[observability] Observability Coverage Report - 2026-08-15

[github-actions[bot]]

Executive Summary

I analyzed 19 representative workflow runs from the last 7 days, drawn from a 30-run repository-wide log fetch and capped at 2 runs per workflow. One failed run (Design Decision Gate 🏗️ §31915362579) never progressed into turn-bearing agent execution, so it is treated as observability N/A rather than a missing-log failure.

Presence coverage is strong in the sampled runtime-bearing runs: firewall access.log was present in 18/18 firewall-enabled runs and MCP telemetry was present in 18/18 MCP-enabled runs. The main gaps are quality-related rather than presence-related: all sampled MCP telemetry came from the rpc-messages.jsonl fallback rather than gateway.jsonl, and every sampled RPC log was missing the expected type field from the audit rubric.

Firewall logging also needs stronger blocked-path visibility. access.log existed for every sampled firewall-enabled run, but the 18 sampled firewall logs showed 1,877 entries with zero TCP_DENIED events, so the logs demonstrate allowed traffic but do not confirm blocked-request observability in this capped sample. Common destinations were api.githubcopilot.com:443 (316), api.anthropic.com:443 (207), o205451.ingest.us.sentry.io:443 (158), otlp-gateway-prod-eu-west-2.grafana.net:443 (142), registry.npmjs.org:443 (111).

Key Alerts and Anomalies

No critical issues detected in the analyzed runtime-bearing sample.

Warning

Firewall log presence is healthy, but blocked-request visibility was absent in the 18 firewall-enabled runs included in this sample.

Warning

MCP telemetry presence is healthy, but all 18 MCP-enabled runs relied on rpc-messages.jsonl fallback logs, and every sampled RPC log omitted the expected type field.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	18	18	100.0%	Warning
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	18	18	100.0%	Warning

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Test Quality Sentinel	§31915364795	Present	29	29	0	Warning
PR Code Quality Reviewer	§31915363728	Present	68	68	0	Warning
Issue Monster	§31915350356	Present	25	25	0	Warning
Cache directory setup	§31915047515	Present	213	213	0	Warning
PR Sous Chef	§31914929251	Present	69	69	0	Warning
PR Sous Chef	§31914206398	Present	55	55	0	Warning
Agent Job Health Monitor	§31914141926	Present	152	152	0	Warning
Detection Analysis Report	§31914092917	Present	587	587	0	Warning
Issue Monster	§31914092630	Present	25	25	0	Warning
Test Quality Sentinel	§31914017991	Present	247	247	0	Warning
PR Code Quality Reviewer	§31914018006	Present	38	38	0	Warning
Design Decision Gate 🏗️	§31914018000	Present	29	29	0	Warning
Ponytail Reviewer	§31914017989	Present	34	34	0	Warning
Matt Pocock Skills Reviewer	§31914017997	Present	91	91	0	Warning
Impeccable Skills Reviewer	§31914017988	Present	41	41	0	Warning
Ponytail Reviewer	§31914006972	Present	56	56	0	Warning
Matt Pocock Skills Reviewer	§31914007011	Present	75	75	0	Warning
Impeccable Skills Reviewer	§31914007047	Present	43	43	0	Warning

Missing Firewall Logs (access.log)

None in the analyzed sample.

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Test Quality Sentinel	§31915364795	rpc-messages.jsonl	4	safeoutputs	1	0	Warning
PR Code Quality Reviewer	§31915363728	rpc-messages.jsonl	6	safeoutputs	2	0	Warning
Issue Monster	§31915350356	rpc-messages.jsonl	14	safeoutputs	6	0	Warning
Cache directory setup	§31915047515	rpc-messages.jsonl	8	github, safeoutputs	1	0	Warning
PR Sous Chef	§31914929251	rpc-messages.jsonl	8	safeoutputs	3	0	Warning
PR Sous Chef	§31914206398	rpc-messages.jsonl	14	safeoutputs	6	0	Warning
Agent Job Health Monitor	§31914141926	rpc-messages.jsonl	8	agenticworkflows, safeoutputs	2	0	Warning
Detection Analysis Report	§31914092917	rpc-messages.jsonl	48	agenticworkflows, github, safeoutputs	20	0	Warning
Issue Monster	§31914092630	rpc-messages.jsonl	14	safeoutputs	6	0	Warning
Test Quality Sentinel	§31914017991	rpc-messages.jsonl	10	safeoutputs	4	0	Warning
PR Code Quality Reviewer	§31914018006	rpc-messages.jsonl	4	safeoutputs	1	0	Warning
Design Decision Gate 🏗️	§31914018000	rpc-messages.jsonl	4	safeoutputs	1	0	Warning
Ponytail Reviewer	§31914017989	rpc-messages.jsonl	8	github, safeoutputs	1	0	Warning
Matt Pocock Skills Reviewer	§31914017997	rpc-messages.jsonl	14	safeoutputs	6	0	Warning
Impeccable Skills Reviewer	§31914017988	rpc-messages.jsonl	4	safeoutputs	1	0	Warning
Ponytail Reviewer	§31914006972	rpc-messages.jsonl	8	github, safeoutputs	1	0	Warning
Matt Pocock Skills Reviewer	§31914007011	rpc-messages.jsonl	4	safeoutputs	1	0	Warning
Impeccable Skills Reviewer	§31914007047	rpc-messages.jsonl	4	safeoutputs	1	0	Warning

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

None in the analyzed sample.

Runs Classified as N/A

Workflow	Run ID	Conclusion	Reason
Design Decision Gate 🏗️	§31915362579	failure	Run completed before turn-bearing agent execution, so firewall and MCP artifacts were not expected.

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 1877
• Domains accessed: 10 unique values (9 non-placeholder domains)
• Blocked requests: 0 (0.0%)
• Most accessed domains: api.githubcopilot.com:443 (316), api.anthropic.com:443 (207), o205451.ingest.us.sentry.io:443 (158), otlp-gateway-prod-eu-west-2.grafana.net:443 (142), registry.npmjs.org:443 (111)
• Format notes: sampled logs matched the AWF custom layout and commonly contained both TCP_TUNNEL:HIER_DIRECT and NONE_NONE:HIER_NONE error:transaction-end-before-headers decisions.

Gateway Log Quality

• Telemetry source mix: rpc-messages.jsonl (18)
• Total entries analyzed: 184
• MCP servers used: safeoutputs (18), github (4), agenticworkflows (2)
• Total tool calls: 64
• Error rate: 0/184 (0.0%)
• Average response time: N/A in the sampled fallback RPC logs; no gateway.jsonl files were present and the RPC records did not provide a directly pairable duration field for this audit.
• Field quality note: every sampled rpc-messages.jsonl file was valid JSONL, but each sample omitted the expected top-level type field from the audit rubric.

Healthy Runs Summary

• Presence coverage was complete for all 18 runtime-bearing runs in the sample: each had both access.log and MCP telemetry.
• Quality findings were consistent rather than isolated: fallback RPC telemetry was universal, and blocked-request evidence was absent throughout the capped sample.

Recommended Actions

1. Emit structured gateway.jsonl in addition to the raw fallback RPC log so response-time and status metrics are directly available without inference.
2. Normalize fallback rpc-messages.jsonl to include the expected top-level type field, or update the rubric and downstream parsers if event is now the canonical replacement.
3. Add a lightweight negative-egress smoke test or scheduled deny probe so routine samples include at least one blocked firewall event and confirm TCP_DENIED observability.

📊 Historical Trends

Historical trend data was not computed in this run. This report is a point-in-time audit over the last 7 days using a representative 19-run capped sample.

References: §31915362579, §31915364795, §31915363728

Analysis window: Last 7 days | Runs analyzed: 19

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• raw.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "raw.githubusercontent.com"

See Network Configuration for more information.

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 121.8 AIC · ⌖ 12.1 AIC · ⊞ 14K · ◷

• expires on Aug 16, 2026, 3:56 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #53243.