[observability] Observability Coverage Report - 2026-07-12

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I analyzed a capped, representative slice of 4 recent runs across 2 workflows: Copilot PR Prompt Pattern Analysis and Daily MCP Tool Concurrency Analysis. Runtime stdout shows both AWF firewall and MCP activity were enabled, but the downloaded run bundles did not include the expected telemetry artifacts needed for debugging.

That means the observability problem is not lack of runtime activity; it is missing export coverage. In this sample, firewall debugging is blocked by absent access.log exports, and MCP debugging is blocked by the absence of both gateway.jsonl and rpc-messages.jsonl.

Key Alerts and Anomalies

🔴 Critical Issues:

• Copilot PR Prompt Pattern Analysis run §29167857322 is firewall-enabled, but no access.log export was present.
• Copilot PR Prompt Pattern Analysis run §29050184752 is firewall-enabled, but no access.log export was present.
• Daily MCP Tool Concurrency Analysis run §29085644969 is firewall-enabled, but no access.log export was present.
• Daily MCP Tool Concurrency Analysis run §29010934239 is firewall-enabled, but no access.log export was present.
• Copilot PR Prompt Pattern Analysis run §29167857322 used MCP tools, but neither gateway.jsonl nor rpc-messages.jsonl was present.
• Copilot PR Prompt Pattern Analysis run §29050184752 used MCP tools, but neither gateway.jsonl nor rpc-messages.jsonl was present.
• Daily MCP Tool Concurrency Analysis run §29085644969 used MCP tools, but neither gateway.jsonl nor rpc-messages.jsonl was present.
• Daily MCP Tool Concurrency Analysis run §29010934239 used MCP tools, but neither gateway.jsonl nor rpc-messages.jsonl was present.

⚠️ Warnings:

• No non-critical warnings detected. The gaps above are critical because they remove the main debugging surfaces.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	4	0	0%	🔴
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	4	0	0%	🔴

📋 Detailed Run Analysis

Firewall-Enabled Runs

Workflow	Run ID	access.log	Entries	Allowed	Blocked	Status
Copilot PR Prompt Pattern Analysis	29167857322	❌	N/A	N/A	N/A	🔴
Copilot PR Prompt Pattern Analysis	29050184752	❌	N/A	N/A	N/A	🔴
Daily MCP Tool Concurrency Analysis	29085644969	❌	N/A	N/A	N/A	🔴
Daily MCP Tool Concurrency Analysis	29010934239	❌	N/A	N/A	N/A	🔴

Missing Firewall Logs (access.log)

Workflow	Run ID	Date	Link
Copilot PR Prompt Pattern Analysis	29167857322	2026-07-11	§29167857322
Copilot PR Prompt Pattern Analysis	29050184752	2026-07-09	§29050184752
Daily MCP Tool Concurrency Analysis	29085644969	2026-07-10	§29085644969
Daily MCP Tool Concurrency Analysis	29010934239	2026-07-09	§29010934239

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Copilot PR Prompt Pattern Analysis	29167857322	None	N/A	N/A	N/A	N/A	🔴
Copilot PR Prompt Pattern Analysis	29050184752	None	N/A	N/A	N/A	N/A	🔴
Daily MCP Tool Concurrency Analysis	29085644969	None	N/A	N/A	N/A	N/A	🔴
Daily MCP Tool Concurrency Analysis	29010934239	None	N/A	N/A	N/A	N/A	🔴

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

Workflow	Run ID	Date	Link
Copilot PR Prompt Pattern Analysis	29167857322	2026-07-11	§29167857322
Copilot PR Prompt Pattern Analysis	29050184752	2026-07-09	§29050184752
Daily MCP Tool Concurrency Analysis	29085644969	2026-07-10	§29085644969
Daily MCP Tool Concurrency Analysis	29010934239	2026-07-09	§29010934239

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 0
• Allowed requests: N/A
• Blocked requests: N/A
• Runtime firewall activity was visible in agent-stdio.log, but the exported Squid log bundle was missing.

Gateway Log Quality

• Telemetry source: none
• Total entries analyzed: 0
• MCP servers used: N/A
• Total tool calls: N/A
• Error rate: N/A
• Average response time: N/A
• Runtime MCP activity was visible in agent-stdio.log, but neither gateway.jsonl nor rpc-messages.jsonl was exported.

Healthy Runs Summary

• None in the analyzed slice.

Recommended Actions

1. Add a post-run validation step that fails when access.log is missing from a firewall-enabled run.
2. Ensure every MCP-enabled run exports either gateway.jsonl or rpc-messages.jsonl into the run bundle.
3. Treat agent-stdio.log as supplemental context only; promote the dedicated firewall and MCP artifacts to the canonical debugging source.

Historical Trends

• No meaningful trend to report from this capped sample because all analyzed runs are missing the critical telemetry artifacts.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 4

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 8.88 AIC · ⊞ 20.4K · ◷

• expires on Jul 12, 2026, 4:11 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #45142.