[observability] Observability Coverage Report - 2026-07-01

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

Analyzed a capped set of 20 recent runs from the last 7 days. Firewall observability is the problem: 18 firewall-enabled runs had firewall summaries, but none exposed the expected access.log artifact, so request-level debugging is not available. MCP telemetry is healthy: both MCP-enabled runs exposed rpc-messages.jsonl, which is an acceptable fallback when gateway.jsonl is absent.

Caution

Critical issue: all 18 firewall-enabled runs in the sample are missing access.log.

Note

No MCP-critical gaps detected. rpc-messages.jsonl was present and valid in both MCP-enabled runs.

Key Alerts and Anomalies

• Firewall summaries show traffic filtering is active, but the per-request Squid log is missing from every firewall-enabled run in this sample.
• MCP telemetry is present via fallback logging; the absence of gateway.jsonl is not a critical gap because rpc-messages.jsonl exists.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	18	0	0%	CRITICAL
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	2	2	100%	HEALTHY

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Summary Requests	Allowed	Blocked	Status
PR Sous Chef	28481000592	❌	85	85	0	CRITICAL
Daily Reliability Review	28481991416	❌	80	80	0	CRITICAL
PR Sous Chef	28482295674	❌	113	113	0	CRITICAL
PR Sous Chef	28483351422	❌	63	63	0	CRITICAL
Cache directory setup	28483385751	❌	67	67	0	CRITICAL
Daily BYOK Ollama Test	28480733135	❌	46	14	32	CRITICAL
PR Sous Chef	28479618990	❌	87	87	0	CRITICAL
Design Decision Gate 🏗️	28479541902	❌	17	17	0	CRITICAL
PR Code Quality Reviewer	28479541896	❌	185	184	1	CRITICAL
Test Quality Sentinel	28479541900	❌	92	88	4	CRITICAL
Issue Monster	28480316527	❌	21	21	0	CRITICAL
Impeccable Skills Reviewer	28479541917	❌	66	66	0	CRITICAL
Matt Pocock Skills Reviewer	28479542060	❌	89	89	0	CRITICAL
Release	28480588106	❌	63	59	4	CRITICAL
Smoke Copilot - AOAI (Entra)	28479529527	❌	72	72	0	CRITICAL
Daily AWF Spec Compiler Surfacing Review	28480446490	❌	29	29	0	CRITICAL
Smoke Copilot - AOAI (apikey)	28479528414	❌	51	51	0	CRITICAL
Smoke Antigravity	28479498355	❌	5	0	5	CRITICAL
Smoke Gemini	28479498352	❌	63	44	19	CRITICAL

Missing Firewall Logs (access.log)

All 18 firewall-enabled runs above are missing access.log; there are no additional firewall runs in the capped sample with request-level Squid logs attached.

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Avenger	28480960974	rpc-messages.jsonl	31	safeoutputs	1	0	HEALTHY
Release	28480588106	rpc-messages.jsonl	8	github, safeoutputs	1	0	HEALTHY

Missing MCP Telemetry

None. Both MCP-enabled runs had usable structured telemetry, and neither is a critical gap.

🔍 Telemetry Quality Analysis

Firewall Log Quality

• awf-config.json was present on the firewall-enabled runs and showed isolation-enabled firewall settings.
• Total access.log entries analyzed: 0
• Firewall summaries still show blocked traffic, including localhost:8080, awmg-mcpg:8080, and mixed allowed/blocked domain activity.
• Debugging network issues remains impaired because request-level Squid lines are missing.

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl fallback.
• Total entries analyzed: 39
• MCP servers used: github, safeoutputs
• Total tool calls: 2
• Error rate: 0%
• Request/response RTTs were low, roughly 6-69ms in the sampled logs.

Healthy Runs Summary

• Avenger and Release both had usable MCP telemetry and no protocol errors.
• The firewall gap is isolated to log extraction, not to the presence of firewall activity itself.

Recommended Actions

1. Restore firewall artifact capture so every firewall-enabled run emits access.log in the expected extracted path.
2. Keep accepting rpc-messages.jsonl as the canonical MCP fallback, but prefer gateway.jsonl when it is available.
3. Add a hard observability check for firewall-enabled runs so missing access.log is surfaced immediately.

References:

• §28480588106
• §28480960974
• §28479498352

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 15 AIC · ⊞ 12.6K · ◷

• expires on Jul 1, 2026, 4:13 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #42850.