[observability] Observability Coverage Report - 2026-07-22

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

Recent sampled runs do not expose the telemetry blocks needed for debugging firewall and MCP issues. The dedicated firewall test run failed, and the MCP-heavy successful runs did not surface usable firewall or gateway telemetry in their cached summaries. Debugging coverage is therefore incomplete.

Key Alerts and Anomalies

CRITICAL:

• Firewall Test Agent run 29259440955 failed, and the audit summary did not surface access_analysis or firewall_analysis.
• Copilot Agent PR Analysis run 29858113306, Smoke Copilot run 29812420778, and MCP Inspector Agent run 29276873376 did not surface MCP telemetry blocks in their cached summaries, so no gateway or rpc-message evidence was available for root-cause work.

WARNING:

• The successful runs completed normally, but the cached summaries omitted the detailed telemetry sections needed for deep investigation.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	2	0	0%	CRITICAL
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	3	0	0%	CRITICAL

Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Firewall Test Agent	29259440955	No	0	0	0	CRITICAL
Copilot Agent PR Analysis	29858113306	No	0	0	0	CRITICAL

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Copilot Agent PR Analysis	29858113306	None	0	0	0	0	CRITICAL
Smoke Copilot	29812420778	None	0	0	0	0	CRITICAL
MCP Inspector Agent	29276873376	None	0	0	0	0	CRITICAL

Telemetry Quality Analysis

• Total access.log entries analyzed: 0
• Domains accessed: 0 unique
• Blocked requests: 0
• Telemetry source: none surfaced in cached summaries
• Total gateway entries analyzed: 0
• MCP servers used: 0
• Total tool calls: 0
• Error rate: N/A

Recommended Actions

1. Make firewall-enabled workflows persist access.log into the downloadable audit artifacts and fail the run when it is absent.
2. Make MCP-enabled workflows retain either mcp-logs/gateway.jsonl or mcp-logs/rpc-messages.jsonl in the audit cache.
3. Add a validation gate that blocks completion when telemetry is missing from a configured firewall or MCP run.

References

• §29259440955
• §29858113306
• §29812420778

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 4

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 49.8 AIC · ⊞ 15.6K · ◷

• expires on Jul 22, 2026, 4:15 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #47432.