[observability] Observability Coverage Report - 2026-07-08

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I analyzed 19 recent workflow runs from the last 7 days, staying within the requested cap. The sample shows a clear split: MCP telemetry is intact for all 3 MCP-enabled runs, but raw AWF Firewall Squid logs are missing from every firewall-enabled run I found. That makes firewall debugging materially weaker than it should be, even though the summarized firewall counters are still being produced.

The MCP side is in good shape by the repo's fallback rule: rpc-messages.jsonl is present for each MCP-enabled run, so none of those runs should be treated as a telemetry-critical miss. The firewall side is the opposite: 0 of 19 firewall-enabled runs exposed a raw access.log, so the source of truth for egress debugging is absent across the whole sampled window.

Key Alerts and Anomalies

Caution

Critical issue: 19/19 firewall-enabled runs are missing raw Squid access.log files. The sample still shows firewall activity in summary.json (for example, blocked requests to awmg-mcpg:8080), but the raw log needed for request-level debugging is not present.

Note

No critical MCP telemetry gaps were found. All 3 MCP-enabled runs had mcp-logs/rpc-messages.jsonl, which is the approved canonical fallback when gateway.jsonl is absent.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	19	0	0.0%	CRITICAL
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	3	3	100.0%	HEALTHY

📋 Detailed Run Analysis

Firewall-Enabled Runs

All sampled firewall-enabled runs had firewall activity in summary.json, but none exposed a raw access.log directory or file set.

Workflow	Run ID	access.log	Allowed	Blocked	Status
AI Moderator	28899537556	❌	27	1	CRITICAL
AI Moderator	28903229640	❌	33	1	CRITICAL
AI Moderator	28905695044	❌	18	1	CRITICAL

Missing Firewall Logs (access.log)

Workflow	Run ID	Link
AI Moderator	28899537556	§28899537556
AI Moderator	28903229640	§28903229640
AI Moderator	28905695044	§28905695044

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
AI Moderator	28899537556	rpc-messages.jsonl	10	2	2	0	HEALTHY
AI Moderator	28903229640	rpc-messages.jsonl	6	2	0	0	HEALTHY
AI Moderator	28905695044	rpc-messages.jsonl	8	2	1	0	HEALTHY

Missing MCP Telemetry

None. Every MCP-enabled run in the sample had rpc-messages.jsonl present.

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Raw Squid access.log entries analyzed: 0
• Firewall summary lines available: yes, via summary.json
• Sampled firewall request volume: 1059 total requests across 19 runs
• Blocked requests in the sampled summaries: 13 total
• Main gap: request-level firewall diagnostics are unavailable because the raw log artifact is absent

Gateway Log Quality

• Telemetry source used: rpc-messages.jsonl fallback
• Total JSON-RPC entries analyzed: 24
• MCP servers observed: github, safeoutputs
• Total tool-call requests: 3
• Error rate: 0%
• Average response time: N/A for the fallback format without response pairing

Healthy Runs Summary

The 3 MCP-enabled AI Moderator runs are observability-healthy on the MCP side. None of the sampled runs are firewall-healthy because the raw Squid log artifact is missing everywhere.

Recommended Actions

1. Make access.log a required artifact for every firewall-enabled run and fail the workflow step if the directory is missing.
2. Keep rpc-messages.jsonl as the MCP fallback, but add a guard that alerts if both gateway.jsonl and rpc-messages.jsonl are absent.
3. Add a small post-run assertion that surfaces raw firewall log presence in the summary, so this gap is visible before the report stage.

References:

• §28899537556
• §28903229640
• §28905695044

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 18.3 AIC · ⊞ 12.5K · ◷

• expires on Jul 8, 2026, 4:11 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-09T00:11:31.128Z.

Closed by Workflow