[observability] Observability Coverage Report - 2026-08-02

[github-actions[bot]]

Executive Summary

I reviewed a capped sample of 20 workflow runs from the last 7 days. Coverage is complete for the one firewall-enabled run and the one MCP-enabled run in the sample, so there are no critical missing-log gaps.

The main issue is log quality, not absence: the firewall run has a usable access.log, but it only shows allowed traffic and proxy noise, with no blocked sample to validate denial-path observability. The MCP run has valid telemetry via the canonical fallback rpc-messages.jsonl and shows healthy JSON-RPC traffic.

Key Alerts and Anomalies

No critical issues detected.

🔴 Critical Issues:

• None.

⚠️ Warnings:

• run-30724324732 (Daily Documentation Healer) has firewall telemetry, but access.log contains 179 lines with 90 allowed tunnels, 0 blocked requests, and 89 NONE_NONE:HIER_NONE noise entries. That is usable, but it does not exercise the blocked-request path.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	1	1	100%	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	1	1	100%	✅

📋 Detailed Run Analysis

Sample Run Status

Run ID	Workflow	Conclusion	Firewall	MCP	Observability
30724324732	Daily Documentation Healer	queued	present	present	⚠️
30723895755	Cache directory setup	success	N/A	N/A	N/A
30723862451	Avenger	success	N/A	N/A	N/A
30723841495	PR Sous Chef	success	N/A	N/A	N/A
30723335437	Detection Analysis Report	success	N/A	N/A	N/A
30723313556	Issue Monster	success	N/A	N/A	N/A
30722880612	PR Sous Chef	success	N/A	N/A	N/A
30722461036	PR Code Quality Reviewer	failure	N/A	N/A	N/A
30722461032	Impeccable Skills Reviewer	success	N/A	N/A	N/A
30722461017	Matt Pocock Skills Reviewer	success	N/A	N/A	N/A
30722461010	Test Quality Sentinel	success	N/A	N/A	N/A
30722461009	Design Decision Gate 🏗️	success	N/A	N/A	N/A
30722259653	Issue Monster	success	N/A	N/A	N/A
30721949988	Impeccable Skills Reviewer	success	N/A	N/A	N/A
30721949976	Test Quality Sentinel	success	N/A	N/A	N/A
30721949961	PR Code Quality Reviewer	success	N/A	N/A	N/A
30721949957	Design Decision Gate 🏗️	success	N/A	N/A	N/A
30721949915	Matt Pocock Skills Reviewer	success	N/A	N/A	N/A
30721793240	Avenger	success	N/A	N/A	N/A
30721766175	PR Sous Chef	success	N/A	N/A	N/A

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Daily Documentation Healer	30724324732	✅	179	90	0	⚠️

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
None in sampled runs	-	-	-

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Daily Documentation Healer	30724324732	rpc-messages.jsonl	4	1	1	0	✅

Missing MCP Telemetry

Workflow	Run ID	Date	Link
None in sampled runs	-	-	-

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Discovered path: /tmp/gh-aw/aw-mcp/logs/run-30724324732/sandbox/firewall/logs/access.log
• Total access.log lines analyzed: 179
• Valid tunnel requests: 90
• Blocked requests: 0
• Noise / non-request lines: 89
• Most accessed domains: api.anthropic.com:443, o205451.ingest.us.sentry.io:443, otlp-gateway-prod-eu-west-2.grafana.net:443

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl fallback
• Discovered path: /tmp/gh-aw/aw-mcp/logs/run-30724324732/mcp-logs/rpc-messages.jsonl
• Total JSON-RPC entries analyzed: 4
• MCP servers used: safeoutputs
• Tool calls observed: 1
• Error rate: 0%
• Average response time: N/A for rpc-messages.jsonl

Healthy Runs Summary

• Daily Documentation Healer had the only firewall-enabled and MCP-enabled run in the sample, and both telemetry sources were present.
• The firewall log is the only coverage concern, because it lacks any blocked-request example.

Recommended Actions

1. Keep access.log collection enabled for every firewall-backed run, and ensure at least one blocked request is generated in test coverage so denial-path debugging is observable.
2. Prefer gateway.jsonl for MCP telemetry when available, but keep rpc-messages.jsonl as a valid fallback and ensure it remains written on every MCP-enabled run.
3. Add a lightweight quality check for firewall runs that flags logs containing only allowed traffic, so the blocked-path gap is visible before incidents.

📊 Historical Trends

No multi-day trend comparison was derived from this sample.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · gpt54 · 11.6 AIC · ⌖ 11.8 AIC · ⊞ 13.7K · ◷

• expires on Aug 2, 2026, 4:08 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #49870.