rtmx-ai/ops

Operational resilience tooling for the rtmx-ai Enterprise organization, iotactical organization, and rhino11 account on GitHub.

Motivation

On 2026-03-28, GitHub's automated abuse detection flagged the rhino11 account without notice, causing:

• Account hidden from public view (/users/rhino11 returned 404)
• GitHub Actions disabled across the entire rtmx-ai organization
• GPG signing key disruption on rtmx-ai/rtmx
• Workflow run history purged
• No email, banner, or moderation notice delivered

Root cause: CPU-intensive Rust cross-compilation in aegis-cli (11-crate workspace with LTO and single codegen-unit, targeting musl and MSVC) resembled cryptocurrency mining to GitHub's automated heuristics.

The account was restored on 2026-04-03 after appeal (GitHub Support ticket #4214638). This repository contains the tooling, playbooks, and governance artifacts built to detect, prevent, and recover from future incidents.

Structure

ops/
├── scripts/
│ ├── phase-0/ # Immediate triage (cancel stuck runs, verify restoration)
│ │ ├── triage.sh
│ │ └── verify-restoration.sh
│ ├── phase-1/ # Account health monitoring
│ │ └── gh-health-check.sh
│ ├── phase-2/ # Workflow hardening references
│ │ ├── ci-hardened.yml
│ │ └── cargo-ci-profile.toml
│ ├── phase-5/ # Enterprise governance audit
│ │ └── governance-audit.sh
│ └── phase-6/ # Cross-org dashboard
│ └── gh-org-dashboard.sh
├── templates/ # Org-level CLAUDE.md boilerplate
│ ├── rtmx-ai-claude.md
│ ├── iotactical-claude.md
│ └── rhino11-claude.md
├── docs/
│ ├── playbooks/ # Incident response and prevention
│ │ ├── enforcement-response.md
│ │ └── abuse-prevention.md
│ └── requirements/ # Requirement specifications
├── .rtmx/
│ └── database.csv # Requirements traceability matrix
├── CLAUDE.md
└── README.md

Phases

Phase	Name	Priority	Description
0	Immediate Triage	Critical	Cancel stuck runs, verify restoration, upgrade token scopes
1	Health Monitoring	High	Account-level monitoring with cron-scheduled health checks
2	Workflow Hardening	High	Reduce CI CPU footprint to avoid abuse detection triggers
3	Org CLAUDE.md	Medium	Standardized agent guidance across all orgs
4	Playbooks	Medium	Incident response and abuse prevention documentation
5	Enterprise Governance	Medium	Actions policies, trusted action allowlists, usage monitoring
6	Cross-Org Dashboard	Low	Multi-org health matrix and burn-rate tracking

Usage

Phase 0: Immediate Triage

./scripts/phase-0/triage.sh
./scripts/phase-0/verify-restoration.sh

Phase 1: Health Monitoring

# Check account health
./scripts/phase-1/gh-health-check.sh status
# Check Actions across all orgs
./scripts/phase-1/gh-health-check.sh actions
# Check GPG key health
./scripts/phase-1/gh-health-check.sh gpg
# View Actions minutes usage
./scripts/phase-1/gh-health-check.sh usage
# Generate full health report
./scripts/phase-1/gh-health-check.sh report

Phase 5: Governance Audit

./scripts/phase-5/governance-audit.sh audit
./scripts/phase-5/governance-audit.sh configure

Phase 6: Cross-Org Dashboard

./scripts/phase-6/gh-org-dashboard.sh dashboard
./scripts/phase-6/gh-org-dashboard.sh minutes
./scripts/phase-6/gh-org-dashboard.sh stale

Requirements

• GitHub CLI (gh) authenticated with admin:org, read:org, repo scopes
• jq for JSON processing
• Bash 4+

License

Apache-2.0