DEFAULT_PROTECTED
Default protected paths: every file a build tool, a git hook runner, a harness, or an editor loads or runs from the repository. A change here reaches another participant's mirror only after a quorum attestation and a signed approval. The list is matched case-insensitively over ASCII-folded paths (lvcs-doc's paths::protected()), so on a case-insensitive filesystem crates/x/BUILD.RS is protected too. lvcs.toml can't change it ([protect] paths is deferred, decision 126): a client lane that makes a harness or editor load a new such file adds its pattern here through M5.actor.
| Pattern | Why |
|---|---|
**/build.rs | runs on every build |
**/Cargo.toml | selects code that builds and runs |
**/Cargo.lock | pins the code that builds and runs |
lvcs.toml | declares checks, limits, and these lists |
**/.cargo/** | configures the compiler and wrappers |
.githooks/** | runs on git operations |
.github/** | CI configuration |
.lvcs/caps | capability grants |
**/.gitignore | decides which local files never sync |
**/.lvcsignore | decides which local files never sync |
**/.gitattributes | marks files derived and selects git's filter and merge drivers |
**/rust-toolchain | selects the compiler binary that runs |
**/rust-toolchain.toml | selects the compiler binary that runs |
**/.claude/** | harness settings and hooks run commands |
**/.mcp.json | starts MCP server commands |
**/CLAUDE.md | loaded into agent sessions as instructions |
**/AGENTS.md | loaded into agent sessions as instructions |
**/.claude-plugin/** | plugin hooks run commands |
**/hooks/hooks.json | plugin hooks run commands |
**/.vscode/** | editor tasks and server paths run on open |