reviewing-interoperability

Does the code correctly speak external standards? HTTP/OAuth semantics, SemVer, RFC date/URI/email formats, Unicode, cron dialects, OTel semconv.

When to use

Reviews a change for interoperability — whether the code correctly speaks the external standards and protocols it claims to (ISO/IEC 25010:2023). Consolidates conformance checks scattered across other lenses: HTTP semantics (safe/idempotent methods, status codes, conditional requests, caching); OAuth 2.0 / OIDC flow correctness (exact redirect_uri, state/nonce, PKCE); Semantic Versioning and wire/format back-compat; RFC formats (date, URI, email, JSON, CSV); Unicode normalization and encoding (NFC, UTF-8, the YAML "Norway" class); cron dialects (POSIX vs. Quartz); OpenTelemetry semantic conventions; and co-existence (ports, global state, shared paths). Use when a change parses or emits a standard format, calls or implements an external protocol or auth flow, versions a published surface, or serializes data another system reads. Owns conformance to an external standard; defers the contract we author to #13, internal correctness to #4, idiom to #8, config to #26. Skip changes with no boundary-crossing standard.

Shape: diff. Written for concrete code; not meant for design docs or plans.

Reviewer discipline

Report only real problems. If the code correctly handles the case, reply "No findings" and stop — do not invent issues. This guards against false positives on correct code; still report every genuine issue you do find, with its full detail.

Defects are the default; improvements are opt-in. By default this lens is defect-only: do not suggest changes to code that is already correct. When the team has opted up into improvement suggestions, a finding on already-correct code is admissible only as nit-severity, route: implementer (the author applies, defers, or ignores), and must clear the non-configurable anti-churn floor: it must genuinely improve — never offer a merely equivalent alternative — and must converge (once a dimension is as good as you can confidently make it, stop; never oscillate A→B then B→A, never re-order to an equivalent state). Defects keep the strict bar above regardless of this setting.

Team preferences. If the reviewed repo has .code-quality-atlas/preferences.md, apply it before reporting: a repo's .code-quality-atlas/preferences.md may set/tune this lens's thresholds or selection, and — being preference-tier — may suppress one of its findings outright (it never surfaces). Its improvement-valence directive is also what decides whether the "opted up" improvement-suggestion behavior above is active for this review. Absent the file, apply this lens's defaults exactly as written above.

Pre-existing defects in touched code are surfaceable, not yours to fix. When you notice a genuine defect this change did not introduce but that sits in the code this PR actually touches — the edited function or immediately adjacent lines — you may surface it, tagged "pre-existing — not introduced by this change." Like improvements it is opt-in and default-quiet (off unless the team opts up), route: implementer, and non-blocking: it informs the author's fix-now / file-a-ticket / ignore call and never sets this PR's verdict, because the diff did not cause it. Stay scoped to code the change touches — a repo-wide hunt is the audits' job, not this review — and never let it expand the PR's scope.