From 934f57a8a0e08e873b0a998e548d8fcea450a3ec Mon Sep 17 00:00:00 2001
From: Jarek Potiuk <potiuk@apache.org>
Date: Sat, 29 Aug 2026 21:22:07 +0200
Subject: [PATCH] fix(security-tracker-stats): recognise the framework's own
 comment marker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default `bot_prefixes` did not list `<!-- apache-magpie: `, the
canonical machine marker every framework skill writes on its
status-rollup, hand-off, and import comments. Those comments were
therefore counted as *human triage activity*, pulling the
time-to-triage median toward zero on any tracker the skills touch — and
the more the skills are used, the more wrong the metric gets.

At the same time the default listed `<!-- airflow-s status rollup v`, a
marker specific to one adopter's tracker repo and meaningless to every
other project. That is the template-genericity residue the upgrade
flow's Step 6d audit exists to catch; #1123 removed the last
apache-steward references but this one survived.

Swaps the leaked adopter marker for the framework's own.

Also corrects the README's merge documentation. It said the `milestones`
and `categories` lists are replaced entirely, implying other lists
merge. `deep_merge` replaces *every* list — its own docstring says
"Lists are REPLACED, not concatenated" — so an overlay adding a single
`bot_prefixes` entry silently drops all the defaults. That is precisely
the trap that makes this bug hard to notice downstream: an adopter fixes
the marker locally and unknowingly discards the rest of the list.

Verified: the config still parses under the hand-rolled
`_minimal_yaml_load` subset parser with the added comments,
`is_bot_body` now classifies a real `<!-- apache-magpie: status-rollup
v3 -->` comment as bot while leaving a human triage comment alone, and
the tool's 114 tests pass.

Generated-by: Claude Code (Claude Opus 5)
---
 tools/security-tracker-stats-dashboard/README.md         | 8 +++++---
 .../security-tracker-stats-dashboard/default-config.yaml | 9 ++++++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/tools/security-tracker-stats-dashboard/README.md b/tools/security-tracker-stats-dashboard/README.md
index a5732e391..f1c83c030 100644
--- a/tools/security-tracker-stats-dashboard/README.md
+++ b/tools/security-tracker-stats-dashboard/README.md
@@ -99,9 +99,11 @@ run is ~5–10 minutes on a 250-issue tracker; incremental re-renders
 1. `default-config.yaml` (in this directory).
 2. `$TRACKER_STATS_CONFIG` overlay YAML, when set (typically
    `<adopter-repo>/.apache-magpie-overrides/security-tracker-stats.yaml`).
-   Deep-merged with the default. **The `milestones` and `categories`
-   lists are REPLACED entirely** (not concatenated) — overlaying a
-   single category requires re-stating the whole list.
+   Deep-merged with the default. **Every list is REPLACED entirely**
+   (not concatenated) — `milestones`, `categories`, `bot_prefixes`,
+   `keywords`, and any other list-valued key. Overlaying a single
+   entry requires re-stating the whole list, otherwise the defaults
+   are silently dropped.
 3. Env-var quick overrides for the most common knobs:
    `TRACKER_STATS_BUCKETS`, `TRACKER_STATS_START`,
    `TRACKER_STATS_UPSTREAM_REPO`.
diff --git a/tools/security-tracker-stats-dashboard/default-config.yaml b/tools/security-tracker-stats-dashboard/default-config.yaml
index 5581bc162..cb8c6b902 100644
--- a/tools/security-tracker-stats-dashboard/default-config.yaml
+++ b/tools/security-tracker-stats-dashboard/default-config.yaml
@@ -163,8 +163,15 @@ triage:
     - Security Model
     - cve-worthy
     - CVE-worthy
+  # Skill-authored comments, skipped when measuring human triage
+  # activity. The first entry is the canonical machine marker every
+  # framework skill writes (`<!-- apache-magpie: <kind> vN -->`); the
+  # rest are prose prefixes from older comment shapes.
+  #
+  # NOTE: this list is REPLACED wholesale by an overlay, not merged --
+  # an overlay adding one prefix must restate the whole list.
   bot_prefixes:
-    - "<!-- airflow-s status rollup v"
+    - "<!-- apache-magpie: "
     - "**Sync "
     - "**Imported on "
     - "**Status update"