[observability] Observability Coverage Report - 2026-07-24

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I sampled two recent workflow runs from the last 7 days that already had both firewall and MCP telemetry artifacts on disk. Coverage is present in both areas, so there are no critical observability gaps in the sampled runs. The main issue is log quality: the firewall logs show only successful CONNECT tunnels plus proxy-side transaction-end-before-headers errors, and the MCP telemetry is present only as raw rpc-messages.jsonl with limited structure.

Overall health is good but not fully ideal. Both sampled runs are still in_progress, so this is a live snapshot rather than a completed-run audit. The telemetry is enough to debug most issues, but deny-path firewall evidence and richer MCP gateway metrics are missing.

Key Alerts and Anomalies

No critical issues detected.

🔴 Critical Issues:

• None in the sampled runs.

⚠️ Warnings:

• Firewall logs are present in both sampled runs, but neither run shows a blocked request; the logs only contain allowed CONNECT traffic and proxy-side transaction-end-before-headers errors.
• MCP telemetry is present via rpc-messages.jsonl in both sampled runs, but the entries are sparse and lack the richer structured fields expected from gateway.jsonl.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	2	2	100%	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	2	2	100%	⚠️

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily Documentation Healer	30054777546	✅	184	97	0	⚠️
PR Sous Chef	30054801027	✅	84	44	0	⚠️

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
None in sampled runs	-	-	-

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	30054777546	rpc-messages.jsonl	4	1	1	0	⚠️
PR Sous Chef	30054801027	rpc-messages.jsonl	4	1	1	0	⚠️

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
None in sampled runs	-	-	-

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 268
• Unique observed domains: 4
• Blocked requests observed: 0
• Most accessed domains: api.anthropic.com, api.githubcopilot.com, o205451.ingest.us.sentry.io, otlp-gateway-prod-eu-west-2.grafana.net

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl fallback
• Total entries analyzed: 8
• MCP servers used: safeoutputs
• Total tool calls: 2
• Error rate: 0%
• Average response time: N/A from fallback JSON-RPC logs

Healthy Runs Summary

• Both sampled runs have usable firewall and MCP telemetry.
• Both sampled runs are missing deny-path firewall evidence, which limits proxy-debugging confidence.
• Both sampled runs have fallback MCP telemetry, but not the preferred structured gateway log.

Recommended Actions

1. Add at least one sampled run with an actual blocked firewall request so deny-path logging can be verified end to end.
2. Prefer gateway.jsonl output for MCP runs where available; keep rpc-messages.jsonl as the fallback, but add schema fields needed for richer debugging.
3. Treat transaction-end-before-headers bursts in access.log as a quality signal to review, because they can mask incomplete proxy-side traces.

📊 Historical Trends

Not enough completed-run history was sampled here to establish a meaningful trend line.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 2

References:

• §30054777546
• §30054801027

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 2.42 AIC · ⊞ 15K · ◷

• expires on Jul 24, 2026, 4:10 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #47877.