loading, change tracking, and database initializers. The data layer leans code-first (a DbContext subclass and DbSet properties are present), but migrations were not detected and auto-generated code is present, so schema ownership needs manual confirmation before the move (Signal 4.4). If any tables carry triggers (Signal 5.2), the migration absorbs hidden behavior the code never showed. With a 0.17 test ratio (Signal 7.1), a silent data regression is the hardest failure to catch.
Suggested modernization sequencing
- Clear the build floor and decide the platform. Install the net45 targeting pack to get a clean baseline, then choose the ASP.NET Core target. This gates everything: the System.Web rewrite (R-002), the runtime move off net45 (R-001), and the identity replacement all hang off it.
- Confirm the change-safety net. A test project already exists (the no-tests rule did not fire), so the work is assessment, not greenfield: judge whether the NUnit suite gives real regression coverage (Signal 7.1) at the 0.17 production ratio before any port.
- Preserve and enforce the service boundary. Today, controllers correctly go through the service layer, but the codebase does not prevent future developers from accessing the data layer directly. During the ASP.NET Core rebuild, keep controllers behind the service layer, remove unused references to the data layer, add an automated architecture rule that blocks direct controller-to-data access, and have Identity use the same request-scoped database context as the rest of the application.
- Settle the data and identity targets. Consolidate the EF version split (RULE-025), confirm schema ownership for the code-first-leaning data layer (Signal 4.4), and plan the EF6-to-EF Core move (RULE-022) and the System.Data.SqlClient swap; replace Forms auth over OWIN with ASP.NET Core cookie authentication (RULE-036).
- Remediate dependencies, then close the engine's blind spots. Upgrade or replace the deprecated (RULE-011) and vulnerable (RULE-027) packages and the cross-project SDKs incl. MvcMailer (RULE-016); externalize the placeholder URL in the test project (RULE-014). Then run the senior architect review checks the engine cannot: the database-trigger inventory (Signal 5.2), the
[ComVisible]review (Signal 1.3), the ELMAH replacement (Signal 7.4), and the categories 10–12 architectural calls.
Confidence & coverage
This run reports Full coverage: Yes -- all 7 projects loaded via solution load with full syntax-tree analysis, 0 syntax-only fallback, 0 skipped, and Impact on confidence: None in A3 -- and for load fidelity that is the authoritative signal: every project received full syntax-tree analysis, and A13 rates every top finding at Full confidence. It needs one honest qualification. The A3 workspace diagnostics record MSBuild failures on every project: the engine's stamped SDK host could not resolve the .NET Framework 4.5 reference assemblies (the “install the targeting pack” failure), plus processor-architecture mismatches between the MSIL project targets and the x86/AMD64 system assemblies (mscorlib, System.Data, System.Web). These are host-environment issues, not code defects, and Roslyn recovered syntax trees regardless, so the deterministic platform, dependency, and coupling findings above are robust; a small number of platform-edge findings are direction, not measurement.
The reconciliation is straightforward: for these .NET Framework targets, A3 load fidelity is the right coverage signal. The stamped host MSBuild version (10.0.300) is not the toolset that actually loads net45 -- a separate Roslyn net472 build host does -- but the host-level diagnostics still mean some semantic resolution of certain net45 framework references may be incomplete. This was an Engagement-mode run (full coverage enforced), the bar for client-grade use, and it completed with full coverage and no confidence impact. Installing the .NET Framework 4.5 targeting pack on the build host would close the remaining semantic-resolution caveat. The score and the four dimensions are senior architect judgment, not mechanical; categories 10–12 are senior-architect-only and were not produced by the engine.
What we corrected from the first run
This is the part most diagnostic tools never show you. The first senior architect read of SocialGoal landed a PARTIAL -- the central read was right, but the headline was noised up by engine false positives. Each was fixed at the source, and on this publication run the read was re-rated AGREE with no residual. The corrections:
- A false “hardcoded IP address”. The engine read the assembly's
1.0.0.0version string as an embedded network address, across all seven projects (engine fix C1-007 / C1-017). It is gone: RULE-014 now fires only on the placeholder URLhttp://yoursite/inSocialGoal.Tests-- test-infrastructure hygiene, not a blocker. - A false “implicit schema dependency”. RULE-010 matched an email-validation regex on a view model as a schema-qualified database reference (engine fix C1-002). It is gone, and not in the register.
- Two test-project findings inflated into the top-10. Structural- and behavioral-coupling rules (RULE-005 / RULE-020) had headlined the test files (engine fix C1-010). They are gone; the register now carries production coupling only and points to the real artifact,
Helpers/SocialGoalSessionFacade.cs. - A false negative on the data layer. The engine had missed that
SocialGoalEntitiesderives fromIdentityDbContext(a DbContext subclass), manufacturing a code-first / database-first ambiguity (engine fix C1-009, landed in218e798). It now recognizes the subclass and routes the code-first determination to senior architect review by design, which this profile reflects honestly.
The platform read here -- net45 throughout, System.Web saturation, Forms auth over OWIN, the deprecated and vulnerable packages, EF6, and the Web-to-Data reference -- is source-verified and stands. The severity of that last item was the one open interpretation: contested in the sample LMRR at publication, then resolved by a senior-architect code read (v1.1, 2026-07-13) as composition-root wiring (with one paging type leaked through service signatures) rather than an active bypass, and re-rated Low. The senior architect read against this exact publication run is a re-confirmed AGREE, with no residual disagreement.
What is mechanical, and what is senior architect judgment
The engine emits deterministic raw signals across nine automated risk categories and scores findings on fixed rules (Probability 1–5 × Impact 1–5 = Priority 1–25). Three further categories -- Migration Feasibility, Embedded Business Logic Risk, and Domain Knowledge Risk -- are senior architect review only; the engine produces no findings for them. The 0-to-100 score and the four dimension reads are senior architect judgment, synthesized from the signals. The engine does not compute the number, and this profile does not invent one.
On this run, 12 deterministic rules fired across 194 findings on all 7 projects -- every project loaded with full syntax-tree analysis (0 fallback, 0 skipped), and A13 rates every top finding at Full confidence. SocialGoal is a clean illustration of the boundary: the engine nailed the mechanical blockers -- the platform, System.Web, Forms auth, EF, and the deprecated and vulnerable packages -- with high certainty. The layer-boundary detection was right too; its Critical severity was the one over-read, contested by the senior architect and later resolved by code read as composition-root wiring (with one paging type leaked through service signatures), which is the detection/judgment boundary doing its job. The largest forward questions belong to the architect: whether the deliberate DDD layering ports cleanly is a Migration-Feasibility call (Cat 10); what business rules live in the Service and Core layers and behind the database is Embedded Business Logic (Cat 11); how much goal-tracking domain knowledge a team must reconstruct is Domain Knowledge (Cat 12). The engine surfaced their symptoms but correctly did not manufacture an architectural verdict it cannot mechanically support.
Modernization lesson
A layered legacy system is still legacy. Architecture can reduce modernization uncertainty, but it does not make the unsupported runtime or the identity, MVC, EF, and package decisions disappear.
For systems like SocialGoal, the value is sequencing confidence. Leadership can separate the platform rewrite from the smaller coupling defects instead of treating the whole system as equally opaque.
About this profile
Source: the Evincia diagnostic engine (commit 73d9f87), Output A (raw signals) and Output B (narrative). Findings paraphrase the codebase; see the repository at the pinned commit for the original source. Analyzes MarlabsInc/SocialGoal under the MIT License; attribution preserved (Copyright (c) 2014 Marlabs). This is an illustrative readiness profile of a public, unmaintained teaching sample, not an engagement and not a judgment of its maintainers. Part of the Evincia Public Codebase Teardowns program.