APM Review Panel: ship_with_followups

Fixes --target intellij CLI validation so JetBrains MCP routing is no longer silently broken; panel unanimous with no blocking findings, five follow-ups led by a policy-gate alias miss and a discovery gap.

cc @sergio-sisternes-epam @danielmeppiel -- a fresh advisory pass is ready for your review.

PR #2041 closes issue #1957 by introducing MCP_ONLY_TARGETS = frozenset({"intellij"}) in target_detection.py and threading it through VALID_TARGET_VALUES and parse_target_field. The abstraction is correct, the all-expansion exclusion follows the established copilot-cowork precedent, and the added parser-layer unit tests pass. Auth and performance experts were correctly inactive. No panelist raised a blocking finding. This is a net-positive community contribution from an EPAM engineer who hit real friction with a documented but broken feature.

Three convergent panel signals warrant pre-merge attention. First, and sharpest: the supply-chain-security-expert identifies that policy_target_check.py passes the raw string 'intellij' to _check_compilation_target without aliasing through RUNTIME_TO_CANONICAL_TARGET. An org with allow: [copilot] in its policy will see --target intellij falsely blocked even though intellij resolves to copilot. This is fail-closed and safe in the threat sense, but it is a correctness regression for exactly the enterprise segment this EPAM contribution signals, and it should be resolved before the fix is considered complete at the policy layer. Second, cli-logging-expert and devx-ux-expert independently flag that the --target help text has no mention of intellij, meaning a user running apm install --help will conclude the flag is invalid and fall back to --runtime intellij -- the legacy path this PR is designed to replace. The fix is two sentences of help text; the cost of not shipping it is that the primary discovery path for the feature remains broken. Third, doc-writer and oss-growth-hacker converge on a missing CHANGELOG entry; a community fix that closes a documented issue with no release attribution is wasted momentum.

The test-coverage-expert returned two evidence: outcome=missing findings. The all-expansion regression trap (test_intellij_not_in_all_canonical_targets) is tagged governed-by-policy and protects the invariant that --target all never silently deploys to IntelliJ -- a promise the PR prose asserts but no automated lock currently enforces. The integration test gap covers the full apm install --target intellij CLI path; hermes and openclaw have integration tests, intellij has none, and an integration test is the tier-floor evidence for a CLI-validation bug fix. The python-architect's apm.yml asymmetry -- singular target: intellij now accepted, plural targets: [intellij] still fails at CANONICAL_TARGETS -- is lower urgency given the PR's stated scope, but the maintainer should document the intentional split or resolve it in a fast follow to avoid surprising users authoring multi-target apm.yml files.

Dissent. doc-writer rates the ide-tool-integration.md update (replacing --runtime intellij with --target intellij in the JetBrains guide example) as RECOMMENDED; devx-ux rates it NIT. I side with doc-writer: a guide that teaches the legacy flag for the one target this PR fixes is user-visible drift, not cosmetic. It should land with or immediately after this PR, not deferred indefinitely.

Aligned with: portable-by-manifest -- Partial: singular target: intellij in apm.yml now accepted via parse_target_field; plural targets: [intellij] still fails against CANONICAL_TARGETS in apm_yml.py -- a newly visible asymmetry. secure-by-default -- Preserved: no validation bypass introduced; the policy gate is fail-closed so no privilege escalation is possible; the alias normalization gap produces correctness failures, not security failures. governed-by-policy -- Gap: policy_target_check.py passes raw 'intellij' rather than canonical 'copilot' to _check_compilation_target; orgs with allow: [copilot] policies incorrectly see --target intellij rejected. multi-harness-multi-host -- Satisfied: IntelliJ MCP adapter, integrator, and RUNTIME_TO_CANONICAL_TARGET remap all pre-existed; this PR completes the integration at the flag validation surface. oss-community-driven -- Strong: EPAM engineer identifies and fixes a documented-but-broken JetBrains gap, demonstrating active enterprise pickup. pragmatic-as-npm -- Partially satisfied: --target intellij is now accepted at parse time, but --help invisibility means the feature is not self-discoverable until the help-text fix lands.

Growth signal. JetBrains IDEs represent roughly 25 million active users; an EPAM engineer both hitting and fixing this gap is an early enterprise-adoption signal worth broadcasting. Recommended sequencing: (1) land the policy-gate alias fix and help-text update in this PR or as a same-day fast follow so the feature is actually usable end-to-end; (2) add the CHANGELOG [Unreleased] entry so the fix is attributable at release and issue #1957 reporters have a clear resolution signal; (3) add IntelliJ to the README hero tool list at the next refresh cycle; (4) consider a community announcement to JetBrains/Kotlin/Java communities once discovery is unbroken. Do not amplify before the help-text gap closes -- announcing a feature users cannot find from --help is a community trust regression, not a growth event.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 5 follow-ups

1. [Supply Chain Security Expert] Apply RUNTIME_TO_CANONICAL_TARGET alias normalization in policy_target_check.py before passing to _check_compilation_target -- Orgs with allow: [copilot] policies see --target intellij falsely rejected today. Fail-closed is safe, but it breaks valid enterprise workflows for exactly the customer segment this EPAM contribution signals, and leaves the policy layer semantically inconsistent with the parser layer.
2. [CLI Logging Expert] Add intellij to the --target flag Values: help text in install.py with a note that it is MCP-only (devx-ux-expert convergent) -- The primary discovery path for the feature this PR ships is currently broken: --help does not mention intellij, causing users to conclude the flag is invalid and fall back to --runtime intellij. The fix is two sentences of help text and closes the entire discovery gap.
3. [Doc Writer] Add CHANGELOG [Unreleased] ### Fixed entry for --target intellij and update ide-tool-integration.md JetBrains example from --runtime to --target (oss-growth-hacker convergent) -- Consumers relying on CHANGELOG to track when issue [BUG] MCP server integration lacks IntelliJ as target #1957 is resolved will have no signal at release; the guide actively teaches the legacy flag for the one target this PR fixes.
4. [Test Coverage Expert] Add test_intellij_not_in_all_canonical_targets and test_all_expansion_excludes_intellij to test_target_detection.py (evidence: missing, governed-by-policy) -- The PR asserts intellij is excluded from --target all expansion but no automated guard enforces this invariant; a future contributor can silently break the promise.
5. [Test Coverage Expert] Create tests/integration/test_intellij_target.py mirroring test_hermes_target.py to exercise the full apm install --target intellij CLI-to-MCP-adapter path (evidence: missing, integration-with-fixtures tier required) -- Hermes and openclaw have integration tests; intellij has zero. Without it the fix can silently regress across refactors.

Architecture

classDiagram
    direction LR
    class TargetParamType {
        <<ClickParamType>>
        +convert(value, param, ctx) str or list
    }
    class parse_target_field {
        <<PureFunction>>
        +value str or list or None
        +source_path Path or None
    }
    class VALID_TARGET_VALUES {
        <<Frozenset>>
        union gate for all CLI tokens
    }
    class ALL_CANONICAL_TARGETS {
        <<Frozenset>>
        vscode claude cursor opencode codex gemini windsurf kiro
    }
    class MCP_ONLY_TARGETS {
        <<Frozenset>>
        intellij
    }
    class EXPLICIT_ONLY_TARGETS {
        <<Frozenset>>
        agent-skills antigravity
    }
    class EXPERIMENTAL_TARGETS {
        <<Frozenset>>
        copilot-cowork hermes openclaw
    }
    class RUNTIME_TO_CANONICAL_TARGET {
        <<Dict>>
        intellij maps to copilot
    }
    class IntelliJClientAdapter {
        <<MCPAdapter>>
        +target_name intellij
        +install_mcp_config()
    }
    class parse_targets_field {
        <<PureFunction>>
        apm_yml.py plural targets validator
    }
    class CANONICAL_TARGETS {
        <<Frozenset>>
        apm_yml.py no intellij entry
    }
    TargetParamType ..> parse_target_field : delegates
    parse_target_field ..> VALID_TARGET_VALUES : validates each token
    VALID_TARGET_VALUES ..> ALL_CANONICAL_TARGETS : union
    VALID_TARGET_VALUES ..> MCP_ONLY_TARGETS : union
    VALID_TARGET_VALUES ..> EXPLICIT_ONLY_TARGETS : union
    VALID_TARGET_VALUES ..> EXPERIMENTAL_TARGETS : union
    parse_target_field ..> EXPLICIT_ONLY_TARGETS : all-gate subtract
    parse_target_field ..> MCP_ONLY_TARGETS : all-gate subtract
    IntelliJClientAdapter ..> RUNTIME_TO_CANONICAL_TARGET : intellij maps to copilot
    parse_targets_field ..> CANONICAL_TARGETS : validates against
    class MCP_ONLY_TARGETS:::touched
    class parse_target_field:::touched
    class VALID_TARGET_VALUES:::touched
    classDef touched fill:#fff3b0,stroke:#d47600

flowchart TD
    CLI["CLI: apm install --target intellij"] --> TPC["TargetParamType.convert\ntarget_detection.py"]
    TPC --> PTF["parse_target_field\ntarget_detection.py"]
    PTF --> VAL{"token in VALID_TARGET_VALUES?"}
    VAL -- "pre-PR: intellij absent" --> ERR["BadParameter raised"]
    VAL -- "post-PR: HIT via MCP_ONLY_TARGETS" --> SINGLE["return 'intellij' token"]
    SINGLE --> AT["active_targets(root, 'intellij')"]
    AT --> RTCA["RUNTIME_TO_CANONICAL_TARGET.get('intellij') = 'copilot'"]
    RTCA --> KT["KNOWN_TARGETS.get('copilot') -> copilot TargetProfile"]
    KT --> FS1["primitives deployed to .github/"]
    SINGLE --> RTR["_resolve_target_runtimes explicit_target='intellij'"]
    RTR --> GATE["_gate_project_scoped_runtimes intellij->copilot in active set"]
    GATE --> FS2["IntelliJClientAdapter.install_mcp_config"]
    SINGLE --> ALLP["all,intellij: non_all_tokens - EXPLICIT_ONLY - MCP_ONLY == empty"]
    ALLP --> EXP["return sorted(ALL_CANONICAL_TARGETS) + ['intellij']"]
    EXP --> DEDUP["active_targets: intellij->copilot deduped vscode->copilot already in seen set"]

Recommendation

Merge once the policy-gate alias fix (supply-chain finding, policy_target_check.py) and the --target help-text update (cli-logging and devx-ux convergent, install.py) are included in this PR or committed as same-day fast follows -- these two items directly gate enterprise correctness and feature discoverability for the capability being shipped. The CHANGELOG entry, ide-tool-integration.md doc update, and the two missing test-coverage items (all-expansion regression trap tagged governed-by-policy, and the integration test) should land in the same release window. The python-architect apm.yml plural-key asymmetry can trail as a documented follow-up issue. The core fix is correct and the PR author has earned a clean merge; close the discovery and policy gaps first.

_{This panel is advisory. It does not block merge. Re-apply the
panel-review label after addressing feedback to re-run.}

Generated by PR Review Panel for issue #2041 · 722.1 AIC · ⌖ 17.8 AIC · ⊞ 5.5K · ◷

APM Review Panel: ship_with_followups

IntelliJ target validation is directionally right, but the direct MCP install path and regression evidence need one fold-in pass.

cc @sergio-sisternes-epam @danielmeppiel -- a fresh advisory pass is ready for your review.

The panel found that parser acceptance alone does not fulfill issue #1957: the direct --mcp ... --target intellij flow was not forwarding the selected target to MCP integration, the documented command shape was invalid, and no empirical install test proved that JetBrains Copilot config was written. The remaining architecture, policy, help, and reference-doc suggestions are small and in scope.

Aligned with: portable-by-manifest, multi-harness support, pragmatic package-manager UX.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 5 follow-ups

1. [Doc Writer] (blocking-severity) Forward --target intellij through direct MCP installation and correct the documented command.
2. [Test Coverage Expert] Add an empirical subprocess test that writes the IntelliJ MCP config.
3. [Test Coverage Expert] Exercise IntelliJ-to-Copilot policy normalization.
4. [Python Architect] Remove duplicated hardcoded IntelliJ mapping.
5. [Supply Chain Security Expert] Replace the fail-open canonical mapping fallback.

Recommendation

Fold these bounded changes into this PR, then re-run the panel against the user-observable install flow.

_{This panel is advisory. It does not block merge. Re-apply the panel-review label after addressing feedback to re-run.}

APM Review Panel: needs_rework

PR #2041 fixes single-target --target intellij validation, but this SHA is not ready to ship because multi-target installs can crash and policy enforcement still misses resolved-target paths.

cc @sergio-sisternes-epam -- a fresh advisory pass is ready for your review.

Panel convergence is strong, not split. The single-target IntelliJ path is real on this commit: the subprocess integration test proves exit 0, the OS-specific config write, and the requested server URL. The unit policy test also proves scalar intellij normalizes to copilot.

But the reproduced list-valued target_override TypeError, plus the finding that direct --mcp preflight and plural-target policy paths do not consistently consume the resolved target set, outweighs the green scalar evidence. Users will naturally try intellij,claude, and org admins will assume compilation.target.allow applies uniformly regardless of install path. Security and correctness should win over optimistic UX here.

Aligned with: OSS community-driven intent is strong, but secure-by-default, governed-by-policy, multi-harness, and pragmatic package-manager behavior require another correction pass.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 5 follow-ups

1. [Supply Chain Security Expert] (blocking-severity) Unify direct --mcp preflight and post-target policy evaluation around the same resolved target set, including plural targets and MCP-only canonical mappings. -- compilation.target.allow must apply uniformly across install paths.
2. [Python Architect] (blocking-severity) Make target handling shape-stable so both str and list[str] forms are normalized before membership checks or policy evaluation. -- The reproduced TypeError turns valid multi-target input into a runtime crash.
3. [DevX UX Expert] (blocking-severity) Constrain explicit --target intellij installs to the intended JetBrains Copilot MCP side effects. -- A specific client target should not write adjacent client config.
4. [Test Coverage Expert] Add CLI coverage for --target intellij,claude, --target all,intellij, and plural-target policy enforcement. -- Existing passing evidence is scalar-only.
5. [Doc Writer] Reconcile target detection documentation after runtime behavior is corrected. -- Public claims must match the final install contract.

Architecture

flowchart TD
    A[\"apm install --mcp NAME --target intellij\"] --> B[\"TargetParamType validation\"]
    B --> C[\"_handle_mcp_install target=intellij\"]
    C --> D[\"run_mcp_install\"]
    D --> E[\"MCPIntegrator.install runtime=intellij explicit_target=intellij\"]
    E --> F[\"JetBrains mcp.json write\"]
    A --> G[\"policy_target_check\"]
    G --> H{\"target shape\"}
    H -->|scalar| I[\"intellij to copilot\"]
    H -->|list| J[\"TypeError before policy result\"]

Recommendation

Do not ship this SHA yet. First fix target-shape and policy-path inconsistencies so direct --mcp, scalar targets, and plural targets share one resolved-target contract. Then verify explicit IntelliJ selection only touches intended config, add composed-flow regression coverage, and rerun the panel.

_{This panel is advisory. It does not block merge. Re-apply the panel-review label after addressing feedback to re-run.}

APM Review Panel: ship_now

PR #2041 adds user-facing IntelliJ target support to the APM CLI, broadening the multi-harness surface with clean architecture and full test coverage at SHA 55914b7e0.

cc @sergio-sisternes-epam -- a fresh advisory pass is ready for your review.

The panel converges on a clean engineering signal. Python architecture raised cosmetic nits only. CLI logging raised one recommended wording adjustment from "runtimes" to "targets" plus one nit. DevX UX, supply-chain security, documentation, test coverage, and performance found no concerns. Auth was inactive because no auth surface changed. The growth persona failed schema validation after two retries, so its return was replaced by the skill-defined placeholder with no findings.

The evidence is strong: exact-head CI is green, the full canonical lint passed, 398 relevant tests passed with one skip, and mutation-break guards proved plural normalization, direct MCP policy forwarding, and exact explicit runtime selection. All findings from the prior needs-rework pass were folded. The remaining polish can follow separately.

Aligned with: portable by manifest: IntelliJ remains in the manifest-driven target model; multi-harness/multi-host: JetBrains IDE support broadens editor coverage; pragmatic as npm: existing install flows gain the target without extra ceremony.

Growth signal. IntelliJ-family IDE support is a concrete differentiator worth highlighting in release notes, especially as a community contribution.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 2 follow-ups

1. [CLI Logging Expert] Align the new user-facing "runtimes" wording to "targets" -- this matches the manifest and documentation vocabulary.
2. [Python Architect] Consider the cosmetic defensive-check and lazy-import-comment cleanups in a future maintenance pass -- they do not affect behavior.

Architecture

classDiagram
    direction LR
    class TargetParamType {
        +convert(value, param, ctx)
    }
    class target_detection {
        +detect_target(project_root, explicit_target, config_target)
        +normalize_policy_targets(value)
    }
    class InstallContext {
        +target_override: str | list | None
    }
    class PolicyTargetCheckPhase {
        +run(ctx)
    }
    class MCPIntegrator {
        +install(deps, runtime, explicit_target)
    }
    class InstallPreflight {
        +run_policy_preflight(effective_target)
    }
    TargetParamType ..> target_detection : parses
    PolicyTargetCheckPhase ..> target_detection : normalizes
    PolicyTargetCheckPhase ..> InstallContext : reads override
    MCPIntegrator ..> target_detection : resolves exact targets
    InstallPreflight ..> target_detection : normalizes

flowchart TD
    A[CLI target input] --> B[Parse scalar or list]
    B --> C[Normalize policy targets]
    C --> D{Policy allows all targets?}
    D -->|No| E[Stop install]
    D -->|Yes| F[Resolve exact explicit runtime set]
    F --> G[Write only selected MCP configurations]

Recommendation

Ship now. Exact-head checks are green, regression guards passed, all prior rework findings were folded, and the final panel found no correctness concern. Track the terminology adjustment as optional follow-up polish.

_{This panel is advisory. It does not block merge. Re-apply the
panel-review label after addressing feedback to re-run.}

APM Review Panel: ship_with_followups

IntelliJ pseudo-target validation is sound; two documentation corrections and one direct test hardening item should fold before merge.

cc @sergio-sisternes-epam @danielmeppiel -- a fresh advisory pass is ready for your review.

PR #2041 adds IntelliJ as a valid MCP-only target, routes direct MCP installs to JetBrains Copilot, and maps policy evaluation to the Copilot profile. The hermetic subprocess test passes. The competing #1965 approach rejects --target intellij; this PR instead preserves the simpler target mental model with bounded implementation changes.

Two documentation claims need correction: the changelog says no file primitives deploy even though the Copilot profile is used, and the usage guide overstates policy coverage for auto-discovered targets. Direct unit tests should also pin the new policy-normalization contract.

Dissent. DevX and security panelists exhausted schema retries, so their placeholders carry no findings. Other specialists found no correctness or security regression.

Aligned with: multi-harness support, governed-by-policy target normalization, pragmatic CLI behavior, and OSS community contribution.

Growth signal. Frame this as IntelliJ joining the supported target family, not only as parser-error removal.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 4 follow-ups

1. [Doc Writer] Correct the changelog's no-file-primitives claim -- IntelliJ routes package primitives through the Copilot profile.
2. [Doc Writer] Narrow the policy statement -- direct preflight receives explicit selections, not later auto-discovery results.
3. [Test Coverage Expert] Add direct normalize_policy_targets tests for scalar, list, None, deduplication, and the error path.
4. [Python Architect] Clarify or remove the redundant isinstance guard on the typed scalar target path.

Architecture

flowchart TD
    A[apm install --mcp NAME --target intellij] --> B[TargetParamType validation]
    B --> C[normalize_policy_targets]
    C --> D[copilot policy profile]
    D --> E[MCP target resolution]
    E --> F[JetBrains Copilot mcp.json]

Recommendation

Fold the documentation corrections and direct normalization tests, then re-run the panel against the converged SHA.

_{This panel is advisory. Re-apply the panel-review label after addressing feedback to re-run.}

APM Review Panel: ship_with_followups

IntelliJ MCP-only target support now has full test proof; one progress-message grammar fix should fold before merge.

cc @sergio-sisternes-epam @danielmeppiel -- a fresh advisory pass is ready for your review.

All active specialists converged on the implementation, documentation, policy normalization, and regression evidence. CI is green at 8f018b843; the hermetic subprocess flow passes, and removing IntelliJ from the accepted target set makes that exact test fail. The sole concrete in-scope item is the scalar progress message saying runtimes instead of runtime.

Aligned with: multi-harness support, governed-by-policy target normalization, pragmatic CLI behavior, and community contribution.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 1 follow-up

1. [CLI Logging Expert] Use singular runtime when an explicit target set contains one item -- the touched path currently emits grammatically incorrect output.

Recommendation

Fold the one-line grammar fix, preserve the green evidence, and run one final panel pass.

_{This panel is advisory. Re-apply the panel-review label after addressing feedback to re-run.}

APM Review Panel: ship_with_followups

The implementation and test evidence are clean; one factual path claim in the target matrix must be corrected.

cc @sergio-sisternes-epam @danielmeppiel -- a fresh advisory pass is ready for your review.

All specialists converged on the production change at 08b53580a. CI, the hermetic CLI flow, direct normalization tests, and mutation-break evidence are green. The remaining item is documentation accuracy: the target matrix says every Copilot-profile primitive lands under .github/, while skills use .agents/skills/.

Aligned with: multi-harness support, portable primitive deployment, pragmatic CLI behavior, and community contribution.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 1 follow-up

1. [Doc Writer] State that Copilot-profile instructions, prompts, agents, and hooks use .github/, while skills use .agents/skills/.

Recommendation

Fold the factual documentation correction and run the final panel pass against the resulting SHA.

_{This panel is advisory. Re-apply the panel-review label after addressing feedback to re-run.}

APM Review Panel: ship_now

Community fix restores documented IntelliJ MCP-only target support with fail-closed policy normalization; all panel lenses converge on ship.

cc @sergio-sisternes-epam @danielmeppiel -- a fresh advisory pass is ready for your review.

Nine panelists reviewed this contribution across four iterations. Every active persona returned a ship signal with only nit-tier residuals. Architecture confirmed the MCP-only pseudo-target pattern is isolated and fail-closed. Security found no new attack surface. Test coverage confirmed layered unit, integration, E2E, and mutation-break evidence, while CI is fully green.

The only substantive follow-up is optional post-merge README growth work, which requires separate maintainer approval. Remaining nits are individually trivial and do not compound into architectural debt.

Dissent. No material dissent. The CLI and DevX reviewers both noted pre-existing runtime-vs-target terminology as polish, not a regression.

Aligned with: multi-harness and multi-host support by restoring the documented IntelliJ surface; governed by policy through fail-closed normalization; secure by default with no new credential, path, or integrity exposure; OSS community-driven through a fully tested contributor fix.

Growth signal. Adding JetBrains to the README hero line could strengthen the multi-harness story, but repository rules require separate maintainer approval; track it after merge rather than bundling it here.

Panel summary

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 1 follow-ups

1. [OSS Growth Hacker] Add JetBrains to the README hero line after maintainer approval -- the highest-traffic conversion surface should eventually reflect this expanded harness reach.

Architecture

classDiagram
    class TargetParamType
    class TargetDetection {
      +MCP_ONLY_TARGETS
      +VALID_TARGET_VALUES
      +normalize_policy_targets()
    }
    class PolicyTargetCheck
    class MCPCommand
    class MCPIntegratorInstall
    class MCPIntegrator
    TargetParamType ..> TargetDetection : validates
    PolicyTargetCheck ..> TargetDetection : normalizes
    MCPCommand --> MCPIntegratorInstall : forwards target
    MCPIntegratorInstall --> MCPIntegrator : exact runtime set

flowchart TD
    A[apm install --mcp pkg --target intellij] --> B[Validate target]
    B --> C[Normalize intellij to copilot for policy]
    C --> D{Policy allows copilot?}
    D -->|No| E[Exit with policy error]
    D -->|Yes| F[Preserve intellij for MCP routing]
    F --> G[Write JetBrains Copilot mcp.json]

sequenceDiagram
    actor User
    participant CLI
    participant Policy
    participant MCP
    participant FS
    User->>CLI: apm install --mcp pkg --target intellij
    CLI->>Policy: evaluate canonical target copilot
    Policy-->>CLI: pass
    CLI->>MCP: install for exact target intellij
    MCP->>FS: write user-scope mcp.json
    FS-->>User: configuration installed

Recommendation

All nine panelists converge on ship with no unresolved in-scope substantive finding after four iterations. CI is green, E2E and mutation-break evidence confirm the guards are load-bearing, and the only follow-up is optional README growth work requiring separate approval. Recommend merge at maintainer convenience.

_{This panel is advisory. It does not block merge. Re-apply the panel-review label after addressing feedback to re-run.}