Fix the firewall/proxy allowlist for the Claude Code CLI engine now — every affected workflow crashes at startup with zero structured logs, and it will repeat every cycle until the egress path to Anthropic's API is restored.
Problem statement
Two Claude Code CLI workflows crashed at startup before producing a single structured log entry or any token_usage, both with the identical error:
ERR_CONFIG: Claude execution failed: no structured log entries were produced. Claude startup failed before structured logging (exitCode=unknown).
audit-diff confirms this is an egress blackout, not a workflow-config issue: comparing the failed run against the last known-good run of the same workflow, api.anthropic.com:443 dropped from 54 allowed connections to 0 attempted/blocked, and Claude's own telemetry hosts (o205451.ingest.us.sentry.io, otlp-gateway-prod-eu-west-2.grafana.net) vanished from the firewall log entirely. A new, previously-unseen (unknown) domain was blocked once in the failed run.
Affected workflows & runs
Both Claude Code CLI engine. Baseline (successful) comparison run: §32220853910 (2026-08-19, "Daily VulnHunter Scan", 33,824 tokens).
Probable root cause
A firewall/proxy allowlist regression, or a Claude Code CLI version bump that introduced a new required egress host, is blocking api.anthropic.com before the CLI can authenticate/start. The Sentry and Grafana telemetry hosts disappearing at the same time points to a shared egress-path change rather than an Anthropic-side outage (both would not vanish simultaneously in an Anthropic-only incident).
Proposed remediation
- Diff the firewall allowlist config effective between 2026-08-19 (last success) and 2026-08-21 (failures) — confirm
api.anthropic.com, the Sentry ingest host, and the Grafana OTLP host are still explicitly present.
- Identify the
(unknown) blocked domain captured in the failed run's firewall log and allowlist it if it is a legitimate new Claude CLI dependency.
- Re-run Daily VulnHunter Scan and Daily AgentRx Trace Optimizer manually after the fix to confirm recovery.
Success criteria / verification
- Both workflows complete with
token_usage > 0 and no ERR_CONFIG in the agent step logs.
- Firewall audit for a subsequent run shows
api.anthropic.com allowed calls at parity with the last known-good baseline (~54 calls).
- No further Claude Code CLI workflows exhibit the same "no structured log entries were produced" startup failure in the next 6h investigation cycle.
Parent report: #54461
Related to #54461
Generated by 🔍 [aw] Failure Investigator (6h) · agent · 160.9 AIC · ⌖ 12.8 AIC · ⊞ 5.9K · ◷
Recurrence — 2026-08-24 19:02 UTC
This issue has gone stale (no update since 2026-08-21), but the exact signature recurred today. audit on Avenger run §32757636440 (2026-08-24 17:36 UTC) returns:
ERR_CONFIG: Claude execution failed: no structured log entries were produced. Claude startup failed before structured logging (exitCode=unknown). startup/configuration failure detected.
A second Avenger run in the same window (§32751983205) failed the same step but was not separately audited. Re-opening attention on this — root cause from 3 days ago is apparently still unresolved.
Generated by 🔍 [aw] Failure Investigator (6h) · claude · agent · 161.3 AIC · ⌖ 8.19 AIC · ⊞ 6.4K · ◷
Fix the firewall/proxy allowlist for the Claude Code CLI engine now — every affected workflow crashes at startup with zero structured logs, and it will repeat every cycle until the egress path to Anthropic's API is restored.
Problem statement
Two Claude Code CLI workflows crashed at startup before producing a single structured log entry or any
token_usage, both with the identical error:audit-diffconfirms this is an egress blackout, not a workflow-config issue: comparing the failed run against the last known-good run of the same workflow,api.anthropic.com:443dropped from 54 allowed connections to 0 attempted/blocked, and Claude's own telemetry hosts (o205451.ingest.us.sentry.io,otlp-gateway-prod-eu-west-2.grafana.net) vanished from the firewall log entirely. A new, previously-unseen(unknown)domain was blocked once in the failed run.Affected workflows & runs
Both Claude Code CLI engine. Baseline (successful) comparison run: §32220853910 (2026-08-19, "Daily VulnHunter Scan", 33,824 tokens).
Probable root cause
A firewall/proxy allowlist regression, or a Claude Code CLI version bump that introduced a new required egress host, is blocking
api.anthropic.combefore the CLI can authenticate/start. The Sentry and Grafana telemetry hosts disappearing at the same time points to a shared egress-path change rather than an Anthropic-side outage (both would not vanish simultaneously in an Anthropic-only incident).Proposed remediation
api.anthropic.com, the Sentry ingest host, and the Grafana OTLP host are still explicitly present.(unknown)blocked domain captured in the failed run's firewall log and allowlist it if it is a legitimate new Claude CLI dependency.Success criteria / verification
token_usage > 0and noERR_CONFIGin the agent step logs.api.anthropic.comallowed calls at parity with the last known-good baseline (~54 calls).Parent report: #54461
Related to #54461
Recurrence — 2026-08-24 19:02 UTC
This issue has gone stale (no update since 2026-08-21), but the exact signature recurred today.
auditon Avenger run §32757636440 (2026-08-24 17:36 UTC) returns:A second Avenger run in the same window (§32751983205) failed the same step but was not separately audited. Re-opening attention on this — root cause from 3 days ago is apparently still unresolved.