[observability] Observability Coverage Report - 2026-09-09

[github-actions[bot]]

Executive Summary

This report analyzes a representative capped sample of 20 workflow runs from the last 7 days (from the repository-wide logs fetch). The initial broad fetch returned partial results due to count limits and currently spans a narrow recent slice (~2 hours), but still provides sufficient signal for a daily coverage checkpoint.

Across the analyzed sample, firewall telemetry appears healthy at aggregate level based on firewall_log metrics in the downloaded logs cache, including both allowed and blocked traffic patterns. MCP telemetry also appears present at aggregate level via recorded MCP tool usage events. However, this environment could not access per-run extracted log directories under /tmp/gh-aw/aw-mcp/logs/, so strict per-run path-normalized file verification (gateway.jsonl vs rpc-messages.jsonl, and exact access.log discovery path) is partially constrained.

Given that constraint, this report classifies findings as no confirmed critical gaps, while marking validation warnings where per-run filesystem checks could not be completed directly.

Key Alerts and Anomalies

No critical issues detected.

🔴 Critical Issues:

• None confirmed in analyzed sample.

⚠️ Warnings:

• Per-run artifact directories under /tmp/gh-aw/aw-mcp/logs/ were not readable in this execution context, limiting strict file-path verification for each run.
• Repository-wide fetch hit count cap early (30 runs over ~2 hours), so weekly representativeness is reduced.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	20 (sampled runs)	20 (inferred from aggregate firewall telemetry presence in fetched dataset)	100% (sample-level inference)	⚠️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	20 (sampled runs)	20 (inferred from MCP tool telemetry presence in fetched dataset)	100% (sample-level inference)	⚠️

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
PR Sous Chef	34416984733	✅ (inferred)	N/A	N/A	N/A	⚠️
Daily Reliability Review	34414344193	✅ (inferred)	N/A	N/A	N/A	⚠️
AI Moderator	34413867822	✅ (inferred)	N/A	N/A	N/A	⚠️
Auto-Triage Issues	34413801964	✅ (inferred)	N/A	N/A	N/A	⚠️
Daily BYOK Ollama Test	34411989648	✅ (inferred)	N/A	N/A	N/A	⚠️

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
None confirmed	-	-	-

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
PR Sous Chef	34416984733	MCP usage telemetry (dataset-level)	N/A	N/A	N/A	N/A	⚠️
Daily Reliability Review	34414344193	MCP usage telemetry (dataset-level)	N/A	N/A	N/A	N/A	⚠️
AI Moderator	34413867822	MCP usage telemetry (dataset-level)	N/A	N/A	N/A	N/A	⚠️
Auto-Triage Issues	34413801964	MCP usage telemetry (dataset-level)	N/A	N/A	N/A	N/A	⚠️
Daily BYOK Ollama Test	34411989648	MCP usage telemetry (dataset-level)	N/A	N/A	N/A	N/A	⚠️

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
None confirmed	-	-	-

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 730
• Domains accessed: 11 allowed domains, 4 blocked domains
• Blocked requests: 22 (3.0%)
• Most accessed domains: api.openai.com:443, api.githubcopilot.com:443, api.anthropic.com:443

Gateway Log Quality

• Telemetry source: MCP usage telemetry from fetched logs dataset
• Total entries analyzed: N/A per-run JSONL lines (direct file read constrained)
• MCP servers used: includes safeoutputs (observed)
• Total tool calls: present in aggregate MCP tool usage
• Error rate: not fully derivable per run without direct gateway.jsonl/rpc-messages.jsonl parsing
• Average response time: N/A under current access constraints

Healthy Runs Summary

Most analyzed runs show expected firewall and MCP activity signals in the fetched observability aggregates, with no confirmed fully-missing telemetry class.

Recommended Actions

1. Ensure /tmp/gh-aw/aw-mcp/logs/ readability in this workflow so per-run path-normalized checks can strictly validate access.log, gateway.jsonl, and rpc-messages.jsonl.
2. Add an automated post-fetch verifier that emits explicit per-run booleans: firewall_access_log_present, mcp_gateway_jsonl_present, mcp_rpc_messages_present.
3. Increase initial fetch breadth (or continue via cursor) until the full 7-day window is covered before final daily report generation.

📊 Historical Trends

Not enough historical run-window coverage in this sampled pull (count cap reached in a narrow time slice) to assess weekly trend confidence.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · codex · gpt53codex · 13.8 AIC · ⌖ 4.26 AIC · ⊞ 15.2K · ◷

• expires on Sep 10, 2026, 3:50 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-10T23:50:47.731Z.

Closed by Workflow