[observability] Observability Coverage Report - 2026-07-21

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I analyzed a capped sample of 20 runs from the last 7 days. Firewall coverage exists for the one firewall-enabled run, but it is low-signal for troubleshooting because no blocked requests were observed. MCP observability is the main gap: 18 of 20 sampled runs have neither gateway.jsonl nor rpc-messages.jsonl.

Two runs had usable MCP telemetry. Both used the canonical rpc-messages.jsonl fallback rather than gateway.jsonl, and both were parseable. Overall observability health is weak because most MCP-enabled runs are missing telemetry entirely.

Key Alerts and Anomalies

🔴 Critical Issues:

• 18 MCP-enabled runs are missing both gateway.jsonl and rpc-messages.jsonl.
• 1 failed run (§29784505320) is also missing MCP telemetry.

⚠️ Warnings:

• Firewall logging is present for the sampled firewall run, but no blocked requests were observed.
• No sampled healthy run exposed gateway.jsonl; telemetry was only available through rpc-messages.jsonl.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	1	1	100%	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	20	2	10%	🔴

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily Documentation Healer	29788848183	✅	200	200	0	⚠️

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	29788848183	rpc-messages.jsonl	4	1	1	0	✅
AI Moderator	29772765860	rpc-messages.jsonl	8	2	1	0	✅

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
Daily BYOK Ollama Test	29784505320	2026-07-20	§29784505320
Cache directory setup	29788135097	2026-07-20	§29788135097
PR Sous Chef	29788028039	2026-07-20	§29788028039
Detection Analysis Report	29787284664	2026-07-20	§29787284664
PR Sous Chef	29786560439	2026-07-20	§29786560439
Daily Reliability Review	29786439729	2026-07-20	§29786439729
PR Sous Chef	29784755317	2026-07-20	§29784755317
Daily AWF Spec Compiler Surfacing Review	29784156438	2026-07-20	§29784156438
PR Sous Chef	29783168867	2026-07-20	§29783168867
ESLint Monster	29783110420	2026-07-20	§29783110420
Duplicate Code Detector	29782860996	2026-07-20	§29782860996
PR Sous Chef	29781538011	2026-07-20	§29781538011
Matt Pocock Skills Reviewer	29781295364	2026-07-20	§29781295364
Daily Regulatory Report Generator	29780720929	2026-07-20	§29780720929
Agentic Workflow Audit Agent	29780629585	2026-07-20	§29780629585
Issue Monster	29780546016	2026-07-20	§29780546016
PR Sous Chef	29779739194	2026-07-20	§29779739194
PR Code Quality Reviewer	29779466140	2026-07-20	§29779466140

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 200
• Domains accessed: 3 unique
• Blocked requests: 0 (0%)
• Most accessed domains: api.anthropic.com:443, o205451.ingest.us.sentry.io:443, otlp-gateway-prod-eu-west-2.grafana.net:443
• Blocked requests visible: no

Gateway Log Quality

rpc-messages.jsonl was the telemetry source in both healthy runs.

• Total entries analyzed: 12
• MCP servers used: safeoutputs, github
• Total tool calls: 2
• Error rate: 0%
• Average response time: N/A for rpc-messages.jsonl without duration pairing

Healthy Runs Summary

• Daily Documentation Healer (29788848183) - firewall log present, MCP telemetry present
• AI Moderator (29772765860) - MCP telemetry present via fallback

Recommended Actions

1. Make MCP telemetry persistence mandatory for every MCP-enabled workflow run; 18 of 20 sampled runs are currently missing both gateway log formats.
2. Prefer gateway.jsonl where possible, and treat rpc-messages.jsonl as fallback-only telemetry.
3. Add a firewall test path that produces at least one blocked request so Squid logs can validate deny-path debugging as well as allow-path behavior.

📊 Historical Trends

No week-over-week baseline was computed from this capped sample.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

References: §29788848183, §29772765860, §29784505320

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 7.21 AIC · ⊞ 11.9K · ◷

• expires on Jul 21, 2026, 4:15 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #47162.