perf(pr-management-stats): build the whole dashboard as code

.github/labeler.yml

@@ -552,7 +552,6 @@ substrate:analytics:
               - 'tools/contributor-metrics/**'
               - 'tools/dashboard-generator/**'
               - 'tools/pr-management/**'
-              - 'tools/pr-management-stats/**'
               - 'tools/preflight-audit/**'
               - 'tools/security-tracker-stats-dashboard/**'
               - 'tools/skill-token-count/**'

.gitignore

@@ -37,7 +37,7 @@ logs
 
 # Local per-adopter framework state (triage session-history gist id,
 # stats dashboard gist id, …). Written by the pr-management skills at the
-# repo root; never committed (see skills/pr-management-stats/export.md and
+# repo root; never committed (see tools/pr-management/src/pr_management/stats/build.py and
 # skills/pr-management-triage/session-history.md).
 /.apache-magpie.session-state.json
 

CONTRIBUTING.md

@@ -236,7 +236,7 @@ every piece of context it needs from some combination of the four
 │   ├── skill-and-tool-validator/  # Validate SKILL.md frontmatter + links + placeholders
 │   ├── skill-evals/      # Behavioral eval harness for skill steps
 │   ├── dashboard-generator/  # HTML dashboard reference impl (Groovy + Python)
-│   ├── pr-management-stats/  # Maintainer dashboard data layer
+│   ├── pr-management/    # Deterministic core of the pr-management skills (triage, stats dashboard)
 │   ├── security-tracker-stats-dashboard/  # Security-side stats
 │   ├── probe-templates/  # Boilerplate for sandbox-probe scripts
 │   └── dev/              # Local checkers (placeholders, agent pre-commit)
@@ -311,7 +311,7 @@ needs to fill in.
 | CVE workflow | `vulnogram/`, `cve-org/` | ASF Vulnogram (CVE allocation + JSON generation); MITRE CVE Services v2 |
 | Runtime / safety | `agent-isolation/`, `privacy-llm/`, `sandbox-lint/` | Bubblewrap + network-allowlist sandbox; redactor + checker for privacy-LLM gating; settings.json linter |
 | Dev loop | `skill-and-tool-validator/`, `skill-evals/`, `dev/` | SKILL.md validation; behavioral eval harness; local placeholder + pre-commit checkers |
-| Reporting | `dashboard-generator/`, `pr-management-stats/`, `security-tracker-stats-dashboard/` | HTML dashboards for maintainer + security review |
+| Reporting | `dashboard-generator/`, `pr-management/`, `security-tracker-stats-dashboard/` | HTML dashboards for maintainer + security review |
 | Authoring | `probe-templates/` | Boilerplate scaffold for sandbox probes |
 
 New tool subtrees follow the same pattern: a `tool.md` or

docs/labels-and-capabilities.md

@@ -354,8 +354,7 @@ or a contract-free mix of substrates (e.g. `tools/spec-inventory` is
 | [`tools/adversarial-review`](../tools/adversarial-review/) | `substrate:review` | Runs other models' CLIs (Codex, Copilot, Gemini, Claude) read-only over a change before its PR is created, and merges their findings into one advisory JSON report |
 | [`tools/vetted-ops`](../tools/vetted-ops/) | `substrate:sandbox` | Fixed, policy-scoped forge operations — a closed catalogue whose parameters can never become commands or flags, so one `allow` entry replaces the wildcard Layer 3 `ask` rules |
 | [`tools/contributor-metrics`](../tools/contributor-metrics/) | `substrate:analytics` | Deterministic contributor activity counts, per-area shares and automated-work weighting for the contributor-growth skills |
-| [`tools/pr-management`](../tools/pr-management/) | `substrate:analytics` | Deterministic core of the `pr-management` skills: classifies a saved PR sweep (pre-filters, decision table, stale sweeps), guards each mutation on fresh reads, and renders every contributor-facing body |
-| [`tools/pr-management-stats`](../tools/pr-management-stats/) | `substrate:analytics` | PR-backlog analytics engine |
+| [`tools/pr-management`](../tools/pr-management/) | `substrate:analytics` | Deterministic core of the `pr-management` skills: classifies a saved PR sweep (pre-filters, decision table, stale sweeps), guards each mutation on fresh reads, renders every contributor-facing body, and builds the whole PR-backlog dashboard |
 | [`tools/preflight-audit`](../tools/preflight-audit/) | `substrate:analytics` | Dry-run the bulk-mode pre-flight classifier; measure skip-rate before / after any rule edit in the security-issue-sync skill |
 | [`tools/privacy-llm`](../tools/privacy-llm/) | `substrate:privacy` | Privacy-LLM PII-scrubbing gate |
 | [`tools/probe-templates`](../tools/probe-templates/) | `substrate:sandbox` | Sandbox-doctor probe templates |

docs/vendor-neutrality.md

@@ -617,7 +617,7 @@ Organization scope (declared, orthogonal to vendor): ASF = 16, agnostic = 63.
 
 **LLM / agent-integration neutrality**
 
-**Agent harness: 33/33 substrate tools run under any harness unchanged (100%).** Substrate tools are Magpie's own machinery; each declares the agent harness it integrates with (`**Harness:**`), or `agnostic`. A tool is neutral when it is harness-agnostic or supports two or more harnesses; *coupled* when it targets a single harness.
+**Agent harness: 32/32 substrate tools run under any harness unchanged (100%).** Substrate tools are Magpie's own machinery; each declares the agent harness it integrates with (`**Harness:**`), or `agnostic`. A tool is neutral when it is harness-agnostic or supports two or more harnesses; *coupled* when it targets a single harness.
 
 | Substrate tool | Substrate | Harness support | Verdict |
 |---|---|---|---|
@@ -633,7 +633,6 @@ Organization scope (declared, orthogonal to vendor): ASF = 16, agnostic = 63.
 | `permission-audit` | sandbox | any | ✅ agnostic |
 | `pilot-report-validator` | framework-dev | any | ✅ agnostic |
 | `pr-management` | analytics | any | ✅ agnostic |
-| `pr-management-stats` | analytics | any | ✅ agnostic |
 | `preflight-audit` | analytics | any | ✅ agnostic |
 | `privacy-llm` | privacy | any | ✅ agnostic |
 | `probe-templates` | sandbox | any | ✅ agnostic |
@@ -663,7 +662,7 @@ Harness → substrate tools it supports:
 - **Gemini CLI** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
 - **Kiro** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
 - **OpenCode** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
-- **any harness** (30): `adversarial-review`, `agent-isolation`, `container-gateway`, `contributor-metrics`, `dashboard-generator`, `dev`, `egress-gateway`, `maven-artifact-verify`, `permission-audit`, `pilot-report-validator`, `pr-management`, `pr-management-stats`, `preflight-audit`, `privacy-llm`, `probe-templates`, `release-config`, `release-verify`, `reproducible-archive`, `security-tracker-stats-dashboard`, `setup-preflight`, `skill-and-tool-validator`, `skill-evals`, `skill-reconciler-diff`, `skill-token-count`, `spec-inventory`, `spec-status-index`, `spec-validator`, `symlink-lint`, `vendor-neutrality-score`, `vetted-ops`
+- **any harness** (29): `adversarial-review`, `agent-isolation`, `container-gateway`, `contributor-metrics`, `dashboard-generator`, `dev`, `egress-gateway`, `maven-artifact-verify`, `permission-audit`, `pilot-report-validator`, `pr-management`, `preflight-audit`, `privacy-llm`, `probe-templates`, `release-config`, `release-verify`, `reproducible-archive`, `security-tracker-stats-dashboard`, `setup-preflight`, `skill-and-tool-validator`, `skill-evals`, `skill-reconciler-diff`, `skill-token-count`, `spec-inventory`, `spec-status-index`, `spec-validator`, `symlink-lint`, `vendor-neutrality-score`, `vetted-ops`
 
 **Model endpoint: neutral by construction — 4 default-approved endpoint classes across independent trust domains, plus adopter opt-in.** From the [`privacy-llm` registry](../tools/privacy-llm/models.md): the framework keys approval on *endpoint identity*, not on who hosts the model, so no single LLM vendor is privileged.