{
  "topic": {
    "id": "precall-integrity",
    "name": "Precall: integrity outcomes",
    "kind": "precall troubleshooting",
    "about": "A pre-call answer's integrity block compares the tool definitions a server serves now with the fingerprint recorded earlier, and reports exactly one of four statuses. Unchanged is the only status that says the definitions match the record — and it is not a finding that a tool is safe. Changed carries a plain diff of how the definitions differ. Unreachable means the server could not be probed for this check, so nothing can be said about its current definitions — it is never reported as unchanged. Not registered means the server was probed for this answer only: there is no recorded fingerprint to compare against, the fingerprint in the answer is what it serves now, computed for the answer and not stored, and checking a server does not register it.",
    "entry_points": {
      "precall": "https://www.rightshold.com/v1/security/precall",
      "external_servers": "https://www.rightshold.com/v1/store/external",
      "definition_changes": "https://www.rightshold.com/v1/security/changes"
    },
    "checks": [
      "GET /v1/security/precall?url=<server URL> — read integrity.status, integrity.detail and, when present, integrity.diff.",
      "GET /v1/security/changes — the definition-change feed the integrity check feeds, for what changed and when.",
      "GET /v1/store/external — the registry record a registered server's fingerprint and history live on."
    ],
    "outcomes": [
      {
        "signal": "unchanged",
        "meaning": "The definitions the server serves now match the fingerprint recorded earlier.",
        "next_step": "Read the rest of the answer before relying on the tool — the scan, the standing flags and the review aggregate are separate evidence, and unchanged is not a finding that a tool is safe."
      },
      {
        "signal": "changed",
        "meaning": "The definitions differ from the record; the answer's diff says how.",
        "next_step": "Read the diff in the answer and the definition-change feed, then decide from the new definitions — re-run the pre-call check after any fix so the answer reflects what the server serves now."
      },
      {
        "signal": "unreachable",
        "meaning": "The server could not be probed for this check, so nothing can be said about its current definitions.",
        "next_step": "Check the URL and that the server is up, then run the pre-call check again; the tool focus in such an answer rests on the last recorded definitions, and says so."
      },
      {
        "signal": "not_registered",
        "meaning": "The server is not in the registry, so there is no recorded fingerprint and no history to read; it was probed for this answer only.",
        "next_step": "Decide from this answer's fresh probe and scan, or register the server (POST /v1/store/external) so later checks compare against a recorded fingerprint. If the URL redirected, register the destination directly — the answer names it as the effective URL."
      }
    ],
    "record": {
      "statuses": [
        "unchanged",
        "changed",
        "unreachable",
        "not_registered"
      ],
      "note": "An integrity check compares the tool definitions a server serves now with the fingerprint recorded earlier. \"Unchanged\" means the definitions match what was recorded — it is not a finding that a tool is safe. \"Changed\" means the definitions differ from the record; the diff says how. \"Unreachable\" means the server could not be probed for this check, so nothing can be said about its current definitions."
    },
    "record_url": "https://www.rightshold.com/diagnostics/precall-integrity"
  }
}