[observability] Observability Coverage Report - 2026-07-19

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I sampled 5 recent workflow runs from the last 7 days. Firewall observability is not usable in the current sample: every firewall-enabled run was missing the Squid access.log artifact, so we have 0% firewall log coverage and no way to inspect allowed vs. blocked egress.

MCP telemetry is better but still incomplete. Two runs have valid rpc-messages.jsonl fallback telemetry, while one MCP-enabled workflow has neither gateway.jsonl nor rpc-messages.jsonl, which is a critical gap. One of the telemetry-bearing runs also recorded a single RPC error response, but the log file itself is valid.

Key Alerts and Anomalies

🔴 Critical Issues:

• access.log missing from all 5 sampled firewall-enabled runs, including PR Sous Chef (#29660064261), Daily Project Performance Summary Generator (Using MCP Scripts) (#29660744841), Agentic Workflow Audit Agent (#29661572874), Daily Documentation Healer (#29666110853), and PR Sous Chef (#29666124378).
• Daily Project Performance Summary Generator (Using MCP Scripts) (#29660744841) has neither gateway.jsonl nor rpc-messages.jsonl, so its MCP execution is not observable.

⚠️ Warnings:

• PR Sous Chef (#29666124378) has complete MCP telemetry via rpc-messages.jsonl, but one RPC response in the file is an error response.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	5	0	0%	🔴
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	3	2	67%	⚠️

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
PR Sous Chef	29660064261	❌	0	0	0	🔴
Daily Project Performance Summary Generator (Using MCP Scripts)	29660744841	❌	0	0	0	🔴
Agentic Workflow Audit Agent	29661572874	❌	0	0	0	🔴
Daily Documentation Healer	29666110853	❌	0	0	0	🔴
PR Sous Chef	29666124378	❌	0	0	0	🔴

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
PR Sous Chef	29660064261	2026-07-18	§29660064261
Daily Project Performance Summary Generator (Using MCP Scripts)	29660744841	2026-07-18	§29660744841
Agentic Workflow Audit Agent	29661572874	2026-07-18	§29661572874
Daily Documentation Healer	29666110853	2026-07-18	§29666110853
PR Sous Chef	29666124378	2026-07-18	§29666124378

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	29666110853	rpc-messages.jsonl	4	1	1	0	✅
PR Sous Chef	29666124378	rpc-messages.jsonl	8	1	3	1	⚠️
Daily Project Performance Summary Generator (Using MCP Scripts)	29660744841	None	0	0	0	0	🔴

Missing MCP Telemetry (gateway.jsonl and rpc-messages.jsonl)

Workflow	Run ID	Date	Link
Daily Project Performance Summary Generator (Using MCP Scripts)	29660744841	2026-07-18	§29660744841

🔍 Telemetry Quality Analysis

• Firewall log quality: not assessable because access.log is missing in every firewall-enabled run.
• MCP telemetry quality: 12 total JSONL entries across the 2 telemetry-bearing runs, 4 outgoing tools/call requests, 1 error response, and 1 unique server (safeoutputs).
• Gateway format: gateway.jsonl was absent in the telemetry-bearing runs, so rpc-messages.jsonl served as the canonical fallback.
• Healthy runs summary: Daily Documentation Healer and PR Sous Chef both have usable MCP telemetry; firewall observability remains the blocking issue across the sample.

Recommended Actions

1. Make access.log an always-uploaded artifact for firewall-enabled runs, and fail the run or emit a visible warning when it is absent.
2. For MCP-script workflows, upload either gateway.jsonl or rpc-messages.jsonl on every run so telemetry is preserved even when the workflow exits early.
3. Add a lightweight post-run check that asserts firewall and MCP artifacts exist before the workflow is marked healthy.

References

• §29660744841
• §29666110853
• §29666124378

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 5

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 15.9 AIC · ⊞ 11.9K · ◷

• expires on Jul 19, 2026, 4:12 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #46689.