[observability] Observability Coverage Report - 2026-07-13

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

This sample covered 2 workflow runs from the last 7 days. Observability is complete for the components that were enabled: the single firewall-enabled run has a populated Squid access.log, and both MCP-enabled runs have canonical RPC telemetry (rpc-messages.jsonl). No missing critical telemetry was found.

The only quality note is that the firewall log is mostly transaction-end-before-headers errors rather than explicit deny lines, so it is more useful for connection tracing than for proving blocked egress behavior.

Key Alerts and Anomalies

No critical issues detected.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	1	1	100%	✅
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	2	2	100%	✅

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked/Errors	Status
PR Sous Chef	29214279165	✅	122	56	66	✅

Missing Firewall Logs (access.log)

None.

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
PR Sous Chef	29214279165	rpc-messages.jsonl	12	safeoutputs	5	0	✅
Smoke CI	29206909973	rpc-messages.jsonl	6	github, safeoutputs	0	0	✅

Missing MCP Telemetry

None.

🔍 Telemetry Quality Analysis

• workflow_runs_analyzed: 2
• firewall_enabled_workflows: 1
• mcp_enabled_workflows: 2
• Firewall log quality: 122 entries, 3 external hosts, 56 allowed connects, 66 local error/abort records.
• MCP log quality: 18 RPC entries total across both sampled runs, valid JSONL, no parse errors.
• Healthy runs summary: both sampled runs have the telemetry needed for debugging their enabled components.

Recommended Actions

1. Keep attaching Squid access.log artifacts on every firewall-enabled run.
2. Preserve rpc-messages.jsonl fallback until gateway.jsonl coverage is universal.
3. If you want stronger negative-path evidence, add a run that exercises explicit blocked egress so deny traces are visible in the firewall log.

References:

• §29214279165
• §29206909973

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 2

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 14 AIC · ⊞ 12.5K · ◷

• expires on Jul 13, 2026, 4:10 PM UTC-08:00