[observability] Observability Coverage Report - 2026-07-23

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I reviewed a capped sample of 4 workflow runs from the last 7 days. Firewall observability is incomplete: 2 of 4 sampled runs have access.log available, while 2 runs show firewall activity in run metadata but no Squid access log in the bundle. MCP telemetry is better but still incomplete: 3 of 4 sampled runs include rpc-messages.jsonl, and 1 run has tool execution recorded but no MCP log artifact at all.

The healthy runs do have usable telemetry. Where present, access.log contains both successful (200) and error/zero-status rows, and the MCP logs are valid JSONL with paired request/response events. The main gap is artifact capture, not execution itself.

Key Alerts and Anomalies

🔴 Critical Issues:

• §29964778078 (AI Moderator) has firewall activity in run_summary.json but no access.log.
• §29966465233 (PR Code Quality Reviewer) has firewall activity in run_summary.json but no access.log.
• §29966465233 (PR Code Quality Reviewer) has tool execution recorded in run metadata, but neither gateway.jsonl nor rpc-messages.jsonl was present.

⚠️ Warnings:

• No parse-quality warnings in the sampled access.log or rpc-messages.jsonl files that were present.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	4	2	50%	🔴
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	4	3	75%	🔴

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
AI Moderator	29964778078	❌	-	-	-	🔴
PR Code Quality Reviewer	29966465233	❌	-	-	-	🔴
Daily Documentation Healer	29967738526	✅	251	125	126	✅
PR Sous Chef	29967751634	✅	39	22	17	✅

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
AI Moderator	29964778078	2026-07-22	§29964778078
PR Code Quality Reviewer	29966465233	2026-07-22	§29966465233

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
AI Moderator	29964778078	rpc-messages.jsonl	6	2	0	0	✅
PR Code Quality Reviewer	29966465233	❌ None	-	-	-	-	🔴
Daily Documentation Healer	29967738526	rpc-messages.jsonl	4	1	1	0	✅
PR Sous Chef	29967751634	rpc-messages.jsonl	6	1	2	0	✅

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
PR Code Quality Reviewer	29966465233	2026-07-22	§29966465233

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 290
• Successful rows (200): 147
• Zero/error rows (0): 143
• Both allowed and blocked-like outcomes are visible in the sampled logs.

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl
• Total entries analyzed: 16
• MCP servers used: github, safeoutputs
• Total outgoing tools/call requests: 3
• Error rate: 0%
• Average response time: N/A (derived from JSON-RPC message pairing)

Healthy Runs Summary

• Daily Documentation Healer and PR Sous Chef have complete firewall and MCP telemetry in the sampled logs.

Recommended Actions

1. Copy sandbox/firewall/logs/access.log into every firewall-enabled run bundle before artifact upload.
2. Require gateway.jsonl or rpc-messages.jsonl for every MCP-enabled run and fail the telemetry step if neither file exists.
3. Add a post-run validation step that checks for both artifact types before the workflow is marked complete.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 4

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 8.86 AIC · ⊞ 12.1K · ◷

• expires on Jul 23, 2026, 4:10 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #47674.