# Diagnostic topic: Precall: integrity outcomes

A pre-call answer's integrity block compares the tool definitions a server serves now with the fingerprint recorded earlier, and reports exactly one of four statuses. Unchanged is the only status that says the definitions match the record — and it is not a finding that a tool is safe. Changed carries a plain diff of how the definitions differ. Unreachable means the server could not be probed for this check, so nothing can be said about its current definitions — it is never reported as unchanged. Not registered means the server was probed for this answer only: there is no recorded fingerprint to compare against, the fingerprint in the answer is what it serves now, computed for the answer and not stored, and checking a server does not register it.

Kind: precall troubleshooting · 4 integrity statuses: unchanged, changed, unreachable, not_registered

## Entry points

- precall: https://www.rightshold.com/v1/security/precall
- external_servers: https://www.rightshold.com/v1/store/external
- definition_changes: https://www.rightshold.com/v1/security/changes

## Checks to run

- GET /v1/security/precall?url=<server URL> — read integrity.status, integrity.detail and, when present, integrity.diff.
- GET /v1/security/changes — the definition-change feed the integrity check feeds, for what changed and when.
- GET /v1/store/external — the registry record a registered server's fingerprint and history live on.

## Outcomes

- unchanged: The definitions the server serves now match the fingerprint recorded earlier. Next step: Read the rest of the answer before relying on the tool — the scan, the standing flags and the review aggregate are separate evidence, and unchanged is not a finding that a tool is safe.
- changed: The definitions differ from the record; the answer's diff says how. Next step: Read the diff in the answer and the definition-change feed, then decide from the new definitions — re-run the pre-call check after any fix so the answer reflects what the server serves now.
- unreachable: The server could not be probed for this check, so nothing can be said about its current definitions. Next step: Check the URL and that the server is up, then run the pre-call check again; the tool focus in such an answer rests on the last recorded definitions, and says so.
- not_registered: The server is not in the registry, so there is no recorded fingerprint and no history to read; it was probed for this answer only. Next step: Decide from this answer's fresh probe and scan, or register the server (POST /v1/store/external) so later checks compare against a recorded fingerprint. If the URL redirected, register the destination directly — the answer names it as the effective URL.

Machine form: https://www.rightshold.com/v1/diagnostics/precall-integrity · All diagnostics: https://www.rightshold.com/diagnostics