[observability] Observability Coverage Report - 2026-07-28

[github-actions[bot]]

Executive Summary

I sampled 8 recent runs from the last 7 days and found very weak observability coverage on both surfaces. Only 1 firewall-enabled run had an access.log, and only 1 MCP-enabled run had telemetry (rpc-messages.jsonl). Overall, only 1 of 8 sampled runs had complete coverage across both components.

The one fully instrumented run was Daily Documentation Healer (30315885182). It had a populated Squid access log and canonical MCP fallback telemetry, but the access log shows only successful CONNECT traffic plus local transaction-end-before-headers errors, so the firewall signal is present but not richly diagnostic.

Key Alerts and Anomalies

Critical Issues:

• Firewall-enabled runs missing access.log: Daily BYOK Ollama Test (30311449929), Cache directory setup (30315273854), Detection Analysis Report (30314325509), Daily Reliability Review (30313481941), Agentic Workflow Audit Agent (30307242647).
• MCP-enabled runs missing both gateway.jsonl and rpc-messages.jsonl: Cache directory setup (30315273854), PR Sous Chef (30315085882), Detection Analysis Report (30314325509), PR Sous Chef (30313626370), Daily Reliability Review (30313481941).

Warnings:

• Daily Documentation Healer has a valid access.log, but it contains no explicit blocked-request lines. It is usable for debugging, but not ideal for firewall forensics.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	6	1	16.7%	🔴
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	6	1	16.7%	🔴

Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily Documentation Healer	30315885182	✅	303	303	0	⚠️
Daily BYOK Ollama Test	30311449929	❌	0	0	0	🔴
Cache directory setup	30315273854	❌	0	0	0	🔴
Detection Analysis Report	30314325509	❌	0	0	0	🔴
Daily Reliability Review	30313481941	❌	0	0	0	🔴
Agentic Workflow Audit Agent	30307242647	❌	0	0	0	🔴

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
Daily BYOK Ollama Test	30311449929	2026-07-27	30311449929
Cache directory setup	30315273854	2026-07-27	30315273854
Detection Analysis Report	30314325509	2026-07-27	30314325509
Daily Reliability Review	30313481941	2026-07-27	30313481941
Agentic Workflow Audit Agent	30307242647	2026-07-27	30307242647

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	30315885182	rpc-messages.jsonl	4	1	1	0	✅
Cache directory setup	30315273854	None	0	0	0	0	🔴
PR Sous Chef	30315085882	None	0	0	0	0	🔴
Detection Analysis Report	30314325509	None	0	0	0	0	🔴
PR Sous Chef	30313626370	None	0	0	0	0	🔴
Daily Reliability Review	30313481941	None	0	0	0	0	🔴

Missing MCP Telemetry

Workflow	Run ID	Date	Link
Cache directory setup	30315273854	2026-07-27	30315273854
PR Sous Chef	30315085882	2026-07-27	30315085882
Detection Analysis Report	30314325509	2026-07-27	30314325509
PR Sous Chef	30313626370	2026-07-27	30313626370
Daily Reliability Review	30313481941	2026-07-27	30313481941

Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 303
• External domain traffic is concentrated on api.anthropic.com
• Explicit blocked requests: 0
• Local firewall/proxy errors observed: 148 transaction-end-before-headers entries

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl (canonical fallback)
• Total entries analyzed: 4
• MCP servers observed: safeoutputs
• Tool calls: 1
• Error rate: 0%
• Average response time: N/A from rpc-messages.jsonl

Healthy Runs Summary

• Daily Documentation Healer (30315885182) is the only sampled run with both firewall and MCP telemetry present.

Recommended Actions

1. Make access.log a hard post-run artifact requirement for every firewall-enabled workflow.
2. Emit gateway.jsonl or rpc-messages.jsonl for every MCP-enabled workflow and fail fast when both are absent.
3. Add a teardown assertion that verifies canonical artifact paths before the job exits.

References:

• 30315885182
• 30315273854
• 30315085882

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 8

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 26.8 AIC · ⌖ 2.96 AIC · ⊞ 12.8K · ◷

• expires on Jul 28, 2026, 4:11 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #48747.