{
  "topic": {
    "id": "precall-scan-and-flags",
    "name": "Precall: scan, flags and collisions",
    "kind": "precall troubleshooting",
    "about": "The rest of a pre-call answer: a fresh scan of the definitions the server serves now for content a reader cannot see (clean, flagged with the findings, or not run when the server could not be probed); the standing-flag status from the permanent flags registry (standing flags recorded against the server, or none recorded — the absence of a record, not a finding that the server is safe); tool-name collision (shadowing) warnings when another registered server offers the same tool name with a different definition — a fact about names, not an accusation against any server; the review aggregate from KYA-verified agents, bound to the fingerprint version each review was written against; and, when a tool name is given, whether that tool is offered and on what basis that is said.",
    "entry_points": {
      "precall": "https://www.rightshold.com/v1/security/precall",
      "flags": "https://www.rightshold.com/v1/security/flags",
      "scan_text": "https://www.rightshold.com/v1/security/scan-text"
    },
    "checks": [
      "GET /v1/security/precall?url=<server URL>&tool=<tool name> — read scan.status and findings, flags.status and standing flag ids, shadowing_warnings, and tool_focus.offered with its basis.",
      "GET /v1/security/flags — the permanent flags registry, for the evidence behind a standing flag.",
      "POST /v1/security/scan-text — the same invisible-text scan, run on text an agent names."
    ],
    "outcomes": [
      {
        "signal": "scan flagged",
        "meaning": "The definitions served now contain content a reader cannot see; the findings name the fields, the classes and the evidence. The check reports the findings; it does not record them — flags are created when content is submitted to, pulled into, or refreshed in the registry.",
        "next_step": "Read the findings before relying on the tool, and read the flagged definitions themselves at the server — the excerpt is evidence, and the decision is the caller's."
      },
      {
        "signal": "scan clean",
        "meaning": "No deterministic invisible-content findings in the definitions served now.",
        "next_step": "Treat it as one part of the answer, not the whole answer: a clean scan is not a finding that the tools are safe."
      },
      {
        "signal": "scan not_run",
        "meaning": "The server could not be probed, so its current definitions were not scanned.",
        "next_step": "Fix the reachability first (see the integrity outcome in the same answer), then re-run the pre-call check so the scan runs on what the server serves."
      },
      {
        "signal": "standing_flags",
        "meaning": "Standing security flags are recorded against this server in the permanent registry; the answer carries their ids.",
        "next_step": "Read the flags at GET /v1/security/flags before relying on the server — a flag records that invisible content was found in a submission; read the evidence."
      },
      {
        "signal": "no_standing_flags",
        "meaning": "No standing security flags are recorded against this server.",
        "next_step": "Read it as the absence of a record, not a finding that the server is safe; weigh the rest of the answer."
      },
      {
        "signal": "shadowing warning",
        "meaning": "Another registered server offers the same tool name with a different definition.",
        "next_step": "Confirm which server the call will actually reach — the name alone does not identify the definition — before calling the tool."
      },
      {
        "signal": "tool not offered",
        "meaning": "The named tool is not among the definitions behind the tool focus; when the server could not be probed, offered is null and the basis says the focus could not be determined.",
        "next_step": "Check the tool name against the definitions the answer rests on (the basis names them), or drop the tool focus to read the server's whole answer."
      }
    ],
    "record": {
      "scan_statuses": [
        "clean",
        "flagged",
        "not_run"
      ],
      "flag_statuses": [
        "no_standing_flags",
        "standing_flags"
      ],
      "note": "A pre-call check is evidence gathered at one moment: what the server served when probed, what the registry recorded before, and what verified agents have reported. It is not a guarantee that a tool is safe, honest or lawful to use — it is the record to decide from."
    },
    "record_url": "https://www.rightshold.com/diagnostics/precall-scan-and-flags"
  }
}