[observability] Observability Coverage Report - 2026-08-03

[github-actions[bot]]

Executive Summary

I sampled the 20 most recent downloaded runs from the last 7 days. Observability is present for the only run in the sample that exercised both AWF Firewall and the MCP Gateway: Daily Documentation Healer (§30773355265). Both telemetry channels were captured, so there are no critical missing-log gaps in the analyzed set.

The one quality concern is on the firewall side: access.log is populated and correctly formatted, but it contains only allowed egress and proxy error lines, with no TCP_DENIED entries. That means debugging the deny path would still be weak in this snapshot, even though log retention itself is healthy. MCP telemetry is available via the canonical fallback rpc-messages.jsonl and is structurally valid.

Key Alerts and Anomalies

No critical issues detected.

⚠️ Warnings:

• run-30773355265: firewall access.log has 195 lines, but 0 blocked (TCP_DENIED) requests; 109 lines are proxy transaction-end-before-headers errors.
• run-30773355265: MCP telemetry is present only as rpc-messages.jsonl fallback, not gateway.jsonl.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	1	1	100%	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	1	1	100%	✅

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily Documentation Healer	30773355265	✅	195	86	0	⚠️

Missing Firewall Logs (access.log)

None in the analyzed set.

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	30773355265	rpc-messages.jsonl	4	1	1	0	✅

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

None in the analyzed set.

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 195
• Domains accessed: 3 unique valid domains
• Blocked requests: 0 (0%)
• Allowed requests: 86
• Proxy error lines: 109
• Most accessed domains: api.anthropic.com:443, o205451.ingest.us.sentry.io:443, otlp-gateway-prod-eu-west-2.grafana.net:443

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl (canonical fallback)
• Total entries analyzed: 4
• MCP servers used: safeoutputs
• Total tool calls: 1
• Error rate: 0%
• Average response time: N/A (derived from fallback JSON-RPC messages)

Healthy Runs Summary

Only run-30773355265 had both firewall and MCP telemetry. The other 19 sampled runs had no firewall or MCP components and were N/A for these checks.

Recommended Actions

1. Keep access.log retention, but add a deny-path exercise or synthetic blocked request if blocked-traffic debugging is important.
2. Prefer gateway.jsonl when available; rpc-messages.jsonl is an acceptable fallback.
3. If transaction-end-before-headers noise is expected, document it so future audits do not treat it as a coverage gap.

References:

• §30773355265
• §30771862234
• §30771862187

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 16 AIC · ⌖ 14 AIC · ⊞ 13.8K · ◷

• expires on Aug 3, 2026, 4:09 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #50118.