[plan] Enhance rate limiting infrastructure for DoS prevention #5541

Objective

Expand rate limiting coverage from the current 5 patterns to 20+ patterns to protect high-traffic endpoints and MCP server requests from resource exhaustion and DoS attacks.

Context

The codebase has 525 timeout patterns for DoS prevention but only 5 rate limiting patterns. Need to add configurable rate limiting with proper error handling, backoff strategies, and telemetry for GitHub API calls, MCP server requests, and workflow compilation operations.

Approach

1. Create pkg/ratelimit/ratelimit.go:

   • Token bucket algorithm implementation
   • Configurable rate limits per operation type
   • Context-aware rate limiting
   • Telemetry hooks for monitoring
   • Exponential backoff on rate limit errors

2. Add rate limiting to GitHub API calls:

   • Wrap GitHub API client with rate limiter
   • Respect GitHub API rate limit headers
   • Implement exponential backoff on 429 responses
   • Add rate limit status to logger output

3. Add rate limiting to MCP server requests:

   • Per-server rate limit configuration
   • Separate limits for different MCP operations
   • Add rate limit configuration to MCP schema

4. Create pkg/ratelimit/ratelimit_test.go:

   • Test token bucket behavior
   • Test concurrent request handling
   • Test rate limit exhaustion scenarios
   • Test backoff and retry logic

5. Add frontmatter configuration in schemas:

   rate-limits:
     github-api: 100/hour
     mcp-requests: 50/minute

6. Update documentation: Add rate limiting examples and best practices to relevant docs

Files to Create/Modify

• Create: pkg/ratelimit/ratelimit.go
• Create: pkg/ratelimit/ratelimit_test.go
• Modify: pkg/workflow/*.go (add rate limiting to GitHub API and MCP requests)
• Modify: pkg/parser/schemas/*.json (add rate-limits configuration)
• Modify: docs/ (document rate limiting configuration)

Acceptance Criteria

• pkg/ratelimit package created with token bucket implementation
• Rate limiting added to GitHub API client wrapper
• Rate limiting added to MCP server request handling
• Exponential backoff implemented for rate limit errors
• Rate limit configuration added to frontmatter schema
• Telemetry and logging for rate limit events
• Comprehensive tests for rate limiting behavior
• Documentation updated with rate limiting examples
• Error messages clear and actionable when rate limits exceeded
• 20+ rate limiting patterns implemented across critical paths

Priority

Medium - Important for production stability under high traffic but less urgent than supply chain security
Related to #5537

AI generated by Plan Command for discussion #5535