fix: complete bundled tool consolidation

[Delqhi]

Summary

Completes the unfinished consolidation from #29 and closes #512 by making Slash, Marketplace and MCP Server Builder first-class bundled SIN-Code capabilities without breaking existing consumers.

Runtime cutover

• preserve the legacy Python namespaces sin_slash, sin_marketplace and sin_mcp_server_builder
• preserve 13 historical console-script entrypoints
• run Marketplace and MCP Builder MCP servers from bundled SIN-Code modules
• remove both standalone repositories from external requirements, skill installation and runtime discovery
• fix the Slash import/annotation regression in the canonical implementation

Packaging and Marketplace

• remove the superseded PEP 639-incompatible license classifier
• repair the stale uv.lock root identity (sin-code-bundle → sin-code)
• refresh the lock without changing any existing package version
• ship a seven-entry, path-free Marketplace catalog inside the wheel
• move the remote catalog source from private Infra to the public SIN-Code repository
• provide an offline bundled-catalog fallback
• remove absolute /Users/... paths and the Infra runtime dependency

Governance

• mark Marketplace and MCP Builder as native in lifecycle metadata
• update ECOSYSTEM and consolidation records
• retain compatibility surfaces while making the three standalone repositories archive candidates

Verification

• 367 passed — canonical Slash/MCP Builder/Marketplace and compatibility tests
• 146 passed — original Slash standalone tests against canonical SIN-Code
• 120 passed — original MCP Builder standalone tests against canonical SIN-Code
• 86 passed, 11 deselected — original Marketplace contracts; the 11 deselected contracts are the intentionally replaced private-Infra URL, no-cache failure and live-network sync behaviors, each covered by deterministic canonical tests
• targeted Go tests: pass
• targeted Go race tests: pass
• Go vet: pass
• Ruff: pass
• uv lock --check --offline: pass
• Wheel and sdist build: pass
• fresh-environment wheel smoke: 7 catalog entries and all 13 legacy entrypoints pass
• Gitleaks changed-files and commit-range scans: clean

Lockfile review

The lock refresh adds the dependencies already declared by the current pyproject.toml, removes the obsolete tree-sitter-languages aggregate, and replaces the stale editable project record. It changes zero existing package versions.

Known unrelated baseline drift

scripts/sync_lifecycle.py --check still reports the pre-existing skill-github-governance drift and 17 unrelated lifecycle-map orphans. The two entries changed by this PR match the lifecycle map exactly; unrelated drift is intentionally not mixed into #512.

Closes #512.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sin-code	Ready	Preview, Comment, Open in v0	Jul 28, 2026 3:11pm

[github-actions]

🏆 CEO Audit — A (92.0/100)

Metric	Value
Grade	A
Score	92.0/100
Critical findings	0
High findings	0
Profile	QUICK
Min grade gate	B

📥 Download full report (Markdown)
📊 Download SARIF (for Code Scanning)

Run skills/code-skills/skill-code-ceo-audit/scripts/audit.sh . --profile=QUICK locally to reproduce.

[github-actions]

🏆 CEO Audit — A (92.0/100)

Metric	Value
Grade	A
Score	92.0/100
Critical findings	0
High findings	0
Medium findings	2
Profile	QUICK
Min grade gate	B

📥 Download full report (Markdown)

Run ID: 30372106148 · Commit: ${github.sha}

Run skills/code-skills/skill-code-ceo-audit/scripts/audit.sh . --profile=QUICK locally to reproduce.