feat: ship Buzzr public sports engine and MCP ecosystem

.codex-plugin/plugin.json

@@ -0,0 +1,38 @@
+{
+  "name": "buzzr-sports-engine",
+  "version": "0.1.0",
+  "description": "Auditable sports math, DFS settlement, and game-entertainment workflows for Codex.",
+  "author": {
+    "name": "Buzzr",
+    "url": "https://github.com/Buzzr-app"
+  },
+  "homepage": "https://buzzr-app.github.io/dfs-engine/",
+  "repository": "https://github.com/Buzzr-app/dfs-engine",
+  "license": "MIT",
+  "keywords": [
+    "sports",
+    "dfs",
+    "odds",
+    "mcp",
+    "settlement"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Buzzr Sports Engine",
+    "shortDescription": "Auditable sports math and DFS settlement",
+    "longDescription": "Use deterministic Buzzr engines for sportsbook odds math, DFS pick-em settlement, bet-history analytics, and game-entertainment scoring.",
+    "developerName": "Buzzr",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Interactive"
+    ],
+    "websiteURL": "https://buzzr-app.github.io/dfs-engine/",
+    "supportURL": "https://github.com/Buzzr-app/dfs-engine/issues",
+    "defaultPrompt": [
+      "Audit this DFS entry with its displayed terms and explain every settlement decision.",
+      "Calculate the no-vig fair line and closing-line value for these prices."
+    ],
+    "brandColor": "#FF6B35",
+    "screenshots": []
+  }
+}

.github/workflows/ci.yml

@@ -6,15 +6,21 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       matrix:
         node: [22, 24]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -25,9 +31,39 @@ jobs:
       - run: npm test
       - run: npm run test:coverage
       - run: npm run build
+      - run: npm run test:mcp:packed
+      - if: matrix.node == 22
+        run: npm run test:packages:packed
+      - run: npm run check:mcp:client-skill
+      - run: npm run check:mcp:examples
+      - run: npm run check:skill
       - run: npm run docs
+      - run: npm run check:docs
+      - run: npm run check:links
+      # External URLs are checked only after reviewed code reaches main. PR
+      # Markdown must not turn the shared CI runner into an arbitrary URL probe.
+      - if: matrix.node == 22 && github.event_name == 'push'
+        run: npm run check:links:external
       - run: npm run smoke:exports
       - run: npm run size:check
       - run: npm run pack:smoke
       - run: npm run bench
       - run: npm run audit:high
+
+  mcp-packed-platforms:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:mcp:packed

.github/workflows/docs.yml

@@ -2,40 +2,47 @@ name: docs
 
 on:
   push:
-    tags:
-      - 'v*'
+    branches:
+      - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: {}
 
 concurrency:
   group: pages
   cancel-in-progress: false
 
 jobs:
   build:
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run docs
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
-          path: packages/dfs-engine/docs
+          path: docs/api
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/prove-mcp-published.yml

@@ -0,0 +1,43 @@
+name: prove published MCP
+
+on:
+  workflow_dispatch:
+    inputs:
+      expected_version:
+        description: Published @buzzr/mcp version expected on npm latest
+        required: true
+        type: string
+      expected_integrity:
+        description: Reviewed npm dist.integrity for the exact release
+        required: true
+        type: string
+      expected_git_head:
+        description: Reviewed 40-character git commit for the exact release
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  prove:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run proof:mcp:published
+        env:
+          EXPECTED_MCP_VERSION: ${{ inputs.expected_version }}
+          EXPECTED_MCP_INTEGRITY: ${{ inputs.expected_integrity }}
+          EXPECTED_GIT_HEAD: ${{ inputs.expected_git_head }}