[observability] Observability Coverage Report - 2026-07-20

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I reviewed a capped sample of 4 recent workflow runs from the last 7 days, focused on AWF Firewall and MCP Gateway observability. Coverage is complete in the sampled set: every firewall-enabled run had a readable access.log, and every MCP-enabled run had telemetry via rpc-messages.jsonl. No critical observability gaps were found in this sample.

The main pattern is that firewall logging is healthy and includes both allowed and blocked traffic, while MCP telemetry is present but currently lands on the canonical fallback path rather than gateway.jsonl. That is acceptable for debugging, but it is lower-fidelity than the preferred structured gateway log.

Key Alerts and Anomalies

No critical issues detected.

🔴 Critical Issues:

• None in the analyzed sample.

⚠️ Warnings:

• MCP runs relied on rpc-messages.jsonl only; gateway.jsonl was not present in the sampled runs.
• The MCP telemetry stream was sparse and only showed safeoutputs RPC traffic, so tool-level observability is present but narrow.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	2	2	100%	✅
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	2	2	100%	✅

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
PR Sous Chef	29707980574	✅	38	20	1	✅
PR Sous Chef	29708769358	✅	146	68	1	✅

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
None	-	-	-

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
PR Sous Chef	29707980574	rpc-messages.jsonl	4	1	1	0	✅
PR Sous Chef	29708769358	rpc-messages.jsonl	4	1	1	0	✅

Missing MCP Telemetry

Workflow	Run ID	Date	Link
None	-	-	-

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log lines analyzed: 184
• Unique domains observed: 9
• Allowed requests: 88
• Blocked requests: 2
• Firewall logs showed both successful CONNECT traffic and at least one blocked request, which is the minimum needed for debugging egress issues.

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl (canonical fallback)
• Total entries analyzed: 8
• MCP servers observed: 1
• Total tool-call requests: 2
• Error rate: 0%
• Average response time: N/A from the fallback source

Healthy Runs Summary

• 29707980574: firewall and MCP telemetry both present
• 29708769358: firewall and MCP telemetry both present

Recommended Actions

1. Keep exporting access.log for all firewall-enabled runs; it is currently sufficient for debugging network egress issues.
2. Prefer gateway.jsonl when available for MCP runs so per-tool timing and richer event fields are available.
3. Preserve the canonical rpc-messages.jsonl fallback, since it prevents MCP runs from becoming opaque when the preferred gateway log is absent.

References:

• §29707980574
• §29708769358

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 4

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 13.8 AIC · ⊞ 11.9K · ◷

• expires on Jul 20, 2026, 4:09 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #46935.