[observability] Observability Coverage Report - 2026-03-26

[github-actions[bot]]

Executive Summary

Over the last 7 days, 62 workflow runs were analyzed from downloaded artifacts in /tmp/gh-aw/aw-mcp/logs.

AWF Firewall coverage is below target: 56/62 firewall-enabled runs had access.log present (90.32%), with 6 runs missing this critical artifact. MCP telemetry coverage is complete for MCP-enabled runs: 45/45 runs had telemetry via rpc-messages.jsonl fallback (100%). No MCP-enabled run was missing both gateway.jsonl and rpc-messages.jsonl.

Key Alerts and Anomalies

🔴 Critical Issues:

• Missing access.log in 6 firewall-enabled runs:
  • §23615244583 Copilot Agent Prompt Clustering Analysis
  • §23618437765 Go Logger Enhancement
  • §23623570309 Daily Observability Report for AWF Firewall and MCP Gateway
  • §23623574508 Daily Safe Output Tool Optimizer
  • §23623653571 Issue Monster
  • §23623734769 Workflow Normalizer

⚠️ Warnings:

• 45 runs had access.log present but did not show both allowed and blocked events.
• 7 MCP runs had telemetry files present but 0 recorded tool calls.
• gateway.jsonl was not observed; all MCP telemetry came from rpc-messages.jsonl.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	62	56	90.32%	🔴
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	45	45	100%	✅

📋 Detailed Run Analysis

Firewall-Enabled Runs

Metric	Value
Total firewall-enabled runs	62
Healthy (access.log present + allowed/blocked both visible)	11
Warning (access.log present but limited signal)	45
Critical (access.log missing)	6

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
Copilot Agent Prompt Clustering Analysis	§23615244583	2026-03-26	§23615244583
Daily Observability Report for AWF Firewall and MCP Gateway	§23623570309	2026-03-26	§23623570309
Daily Safe Output Tool Optimizer	§23623574508	2026-03-26	§23623574508
Go Logger Enhancement	§23618437765	2026-03-26	§23618437765
Issue Monster	§23623653571	2026-03-26	§23623653571
Workflow Normalizer	§23623734769	2026-03-26	§23623734769

MCP-Enabled Runs

Metric	Value
MCP-enabled runs	45
Telemetry present (gateway.jsonl or rpc-messages.jsonl)	45
Missing both telemetry files	0
Source gateway.jsonl	0
Source rpc-messages.jsonl	45
Warning (0 tool calls)	7

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
None	N/A	N/A	N/A

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 4,073
• Domains accessed: 15 unique
• Blocked requests: 59 (1.45%)
• Most accessed domains: github.com, api.githubcopilot.com, api.anthropic.com, api.openai.com, ab.chatgpt.com

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl (canonical fallback)
• Total MCP entries analyzed: 336
• Total MCP tool calls: 336
• MCP error count: 0
• Average response time: N/A (fallback-only telemetry lacks direct duration metrics in this dataset)

Healthy Runs Summary

• Runs with complete expected observability coverage: 56/62
• Incomplete runs: 6/62
• Additional telemetry artifacts:
  • aw_info.json: 62/62
  • agent-stdio.log: 56/62
  • safe_output*.jsonl: 57/62

Recommended Actions

1. Enforce a hard observability guardrail: fail or auto-mark runs where firewall_enabled=true and firewall-audit-logs/logs/access.log is missing.
2. Emit a per-run observability manifest with explicit booleans: access_log_present, gateway_jsonl_present, rpc_messages_present, and telemetry_parse_ok.
3. Add an MCP telemetry sanity rule for runs with rpc-messages.jsonl but 0 tool calls, to distinguish intentional idle runs from telemetry regressions.

📊 Historical Trends

This report is a single 7-day snapshot. Historical trend deltas were not computed in this run.

Context

• Workflow run: §23623570309
• Analysis window: last 7 days
• Runs analyzed: 62

References:

• §23623570309
• §23615244583
• §23623653571

AI generated by Daily Observability Report for AWF Firewall and MCP Gateway · history

• expires on Mar 27, 2026, 11:58 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #23287.