# Calibration pass #1 (cc-os) — protected set

_Fixed 2026-07-14, before the pass; per lifecycle-spec §9 this list is
human-edited and never revised after the pass starts._

Hard gate: the pass FAILS if any rule persisted to a rulebook has a glob
matching any path below — regardless of behavior tier. Exploration-time
consult verdicts on these paths are free.

Protected globs (repo-root-relative, cc-os):

- `plugins/*/eval*/scenarios/**`
- `plugins/*/eval*/scenarios-reserve/**`
- `plugins/*/eval*/fixture/**`
- `plugins/*/eval*/judge-rubric.md`
- `plugins/os-context/eval/**/scenarios*/**` (defensive; covered by the above where layout matches)
- `openspec/specs/**`
- `docs/adr/**`
- `.claude/skills/**`
- `.codex/skills/**`
- `.pi/skills/**`
- `plugins/*/.claude/skills/**`
- `CLAUDE.md` (root and any directory-level `CLAUDE.md`, i.e. `**/CLAUDE.md`)
- `plugins/*/skills/**`, `plugins/*/scripts/**`, `plugins/*/hooks/**`,
  `plugins/*/lib/**`, `plugins/*/.claude-plugin/**` (plugin source)
- `plugins/*/rulebook.json`, `plugins/*/conventions.json`, `plugins/*/invariants.md`,
  `plugins/*/examples/golden/**` (plugin source/reversion protection)