Expand description
Tool-failure clustering (T0) — the flagship analyzer. Groups error Tool
grains (captured tool calls) by (tool_name, normalized error signature) and
fires when a cluster is frequent (≥ min_count) AND is either a meaningful
share of that tool’s calls (≥ min_rate) OR a large absolute count
(≥ min_abs) — so high-volume, moderate-rate failures aren’t hidden. Emits a
memory lesson. Because the signature is derived from
attacker-influenceable tool output, this analyzer never auto-applies
(§6.3) — its manifest is Never.