[observability] Observability Coverage Report - 2026-07-09

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

This week's 20-run sample is broadly healthy. 18 of 20 runs exercised the firewall path and every firewall-enabled run exposed an access.log trail. All 20 runs exercised MCP tooling, and every sampled run exposed rpc-messages.jsonl at runtime, which means MCP telemetry was present even when the preferred gateway log was absent.

The main gap is quality rather than coverage: two PR Sous Chef failures (28982973843, 28984051748) only produced zero-byte rpc-messages.jsonl, so the run is observable but not very useful for debugging tool-level behavior. The firewall log bundle is populated and readable, but this sample did not surface explicit denied-request lines.

Key Alerts and Anomalies

Note

No critical issues detected.

Warning

Zero-byte MCP telemetry was observed on §28982973843 and §28984051748; both runs should be treated as low-quality telemetry, not missing telemetry.

Warning

The Squid access log is present and populated, but the sampled slice is dominated by allowed CONNECT traffic and transaction-end errors rather than explicit denied requests.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	18	18	100%	✅
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	20	20	100%	⚠️

Detailed Run Analysis

Firewall-Enabled Runs

18 sampled firewall-enabled runs had access.log references in the workflow logs and the shared Squid log bundle contained 139 entries with valid Squid-style CONNECT records.

MCP-Enabled Runs

All 20 sampled runs had MCP telemetry present via rpc-messages.jsonl. 18 runs had non-empty telemetry; 2 runs were zero-byte warnings.

Workflow	Run ID	Telemetry	Status
PR Sous Chef	28982973843	rpc-messages.jsonl present, zero bytes	⚠️
PR Sous Chef	28984051748	rpc-messages.jsonl present, zero bytes	⚠️
Daily Reliability Review	28982212753	rpc-messages.jsonl present	✅
Daily BYOK Ollama Test	28980615181	rpc-messages.jsonl present	✅

Telemetry Quality

Firewall log sample: 139 lines, 56 CONNECT 200 entries, 85 transaction-end/error entries, 5 unique domains.
MCP telemetry source: canonical rpc-messages.jsonl fallback; no gateway.jsonl surfaced in this sample.

Recommended Actions

1. Keep the Squid access-log upload path under regression watch, because the firewall path is healthy but the sample is not rich in denied-request examples.
2. Add a guardrail for zero-byte rpc-messages.jsonl so MCP runs fail loudly when the gateway is active but telemetry is empty.
3. Prefer the structured gateway.jsonl format where available; when only the fallback exists, retain enough of the raw JSONL to support tool-call and latency analysis.

References:

• §28982212753
• §28980615181
• §28984051748

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 20.8 AIC · ⊞ 12.5K · ◷

• expires on Jul 9, 2026, 4:15 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-10T00:15:07.252Z.

Closed by Workflow