Does duration_drift use a fixed latency threshold?

No. duration_drift has no absolute threshold anywhere in it, like flagging anything slower than five seconds. A single-tool lookup and a thirty-step research run can both be completely normal while sitting two orders of magnitude apart, so a fixed cutoff would either miss the agent that’s always been slow or fire constantly on the one that’s supposed to be fast.

Instead, each call site and each tool is compared only against its own recent history. What counts as drift is a real shift away from what that specific bucket normally does, reported as a multiplicative change like 1.4x slower rather than a raw number of seconds. That’s also why a brand new call site takes a while to be useful: there’s no history to compare against until it’s built up enough of its own traffic to know what normal looks like for it.