[observability] Observability Coverage Report - 2026-09-25

[github-actions[bot]]

Executive Summary

This daily observability audit analyzed 20 representative workflow runs from the last 7 days (capped per policy, with breadth-first selection and failure/cancel prioritization). The sampled runs included a mix of successful and failed executions across multiple workflows, but none of the selected runs included AWF Firewall artifacts (access.log) or MCP gateway telemetry artifacts (gateway.jsonl or rpc-messages.jsonl).

Because no firewall-enabled or MCP-enabled runs were present in the analyzed sample, component-level coverage metrics are currently not assessable for this window. This is a sampling gap rather than a confirmed runtime regression in logging pipelines.

Overall health for observability in this sample is indeterminate for AWF Firewall and MCP Gateway coverage due to absence of eligible runs. No critical missing-log defects were detected within runs that actually declared those components.

Key Alerts and Anomalies

No critical issues detected.

🔴 Critical Issues:

• None in sampled eligible runs (no firewall-enabled or MCP-enabled runs found in analyzed set).

⚠️ Warnings:

• Representative sample contains zero firewall-enabled runs, so access.log coverage cannot be computed.
• Representative sample contains zero MCP-enabled runs, so gateway/rpc telemetry coverage cannot be computed.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	0 (firewall_enabled_workflows)	0 (runs_with_complete_logs)	N/A (observability_coverage_percentage)	i️
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	0 (mcp_enabled_workflows)	0 (runs_with_complete_logs)	N/A (observability_coverage_percentage)	i️

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
None in analyzed sample	-	-	-	-	-	i️

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
None	-	-	-

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
None in analyzed sample	-	-	-	-	-	-	i️

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
None	-	-	-

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 0
• Domains accessed: 0 unique
• Blocked requests: 0 (N/A)
• Most accessed domains: N/A

Gateway Log Quality

• Telemetry source: N/A (no MCP-enabled runs in sample)
• Total entries analyzed: 0
• MCP servers used: N/A
• Total tool calls: 0
• Error rate: N/A
• Average response time: N/A

Healthy Runs Summary

No runs in this sample exercised firewall or MCP telemetry paths, so observability health for those subsystems could not be confirmed from this slice.

Recommended Actions

1. Add one targeted daily canary workflow that always enables firewall and MCP to guarantee baseline observability coverage in each 24h report.
2. Persist a small derived “component-used” index in run metadata (e.g., from aw_info.json) to make representative sampling deterministic for firewall/MCP classes.
3. Keep this report’s capped analysis model, but automatically backfill up to 5 targeted fetches only when either component class is absent from the initial broad sample.

📊 Historical Trends

Historical trend data was not computed in this run because the sampled set contained no firewall/MCP-enabled executions. Recommend tracking rolling 7-day coverage for each component once canary coverage is in place.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 20

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · codex · gpt53codex · 17.4 AIC · ⌖ 3.8 AIC · ⊞ 16K · ◷

• expires on Sep 26, 2026, 3:49 PM UTC-08:00