protectlisted

# Configuring real enforcement keel's hook is advisory - it runs only inside Claude Code and only catches honest mistakes made through it. It is not a security boundary: it cannot stop a push made outside Claude Code, from another tool, or from someone who never installed the plugin. **This skill sets up the enforcement that actually holds, server-side, for everyone.** ## 1. Check you can gh repo view --json viewerPermission -q .viewerPermission You need `ADMIN`. If you do not have it, tell the user what to ask their administrator for and stop. ## 2. Confirm before changing anything Branch protection is outward-facing and affects every contributor, not just this session - and it is not a quick undo once other people start relying on it. **Before making any `gh api` call**, show the user the exact rule you are about to apply, filled in with real values from `.keel.json` (branch name, required approving review count, status check contexts) - not a template. Get explicit confirmation. If they want changes, adjust and show it again before proceeding. ## 3. Protect the production branch Requires a PR, passing checks, and (usually) an approving review. Resolve `<count>` from the `reviewPolicy` table below before running this. Note `-F` (not `-f`) on the numeric and boolean fields: `-f` sends every value as a JSON string, so `-f ...count=1` would send `"1"` where GitHub expects an integer and the call would fail. gh api -X PUT repos/{owner}/{repo}/branches/<product