[observability] Observability Coverage Report - 2026-07-07

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I sampled the 20 most recent unique runs from the last 7 days. Firewall summary data exists for 19 of them, but no raw access.log/ directories were present anywhere under /tmp/gh-aw/aw-mcp/logs, so Squid egress debugging is not currently supported by the downloaded artifacts. I also found no gateway.jsonl or rpc-messages.jsonl files in the sample, including tool-heavy PR Sous Chef runs, so MCP telemetry is missing from the observable log set as well.

Three runs reported blocked egress in the firewall summary totals, but the raw request lines needed to debug those blocks were not available. One failure (Smoke CI) had no firewall activity and no tool telemetry, so it is N/A for both components.

Key Alerts and Anomalies

🔴 Critical Issues:

• 19 firewall-enabled runs are missing access.log.
• 19 tool-using runs are missing MCP telemetry (gateway.jsonl or rpc-messages.jsonl).
• Blocked firewall traffic was summarized for 28828345771, 28825337282, and 28823818796, but the raw Squid entries are absent.

⚠️ Warnings:

• Summary-level firewall metrics exist, but raw logs do not, which limits debugging to aggregate counts only.
• No per-server MCP metrics could be derived because the gateway/RPC logs were not materialized.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	19	0	0%	🔴
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	19	0	0%	🔴

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Runs	access.log	Requests	Allowed	Blocked	Status
Cache directory setup	28831134728	❌ missing	54	54	0	🔴
PR Sous Chef	28830940661, 28829827804, 28828486126, 28827245177, 28825705904, 28823534950, 28821195230, 28818440380	❌ missing	243	243	0	🔴
Daily Reliability Review	28829692742	❌ missing	87	87	0	🔴
Daily BYOK Ollama Test	28828345771	❌ missing	23	15	8	🔴
Daily AWF Spec Compiler Surfacing Review	28828078127	❌ missing	33	33	0	🔴
ESLint Monster	28827055688	❌ missing	10	10	0	🔴
Daily Regulatory Report Generator	28825337282	❌ missing	92	91	1	🔴
Daily Safe Output Tool Optimizer	28823818796	❌ missing	171	170	1	🔴
Contribution Check	28823796952	❌ missing	133	133	0	🔴
Daily Caveman Optimizer	28823577890	❌ missing	47	47	0	🔴
Q	28823530602	❌ missing	122	122	0	🔴
Copilot PR Prompt Pattern Analysis	28823491028	❌ missing	90	90	0	🔴
Smoke CI	28823291461	N/A	0	0	0	i️

Missing Firewall Logs (access.log)

All 19 firewall-enabled runs above are missing the raw Squid log directory, so there is no per-request line-level evidence for allowed vs blocked traffic.

Tool-Using Runs Inspected for MCP Telemetry

Workflow	Runs	Telemetry Source	Status
Cache directory setup	28831134728	none	🔴
PR Sous Chef	28830940661, 28829827804, 28828486126, 28827245177, 28825705904, 28823534950, 28821195230, 28818440380	none	🔴
Daily Reliability Review	28829692742	none	🔴
Daily BYOK Ollama Test	28828345771	none	🔴
Daily AWF Spec Compiler Surfacing Review	28828078127	none	🔴
ESLint Monster	28827055688	none	🔴
Daily Regulatory Report Generator	28825337282	none	🔴
Daily Safe Output Tool Optimizer	28823818796	none	🔴
Contribution Check	28823796952	none	🔴
Daily Caveman Optimizer	28823577890	none	🔴
Q	28823530602	none	🔴
Copilot PR Prompt Pattern Analysis	28823491028	none	🔴
Smoke CI	28823291461	N/A	i️

Missing MCP Telemetry (gateway.jsonl / rpc-messages.jsonl)

No raw MCP gateway or RPC log files were present in the downloaded tree, so the sampled tool-using runs cannot be debugged at the event level.

🔍 Telemetry Quality Analysis

• Firewall summary totals across the analyzed set: 1,105 requests, 1,095 allowed, 10 blocked.
• Runs with blocked requests: 28828345771 (8), 28823818796 (1), 28825337282 (1).
• Raw firewall entries were not available, so I could not validate Squid format, domain mix, or blocked-request context.
• MCP telemetry quality is effectively unassessable because neither gateway.jsonl nor rpc-messages.jsonl was present.

Recommended Actions

1. Preserve /access.log/ for every firewall-enabled run and fail the workflow if the directory is absent.
2. Emit gateway.jsonl or rpc-messages.jsonl for every tool-using run so MCP execution can be debugged after the fact.
3. Add a post-run check that compares summary-level firewall activity against raw log presence and flags any mismatch immediately.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 14.3 AIC · ⊞ 12.6K · ◷

• expires on Jul 7, 2026, 4:14 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #44135.