pincer-workflow 0.2.2 → 0.2.3

package/README.md

@@ -86,7 +86,7 @@ want the repo-side rules too can copy `AGENTS.md` from the
 npx pincer-workflow@latest update
 ```
 
-Files you never touched are refreshed in place. (Installs older than v0.2.0 gain the ticket state machine, the status report and the ticket-guard hook on update; `.claude/settings.json` conflicts if you edited it — merge the new hook entry from the `.new` file. v0.2.2 replaces the Codex adapter: the commands are now skills in `.agents/skills/` invoked as `$pincer-*`, since Codex no longer loads `~/.codex/prompts/` — you can delete the copies there.) Files you edited are left
+Files you never touched are refreshed in place. (Installs older than v0.2.0 gain the ticket state machine, the status report and the ticket-guard hook on update; `.claude/settings.json` conflicts if you edited it — merge the new hook entry from the `.new` file. v0.2.2 replaces the Codex adapter: the commands are now skills in `.agents/skills/` invoked as `$pincer-*`, since Codex no longer loads `~/.codex/prompts/` — you can delete the copies there. v0.2.3 ships the playbooks, rubrics and templates under `.claude/` on every platform, which Codex- and Copilot-only installs were missing.) Files you edited are left
 alone — the new version lands next to them as `<file>.new` for a manual merge.
 `npx pincer-workflow doctor` checks the health of an install (hook executable,
 `.gitignore` covering `.env*`, no unmerged `*.new` files, version current).
@@ -96,7 +96,7 @@ alone — the new version lands next to them as `<file>.new` for a manual merge.
 | Piece | Purpose |
 | --- | --- |
 | `AGENTS.md` | Project rules, single cross-platform source (workflow order, security defaults, secrets, untrusted-content and dependency rules) |
-| `.claude/commands/` | The five playbooks plus `/pincer-status` (canonical — adapters are generated from them) |
+| `.claude/commands/` | The five playbooks plus `/pincer-status` (canonical — adapters are generated from them; ships on every platform together with `agents/` and `references/`) |
 | `.claude/agents/` | `codebase-explorer` and `code-quality-reviewer` subagents, with inline fallbacks for platforms without subagents |
 | `scripts/pincer-ticket.sh` | The ticket state machine: `start` (enforces dependency order) → `verify` (runs the ticket's check, stamps a receipt only on green) → `done` (refuses without a matching receipt or with unticked criteria) |
 | `scripts/pincer-status.sh` | Read-only state report: PRD, every ticket with clock-based elapsed time, blocked tickets, build time vs budget, next command |

package/bin/pincer.js

@@ -20,9 +20,13 @@ const TEMPLATE = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '
 const VERSION = createRequire(import.meta.url)('../package.json').version;
 const MANIFEST = '.pincer.json';
 
+// The playbooks, subagent rubrics and PRD/ticket templates under .claude/ are
+// the canonical kit and are read by every platform's adapter (the Codex skills
+// and Copilot prompts point at them), so they ship everywhere; only Claude
+// Code's own wiring (CLAUDE.md, settings.json, hooks) is platform-specific.
 const PLATFORM_ROOTS = {
-  common: ['AGENTS.md', 'docs/dry-run-checklist.md', 'scripts/sync-prompts.sh', 'scripts/pincer-ticket.sh', 'scripts/pincer-status.sh'],
-  claude: ['CLAUDE.md', '.claude'],
+  common: ['AGENTS.md', 'docs/dry-run-checklist.md', 'scripts/sync-prompts.sh', 'scripts/pincer-ticket.sh', 'scripts/pincer-status.sh', '.claude/commands', '.claude/agents', '.claude/references'],
+  claude: ['CLAUDE.md', '.claude/settings.json', '.claude/hooks'],
   codex: ['.codex', '.agents'],
   copilot: ['.github'],
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pincer-workflow",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "PINCER — a PRD-driven agentic delivery workflow for Claude Code, Codex CLI, and GitHub Copilot. Plan · Investigate · Narrow · Code · Evaluate · Release.",
   "bin": {
     "pincer": "bin/pincer.js"

package/template/.agents/skills/pincer-code/SKILL.md

@@ -30,7 +30,7 @@ from wherever the receipt says you are. Confirm the starting point with the user
 1. **Start:** `scripts/pincer-ticket.sh start T-{NN}` — refuses while a `depends_on` ticket
    isn't done, and stamps the start time. Read the ticket and the files it references.
    Announce: "Starting T-{NN}: {title}."
-2. **Implement.** Follow the conventions in `CLAUDE.md` and the PRD's architecture and
+2. **Implement.** Follow the conventions in `AGENTS.md` and the PRD's architecture and
    visual direction. Installing a dependency not named in the PRD's architecture is a
    stop-and-ask: verify it's the real package on the registry (linked repo, downloads —
    hallucinated names get typosquatted), say why it earns its place, and wait for a yes.
@@ -49,7 +49,7 @@ from wherever the receipt says you are. Confirm the starting point with the user
      `.env.example` as a blocker.
    - External input touched by this diff is validated server-side, and untrusted
      content (user input, LLM output) is escaped where rendered — per the
-     Security defaults in `CLAUDE.md`.
+     Security defaults in `AGENTS.md`.
    - No error path leaks internals (stack traces, key names with values) to the client.
    If the review changed code, run `verify` again — the receipt must match the code you commit.
 5. **Close the ticket:** tick every verified acceptance-criteria checkbox (`- [ ]` → `- [x]`;

package/template/.claude/commands/pincer-code.md

@@ -28,7 +28,7 @@ from wherever the receipt says you are. Confirm the starting point with the user
 1. **Start:** `scripts/pincer-ticket.sh start T-{NN}` — refuses while a `depends_on` ticket
    isn't done, and stamps the start time. Read the ticket and the files it references.
    Announce: "Starting T-{NN}: {title}."
-2. **Implement.** Follow the conventions in `CLAUDE.md` and the PRD's architecture and
+2. **Implement.** Follow the conventions in `AGENTS.md` and the PRD's architecture and
    visual direction. Installing a dependency not named in the PRD's architecture is a
    stop-and-ask: verify it's the real package on the registry (linked repo, downloads —
    hallucinated names get typosquatted), say why it earns its place, and wait for a yes.
@@ -47,7 +47,7 @@ from wherever the receipt says you are. Confirm the starting point with the user
      `.env.example` as a blocker.
    - External input touched by this diff is validated server-side, and untrusted
      content (user input, LLM output) is escaped where rendered — per the
-     Security defaults in `CLAUDE.md`.
+     Security defaults in `AGENTS.md`.
    - No error path leaks internals (stack traces, key names with values) to the client.
    If the review changed code, run `verify` again — the receipt must match the code you commit.
 5. **Close the ticket:** tick every verified acceptance-criteria checkbox (`- [ ]` → `- [x]`;

package/template/.codex/README.md

@@ -15,6 +15,10 @@ $pincer-narrow   →   $pincer-code   →   $pincer-evaluate   →   $pincer-rel
 $pincer-status
 ```
 
+The skills point at the canonical playbooks, the two subagent rubrics and the
+PRD/ticket templates under `.claude/` — those ship on every platform, so the
+directory is expected here even without Claude Code.
+
 `/skills` lists what Codex has loaded — the six `pincer-*` entries should be
 there whenever you start `codex` inside this repo. The skills are generated
 from `.claude/commands/` by `scripts/sync-prompts.sh` (cross-references are

package/template/.github/prompts/pincer-code.prompt.md

@@ -30,7 +30,7 @@ from wherever the receipt says you are. Confirm the starting point with the user
 1. **Start:** `scripts/pincer-ticket.sh start T-{NN}` — refuses while a `depends_on` ticket
    isn't done, and stamps the start time. Read the ticket and the files it references.
    Announce: "Starting T-{NN}: {title}."
-2. **Implement.** Follow the conventions in `CLAUDE.md` and the PRD's architecture and
+2. **Implement.** Follow the conventions in `AGENTS.md` and the PRD's architecture and
    visual direction. Installing a dependency not named in the PRD's architecture is a
    stop-and-ask: verify it's the real package on the registry (linked repo, downloads —
    hallucinated names get typosquatted), say why it earns its place, and wait for a yes.
@@ -49,7 +49,7 @@ from wherever the receipt says you are. Confirm the starting point with the user
      `.env.example` as a blocker.
    - External input touched by this diff is validated server-side, and untrusted
      content (user input, LLM output) is escaped where rendered — per the
-     Security defaults in `CLAUDE.md`.
+     Security defaults in `AGENTS.md`.
    - No error path leaks internals (stack traces, key names with values) to the client.
    If the review changed code, run `verify` again — the receipt must match the code you commit.
 5. **Close the ticket:** tick every verified acceptance-criteria checkbox (`- [ ]` → `- [x]`;