[observability] Observability Coverage Report - 2026-10-04

[github-actions[bot]]

Executive Summary

This daily observability audit analyzes 20 recent workflow runs from the past 7 days (capped sample), prioritized toward failed/cancelled runs. The initial repository-wide log fetch returned partial results due to count limits, but it provided a representative high-signal slice for current coverage assessment.

AWF Firewall telemetry appears broadly healthy in the analyzed set based on firewall artifact summaries, with request activity and block events observed at aggregate level. MCP Gateway observability also appears broadly healthy at aggregate level, with MCP tool usage captured across multiple servers. However, direct per-run file-path validation for access.log, gateway.jsonl, and rpc-messages.jsonl was blocked by a runtime permissions boundary on the extracted log directory path.

Given that boundary, this report classifies run-level path-presence checks as warnings (inconclusive) rather than critical missing telemetry. Immediate follow-up should restore run-directory readability for deterministic per-run file presence checks.

Key Alerts and Anomalies

⚠️ Warnings:

• Run-level recursive file validation could not be completed for run-<id> directories due to Permission denied when traversing /tmp/gh-aw/aw-mcp/logs.
• The broad 7-day fetch hit count: 30 early, covering a narrow recent time slice; additional continuation fetches are needed for full-week confidence.

🔴 Critical Issues:

• No confirmed critical missing telemetry runs in this sample. (Critical classification is deferred where per-run file checks are blocked by environment limitations.)

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	20 (sampled)	20 inferred from firewall aggregate signals	100% inferred*	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	20 (sampled)	20 inferred from MCP usage signals	100% inferred*	⚠️

*Coverage is inferred from aggregated telemetry in the fetched dataset, not confirmed via per-run recursive file-path checks.

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Issue Monster	37244700907	⚠️ Inconclusive	N/A	N/A	N/A	⚠️
Detection Analysis Report	37243317863	⚠️ Inconclusive	N/A	N/A	N/A	⚠️
Daily AWF Spec Compiler Surfacing Review	37239735264	⚠️ Inconclusive	N/A	N/A	N/A	⚠️
(other analyzed runs)	(17 runs)	⚠️ Inconclusive	N/A	N/A	N/A	⚠️

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
None confirmed	—	—	—

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Issue Monster	37244700907	Aggregate MCP usage present (path check inconclusive)	N/A	N/A	N/A	N/A	⚠️
PR Sous Chef	37243873721	Aggregate MCP usage present (path check inconclusive)	N/A	N/A	N/A	N/A	⚠️
[aw] Failure Investigator (6h)	37240508596	Aggregate MCP usage present (path check inconclusive)	N/A	N/A	N/A	N/A	⚠️
(other analyzed runs)	(17 runs)	Aggregate MCP usage present (path check inconclusive)	N/A	N/A	N/A	N/A	⚠️

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
None confirmed	—	—	—

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total firewall requests observed (aggregate): 2162
• Allowed requests: 2158
• Blocked requests: 4 (0.18%)
• Most accessed domains include api.githubcopilot.com:443, o205451.ingest.us.sentry.io:443, and otlp-gateway-prod-eu-west-2.grafana.net:443

Gateway Log Quality

• Telemetry source for this audit: MCP aggregate usage summaries from fetched logs dataset
• Servers observed: github, safeoutputs, agenticworkflows
• Total MCP tool calls observed (aggregate): 498
• Error/status quality: no per-entry JSONL validation possible under current path-permission boundary
• Response time metrics: not available in aggregate summary output

Healthy Runs Summary

• All analyzed runs show observability signal at aggregate level for network and MCP activity.
• No confirmed run in the analyzed sample is proven to lack both MCP telemetry files.
• Per-run file-level assertions remain pending until run-directory readability is restored.

Recommended Actions

1. Fix runtime permissions for /tmp/gh-aw/aw-mcp/logs/run-* so recursive per-run checks can validate exact access.log, gateway.jsonl, and rpc-messages.jsonl paths.
2. Add a deterministic post-download manifest from the logs tool (per run: firewall enabled, MCP enabled, discovered telemetry file paths) to remove dependence on local directory traversal permissions.
3. Continue using a capped sample, but automatically chain one continuation fetch when the initial call reports a narrow time slice versus the requested 7-day window.

📊 Historical Trends

• Current sample is concentrated in a narrow recent window due to initial count cap.
• Aggregate signals suggest stable observability instrumentation, but full-week trend confidence requires continuation fetches.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · codex · gpt53codex · 15.1 AIC · ⌖ 4.07 AIC · ⊞ 15.4K · ◷

• expires on Oct 5, 2026, 3:51 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-05T23:51:19.431Z.

Closed by Workflow