[observability] Observability Coverage Report - 2026-07-14

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

From 10 sampled runs in the last 7 days, 3 showed firewall telemetry and 4 showed MCP gateway activity. Two firewall-enabled runs preserved access.log with usable Squid entries and no blocked egress; three MCP-enabled runs preserved rpc-messages.jsonl as the canonical fallback. One run, Daily Reliability Review (§29292247726), had firewall + MCP setup in the workflow logs but the downloaded artifact set did not include either sandbox/firewall/logs/access.log or mcp-logs/rpc-messages.jsonl, which is a debugging gap.

Key Alerts and Anomalies

🔴 Critical Issues:

• §29292247726 Daily Reliability Review: no preserved access.log under the run artifact set and no preserved gateway.jsonl / rpc-messages.jsonl, despite workflow logs listing both firewall and MCP runtime paths.

⚠️ Warnings:

• None beyond the critical missing-artifact run.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	3	2	66.7%	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	4	3	75.0%	⚠️

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily Reliability Review	29292247726	❌	0	0	0	🔴
Auto-Triage Issues	29294438955	✅	26	14	0	✅
Daily Documentation Healer	29294543421	✅	153	73	0	✅

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
Daily Reliability Review	29292247726	2026-07-13	§29292247726

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Reliability Review	29292247726	❌ None	0	0	0	0	🔴
PR Sous Chef	29291517778	rpc-messages.jsonl	8	2	1	0	✅
Auto-Triage Issues	29294438955	rpc-messages.jsonl	4	1	1	0	✅
Daily Documentation Healer	29294543421	rpc-messages.jsonl	4	1	1	0	✅

Missing MCP Telemetry

Workflow	Run ID	Date	Link
Daily Reliability Review	29292247726	2026-07-13	§29292247726

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 179
• Unique domains observed: 4
• Blocked requests: 0
• Domains: api.anthropic.com:443, api.githubcopilot.com:443, o205451.ingest.us.sentry.io:443, otlp-gateway-prod-eu-west-2.grafana.net:443

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl only in the preserved sample
• Total JSONL entries analyzed: 16
• MCP servers observed: github, safeoutputs
• Total tool calls: 3
• Error rate: 0%
• Average response time: N/A for the preserved fallback format

Healthy Runs Summary

• Auto-Triage Issues (§29294438955)
• Daily Documentation Healer (§29294543421)
• PR Sous Chef (§29291517778)

Recommended Actions

1. Keep access.log and rpc-messages.jsonl in the preserved run artifact set for all firewall/MCP workflows.
2. Add a post-run assertion that warns when a run advertises firewall or MCP setup but the corresponding log directory is absent.
3. Prefer gateway.jsonl where available; otherwise keep rpc-messages.jsonl as the documented fallback and surface the source in the run summary.

References:

• §29292247726
• §29294543421
• §29291517778

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 10

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 6.82 AIC · ⊞ 16.2K · ◷

• expires on Jul 14, 2026, 4:09 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-15T00:09:22.605Z.

Closed by Workflow