[observability] Observability Coverage Report - 2026-07-30

[github-actions[bot]]

Executive Summary

Sampled 8 recent runs from the last 7 days. Firewall observability is the main gap: 5 firewall-enabled runs have no access.log, which makes egress debugging impossible on those runs. The 3 runs that do have Squid logs are readable, but they only show allowed traffic in this sample.

MCP telemetry is healthy for the 3 MCP-enabled runs we found. None emitted gateway.jsonl, but all 3 had the canonical fallback rpc-messages.jsonl with balanced request/response pairs and no parse issues.

Key Alerts and Anomalies

Critical issues:

• Missing access.log on 5 firewall-enabled runs: 30497974805, 30498708092, 30499600521, 30499690701, 30500558377.

Warnings:

• The 3 present firewall logs only show allowed traffic; no blocked requests were captured in this sample.
• No gateway.jsonl was discovered, but that is not critical here because rpc-messages.jsonl was present on every sampled MCP run.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	8	3	37.5%	Critical
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	3	3	100%	Healthy

Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
PR Sous Chef	30497974805	No	-	-	-	Critical
Daily Reliability Review	30498708092	No	-	-	-	Critical
Detection Analysis Report	30499600521	No	-	-	-	Critical
PR Sous Chef	30499690701	No	-	-	-	Critical
Cache directory setup	30500558377	No	-	-	-	Critical
Daily Documentation Healer	30501207420	Yes	168	168	0	Warning
PR Sous Chef	30501214572	Yes	90	90	0	Warning
AI Moderator	30501322362	Yes	38	38	0	Warning

Missing Firewall Logs (access.log)

Workflow	Run ID	Link
PR Sous Chef	30497974805	§30497974805
Daily Reliability Review	30498708092	§30498708092
Detection Analysis Report	30499600521	§30499600521
PR Sous Chef	30499690701	§30499690701
Cache directory setup	30500558377	§30500558377

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	30501207420	rpc-messages.jsonl	4	1	1	0	In progress
PR Sous Chef	30501214572	rpc-messages.jsonl	8	1	3	0	In progress
AI Moderator	30501322362	rpc-messages.jsonl	18	2	6	0	Queued

Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 296
• Blocked requests observed: 0
• Valid Squid CONNECT entries were present in all 3 logs
• Frequent egress domains: api.anthropic.com, api.githubcopilot.com, api.openai.com, github.com, chatgpt.com

MCP Gateway Log Quality

• Telemetry source used: rpc-messages.jsonl
• Total JSONL entries analyzed: 30
• Tool calls observed: 10
• MCP servers used: github, safeoutputs
• Error responses: 0
• Average response time: N/A for the fallback RPC log format

Healthy Runs Summary

• 30501207420: firewall log present, MCP telemetry present
• 30501214572: firewall log present, MCP telemetry present
• 30501322362: firewall log present, MCP telemetry present

Recommended Actions

1. Ensure every firewall-enabled workflow persists sandbox/firewall/logs/access.log.
2. Add a validation step that flags firewall-enabled runs when access.log is missing.
3. Keep rpc-messages.jsonl as the documented MCP fallback, and consider emitting gateway.jsonl consistently if structured latency metrics are needed.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 8

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 29 AIC · ⌖ 3.83 AIC · ⊞ 13.6K · ◷

• expires on Jul 30, 2026, 4:13 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #49232.