[daily regulatory] Regulatory Report - 2026-07-11

[github-actions[bot]]

Today's analysis reviewed 17 daily report discussions published since 2026-07-10 21:30Z. Overall data quality is good — most reports are internally consistent and clearly scoped. Two critical infrastructure issues stand out: (1) the Observability report confirms 0% telemetry coverage for firewall and MCP runs, and (2) the Safe Output Health report identifies a production safe_outputs job failure in the Daily Firewall workflow due to a create_discussion handler not being wired in the safe-outputs config. Additionally, a new engine (opencode) debuted at 0/3 success rate.

Cross-report metrics are broadly consistent where scopes align. The Copilot agent PR success rate shows a meaningful one-day dip (64% vs prior ~75%) which is confirmed by both the Copilot Agent Analysis and Prompt Analysis reports.

📋 Full Regulatory Report

📊 Reports Reviewed

Report	Discussion	Created	Status
[prompt-analysis] Copilot PR Prompt Analysis	#45010	2026-07-11T21:01Z	✅ Valid
[lockfile-stats] Lockfile Statistics Analysis	#45009	2026-07-11T20:33Z	✅ Valid
[daily-team-evolution] Team Evolution Insights	#45008	2026-07-11T20:32Z	✅ Valid
[daily-code-metrics] Daily Code Metrics	#45003	2026-07-11T18:55Z	✅ Valid
[Auto-Triage] Auto-Triage Report	#45002	2026-07-11T18:51Z	✅ Valid
[copilot-agent-analysis] Daily Copilot Agent Analysis	#45000	2026-07-11T18:34Z	⚠️ Issues
[daily secrets] Secret Usage Analysis	#44999	2026-07-11T18:00Z	✅ Valid
[detection-analysis] Detection Analysis	#44958	2026-07-11T13:16Z	✅ Valid
[api-consumption] GitHub API Consumption	#44940	2026-07-11T11:29Z	✅ Valid
[copilot-session-insights] Session Analysis	#44913	2026-07-11T07:56Z	⚠️ Issues
[safe-output-health] Safe Output Health	#44869	2026-07-11T05:25Z	⚠️ Issues
[daily-compiler-quality] Compiler Code Quality	#44858	2026-07-11T03:42Z	✅ Valid
[Auto-Triage] Auto-triage Summary	#44853	2026-07-11T01:03Z	✅ Valid
[daily-sentrux] Daily Sentrux	#44851	2026-07-11T00:18Z	✅ Valid
[observability] Observability Coverage	#44849	2026-07-11T00:12Z	❌ Failed
[audit-workflows] Agentic Workflow Audit (07-10 partial)	#44841	2026-07-10T21:50Z	⚠️ Issues

🔍 Data Consistency Analysis

Cross-Report Metrics Comparison

Metric	API Consumption	Copilot Agent	Detection Analysis	Audit Workflows	Status
Workflow runs (24h window)	184	103 (detection)	103	104 (partial)	⚠️ Note
Success rate (overall)	89.1%	88.0% (regular)	88.0% (regular)	81.7% (incl. smoke)	✅ Consistent
Production success	—	—	92.9% (detection-enabled)	92.9%	✅ Match
Copilot agent PR success	64% (agent analysis)	64%	—	—	✅ Consistent

Scope note: Run count differences (184 vs 103-104) are expected — API Consumption covers a longer window (07-10 15:52 → 07-11 10:52) vs Detection/Audit which cover exactly 24h windows ending at different times.

Consistency Score

• Overall Consistency: 88% (7 of 8 cross-report metric pairs match)
• Critical Discrepancies: 0
• Scope-driven differences: 2 (run counts — expected, documented)
• Minor Discrepancies: 1 (success rate in Audit appears low at 81.7% but is due to smoke tests; production rate of 92.9% matches across reports)

⚠️ Issues and Anomalies

Critical Issues

1. Observability Telemetry Completely Absent

   • Affected Reports: [observability] Observability Coverage Report
   • Metric: firewall_coverage, mcp_coverage
   • Description: 0% coverage for both AWF Firewall (access.log) and MCP Gateway (gateway.jsonl) across all 19 firewall-enabled and 3 MCP-enabled sampled runs
   • Expected: Log files should be present for observability audit
   • Actual: 0 of 22 runs had any telemetry logs
   • Severity: Critical
   • Recommended Action: Investigate log collection/upload path for firewall and MCP runs; confirm logs are being written and uploaded as workflow artifacts

2. Daily Firewall Report: create_discussion Not Wired

   • Affected Reports: [safe-output-health] Safe Output Health Report
   • Description: The Daily Firewall Logs Collector workflow's safe-outputs allowlist only permits upload_asset, missing_tool, missing_data, noop — but the workflow prompt instructs the agent to call create_discussion. The mismatch causes a hard safe_outputs job failure.
   • Run: §29137608538
   • Severity: High — daily firewall report is not being produced
   • Recommended Action: Add create_discussion to the Daily Firewall workflow's safe-outputs config, or update the prompt to use an available safe-output type

3. OpenCode Engine Debut: 0/3 Success Rate

   • Affected Reports: [audit-workflows] Workflow Audit
   • Description: New opencode engine appeared in the fleet for the first time with 0% success (0/3 runs)
   • Severity: Medium — new engine, expected teething issues
   • Recommended Action: Monitor stabilization; treat as known onboarding regression

Warnings

1. Copilot Session Transcripts Unavailable — 44th Consecutive Day

   • Details: OAuth token error prevents conversation transcript download; behavioral analysis is impossible
   • Impact: Session insights report is limited to metadata only; no loop detection or context analysis possible

2. Copilot Agent PR Success Rate Dip

   • Details: Today's 24h PR success rate dropped to 64% from prior 3-day band of ~75-76%
   • Impact: ~15% relative decline; 13 closed-without-merge PRs (WIP/placeholder bodies, batch doc-normalization closures)
   • Note: 9 PRs still open; final rate may improve

3. audit-workflows Report Coverage Capped at ~38%

   • Details: logs bridge 120s timeout means only 104 of ~275 run dirs had complete summaries
   • Impact: Audit coverage is consistently incomplete; recurring chronic limitation

4. Firewall Blocked api.sentrux.dev

   • Details: Daily Sentrux workflow blocked by firewall — domain not in allowlist
   • Recommended Action: Add api.sentrux.dev to network.allowed in the sentrux workflow

5. Observability Report: Threat Detection Flagged

   • Details: The observability report carries a CAUTION: agentic threat detected banner (though the detection engine itself failed to produce results)
   • Impact: Requires manual review before automation follow-up

Data Quality Notes

• The API Consumption report explicitly notes it is an incremental collection and the pre-15:52 tail of 07-10 was not re-fetched — cross-day comparisons should account for this
• The copilot-session-insights report covers only a 15.8-minute burst window (not 24h), making it a snapshot rather than a full-day picture
• Code quality score dip in daily-code-metrics (67.7/100) is a churn artifact per the report — heavy 7-day refactor burst, not structural decay

📈 Trend Analysis

Week-over-Week Comparison

Metric	Today (07-11)	Yesterday (07-10)	Change
Production success rate	92.9%	92.9% (est.)	➡️ Stable
Copilot agent PR merged %	64% (24h)	75%	⬇️ −15% rel.
30-day PR success rate	79.1%	79.9%	⬇️ −0.8pp
Code quality score	67.7/100	~74/100 (est.)	⬇️ Churn artifact
Codebase LOC	1,870,920	~1,837k	⬆️ +1.8%
Sentrux score	5,217	5,216	➡️ Stable
Complex functions	1,007	~988	⬆️ Degrading

Notable Trends

• Slow Sentrux quality drift: −17 points over 30 days driven purely by complex function accumulation (+205 complex fns since late April). No structural regressions but steady slow degradation.
• PR success rate declining: 30-day rate dropped from 81.8% (07-03) to 79.1% (07-11), a −2.7pp slide over 8 days — worth monitoring.
• Safe-output observability gap: 3 JOB-layer safe_outputs failures in last ~3 weeks all had unreadable error details — root-causing production failures is guesswork.

📝 Per-Report Analysis

[observability] Observability Coverage Report

Source: #44849 · Created: 2026-07-11T00:12Z
Quality: ❌ Failed — threat detection banner, zero telemetry found

Metric	Value	Validation
Firewall runs analyzed	19	✅
Firewall log coverage	0%	❌ Critical
MCP runs analyzed	3	✅
MCP log coverage	0%	❌ Critical

Notes: This is a critical infrastructure regression. The report notes run folders only contain aw_info.json, summary.json, run_summary.json — no access.log or MCP gateway logs.

[safe-output-health] Safe Output Health Report

Source: #44869 · Created: 2026-07-11T05:25Z
Quality: ⚠️ Issues — 1 production failure identified

Metric	Value	Validation
Runs analyzed	15	✅
safe_outputs job success rate	93.3% (14/15)	⚠️ 1 failure
Messages actuated	0 (read-only window)	✅
Error clusters	1 new (production)	⚠️

[audit-workflows] Agentic Workflow Audit (07-10 partial)

Source: #44841 · Created: 2026-07-10T21:50Z
Quality: ⚠️ Issues — partial coverage (37.8% of runs), new engine failures

Metric	Value	Validation
Runs analyzed	104 / ~275 (37.8%)	⚠️ Partial
Overall success	81.7%	✅ (smoke-adjusted: 92.9%)
Agent-logic failures	0	✅
Tokens consumed	7.25M	✅
opencode success	0/3 = 0%	⚠️ New engine

[copilot-agent-analysis] Daily Copilot Agent Analysis

Source: #45000 · Created: 2026-07-11T18:34Z
Quality: ⚠️ Issues — success rate dip

Metric	Value	Validation
Total PRs (24h)	45	✅
Merged PRs	23 (64%)	⚠️ Below 7d avg ~75%
Closed PRs	13	✅
Open PRs	9	✅
Avg duration	~160 min	✅

[api-consumption] GitHub API Consumption

Source: #44940 · Quality: ✅ Valid

Metric	Value	Validation
Total runs	184	✅
Success rate	89.1%	✅
API calls	96,930	✅ (above 90d mean 61.6k)
Safe-output writes	288	✅

[daily-code-metrics] Daily Code Metrics

Source: #45003 · Quality: ✅ Valid

Metric	Value	Validation
Total LOC	1,870,920	✅
Quality score	67.7/100	⚠️ Churn artifact (normal)
Test-to-source ratio	1.96×	✅ Strong
Large files (>500 LOC)	935	⚠️ Code org gap

[daily-sentrux] Daily Sentrux

Source: #44851 · Quality: ✅ Valid

Metric	Value	Validation
Overall score	5,217/10,000	⚠️ Slow decline
Complex functions	1,007	⚠️ Degrading (+19 vs 7d ago)
Architecture violations	0	✅

[detection-analysis] Detection Analysis

Source: #44958 · Quality: ✅ Valid

Metric	Value	Validation
Total runs analyzed	103	✅
Detection-enabled	28 (27.2%)	✅
Detection success rate	92.9%	✅ Above regular 88%
Misconfigured workflows	4	⚠️ Action needed

💡 Recommendations

Process Improvements

1. Wire create_discussion in Daily Firewall workflow: The safe-outputs config is missing the create_discussion handler that the prompt expects. This is a compile-time mismatch that has silently broken the daily firewall report.
2. Restore Firewall and MCP telemetry collection: 0% log coverage is a complete collection regression. Investigate whether the access.log and gateway JSONL upload steps are working and whether the observability workflow is fetching from the right artifact paths.
3. Fix Copilot Session OAuth token: The 44-day transcript blackout means session behavioral analysis is purely metadata-driven. Restore the OAuth token to re-enable full session analysis.

Data Quality Actions

1. Add api.sentrux.dev to Sentrux workflow allowlist: The domain is being blocked by the firewall, preventing the Sentrux scan from completing normally.
2. Emit token_usage.jsonl for codex/opencode engines: Empty token files are causing hard smoke test failures; wire real usage or downgrade the assertion to a warning for engines that can't report per-turn tokens.
3. Improve safe_outputs step log surfacing: Three JOB-layer failures in recent weeks had unreadable error details. Bundle the step stdout with workflow artifacts to enable root-cause analysis.

Workflow Suggestions

1. Extend logs bridge timeout or paginate: The 120s cap means audit coverage is capped at ~38% of runs. Consider count-limited or before_run_id paginated fetches to guarantee complete coverage.
2. Monitor opencode engine onboarding: Expected teething; set a 1-week window before treating 0/3 as a regression requiring escalation.
3. Track complex-function accumulation: 1,007 complex functions (+205 since April) represents a slow quality drain. Set a threshold gate to catch regressions before they compound.

📊 Regulatory Metrics

Metric	Value
Reports Reviewed	16
Reports Passed	10
Reports with Issues	4
Reports Failed	1 (observability)
Critical Issues	2
High Severity Issues	1
Overall Health Score	69%

---

Report generated automatically by the Daily Regulatory workflow
Data sources: Daily report discussions from github/gh-aw
Run: §29168852071

References:

• §29168852071
• #44869 (Safe Output Health)
• #44849 (Observability Coverage)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by ⚖️ Daily Regulatory Report Generator · 58.1 AIC · ⌖ 6.61 AIC · ⊞ 8.2K · ◷

• expires on Jul 14, 2026, 1:36 PM UTC-08:00

[github-actions[bot]]

This report has been superseded by a newer daily regulatory report.

[github-actions[bot]]

This report has been superseded by a newer daily regulatory report.