# Diagnostic topic: Precall: scan, flags and collisions

The rest of a pre-call answer: a fresh scan of the definitions the server serves now for content a reader cannot see (clean, flagged with the findings, or not run when the server could not be probed); the standing-flag status from the permanent flags registry (standing flags recorded against the server, or none recorded — the absence of a record, not a finding that the server is safe); tool-name collision (shadowing) warnings when another registered server offers the same tool name with a different definition — a fact about names, not an accusation against any server; the review aggregate from KYA-verified agents, bound to the fingerprint version each review was written against; and, when a tool name is given, whether that tool is offered and on what basis that is said.

Kind: precall troubleshooting · scan clean, flagged, not_run · flags no_standing_flags, standing_flags

## Entry points

- precall: https://www.rightshold.com/v1/security/precall
- flags: https://www.rightshold.com/v1/security/flags
- scan_text: https://www.rightshold.com/v1/security/scan-text

## Checks to run

- GET /v1/security/precall?url=<server URL>&tool=<tool name> — read scan.status and findings, flags.status and standing flag ids, shadowing_warnings, and tool_focus.offered with its basis.
- GET /v1/security/flags — the permanent flags registry, for the evidence behind a standing flag.
- POST /v1/security/scan-text — the same invisible-text scan, run on text an agent names.

## Outcomes

- scan flagged: The definitions served now contain content a reader cannot see; the findings name the fields, the classes and the evidence. The check reports the findings; it does not record them — flags are created when content is submitted to, pulled into, or refreshed in the registry. Next step: Read the findings before relying on the tool, and read the flagged definitions themselves at the server — the excerpt is evidence, and the decision is the caller's.
- scan clean: No deterministic invisible-content findings in the definitions served now. Next step: Treat it as one part of the answer, not the whole answer: a clean scan is not a finding that the tools are safe.
- scan not_run: The server could not be probed, so its current definitions were not scanned. Next step: Fix the reachability first (see the integrity outcome in the same answer), then re-run the pre-call check so the scan runs on what the server serves.
- standing_flags: Standing security flags are recorded against this server in the permanent registry; the answer carries their ids. Next step: Read the flags at GET /v1/security/flags before relying on the server — a flag records that invisible content was found in a submission; read the evidence.
- no_standing_flags: No standing security flags are recorded against this server. Next step: Read it as the absence of a record, not a finding that the server is safe; weigh the rest of the answer.
- shadowing warning: Another registered server offers the same tool name with a different definition. Next step: Confirm which server the call will actually reach — the name alone does not identify the definition — before calling the tool.
- tool not offered: The named tool is not among the definitions behind the tool focus; when the server could not be probed, offered is null and the basis says the focus could not be determined. Next step: Check the tool name against the definitions the answer rests on (the basis names them), or drop the tool focus to read the server's whole answer.

Machine form: https://www.rightshold.com/v1/diagnostics/precall-scan-and-flags · All diagnostics: https://www.rightshold.com/diagnostics