rtmx-ai / rtmx / 23607163627

79%

push

github

feat(security): Configurable verify thresholds + CI file guard (REQ-SEC-010, REQ-SEC-011)

REQ-SEC-011: Verify throughput thresholds
- verify.thresholds.warn (default: 5) and verify.thresholds.fail
  (default: 15) configurable in rtmx.yaml
- Changes within warn: commit silently
- Changes between warn and fail: commit with WARNING
- Changes exceeding fail: exit 1, no write (use --force to override)
- Enables future organizational policy enforcement via rtmx-sync

REQ-SEC-010: CI pipeline file guard
- Auto-commit now validates git diff --name-only before committing
- Refuses to commit if any file other than .rtmx/database.csv changed
- Prevents self-modification attacks via compromised verify binary

5 behavioral tests for thresholds (within/warn/fail/custom/defaults).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

22 of 34 new or added lines in 2 files covered. (64.71%)

7081 of 8810 relevant lines covered (80.37%)

26.77 hits per line