fix(go-policy): use RLock for rule scan and check threshold before incrementing

[Imran Siddique (imran-siddique)]

Applies finnoybu patterns #2019 and #2021:

• Evaluate() held an exclusive lock for the entire rule scan, serializing all concurrent callers. Fix: RLock for the read-only scan, write lock only in checkRateLimit().
• checkRateLimit incremented count then compared, so once over the limit the counter grew unboundedly. Fix: check >= MaxCalls before incrementing.

Supersedes conflicted PRs #2019 and #2021.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

Docs Sync

• Documentation is in sync.

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

API Compatibility

Severity	Change	Impact
High	Changed Evaluate method to use RLock for rule scanning instead of Lock.	Potentially breaking for concurrent use cases if external code relied on the previous locking behavior.
High	Modified checkRateLimit to check >= MaxCalls before incrementing the counter.	May alter behavior for cases where external code depended on the previous counter behavior.

[github-actions]

🤖 AI Agent: test-generator — `agentmesh/policy.go`

agentmesh/policy.go

• TestEvaluateConcurrentAccess -- Validate that Evaluate correctly handles concurrent access with RLock and Lock.
• TestCheckRateLimitThreadSafety -- Ensure checkRateLimit maintains thread safety when accessed concurrently.
• TestEvaluateWithMultipleRules -- Test Evaluate with multiple rules to ensure correct rule matching and decision-making.
• TestEvaluateWithBackends -- Verify Evaluate correctly handles external policy backends.
• TestCheckRateLimitEdgeCases -- Test checkRateLimit with edge cases, such as MaxCalls set to 0 or negative values.

[github-actions]

🤖 AI Agent: security-scanner — View details

No security issues found.

[github-actions]

🤖 AI Agent: code-reviewer — Action Items:

TL;DR: 0 blockers, 1 warning. Code improves concurrency and rate-limiting logic, but lacks test coverage for RLock behavior.

#	Sev	Issue	Where
1	Warn	Missing test for concurrent RLock behavior	policy_test.go

Action Items:

• None.

Warnings:

#	Description	Resolution
1	Add tests to validate RLock behavior under concurrent access.	Fine as follow-up PR.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Warning	See details
🛡️ Security Scan	✅ Passed	No issues found
🔄 Breaking Changes	✅ Completed	Analysis complete
📝 Docs Sync	✅ Passed	No issues found
🧪 Test Coverage	✅ Completed	Analysis complete

Verdict: ⚠️ Ready for human review