Interesting. Most of the failures I've seen aren't the agent doing something obviously daft, it's a tool call that returns fine but the result shouldn't be trusted. Stale cached data, or a web page or file with text in it that's basically trying to give the agent instructions. Everything after that looks reasonable, it's just built on a bad input.

Can flow-1 flag that kind of thing? And how does it tell the difference between the tool giving back something wrong and the agent misreading a result that was actually fine? From the trace alone those look pretty similar to me.