Add Pitot protected native auto-merge gate

labkit/tests/test_labkit_gen.py

@@ -150,9 +150,10 @@ def test_release_workflow_goreleaser_builds_and_attests_binaries():
 
 def test_auto_merge_is_opt_in():
     # Only labs that set `sync.auto_merge` get a generated public-repo verify.yml.
-    interlock = generated_artifacts(_config("21-interlock"), REPO_ROOT)
-    assert any(p.name == "verify.yml" for p in interlock), "interlock opts in => verify.yml"
-    for name in ("12-product-engineering-loop", "15-pitot", "14-product-value-projection"):
+    for name in ("21-interlock", "15-pitot"):
+        artifacts = generated_artifacts(_config(name), REPO_ROOT)
+        assert any(p.name == "verify.yml" for p in artifacts), f"{name} opts in => verify.yml"
+    for name in ("12-product-engineering-loop", "14-product-value-projection"):
         artifacts = generated_artifacts(_config(name), REPO_ROOT)
         assert not any(p.name == "verify.yml" for p in artifacts), f"{name} did not opt in"
 

labs/15-pitot/.labkit/generated/verify.yml

@@ -0,0 +1,56 @@
+# Generated by labkit (python -m labkit gen). Do not edit by hand.
+# Edit labs/<lab>/publish.config.json and regenerate; drift fails `labkit doctor`.
+# Install into operatorstack/pitot at .github/workflows/verify.yml (bootstrap step).
+name: Verify Pitot distribution
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-pitot-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: go test ./...
+      - run: go build ./...
+
+  verify-sync-provenance:
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      startsWith(github.head_ref, 'sync/intelligence-flow-')
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Verify generated projection provenance
+        env:
+          HEAD_BRANCH: ${{ github.head_ref }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        shell: bash
+        run: |
+          source_repo="$(jq -r '.source.repository' UPSTREAM.json)"
+          source_commit="$(jq -r '.source.commit' UPSTREAM.json)"
+          short="${source_commit:0:12}"
+          [[ "$PR_AUTHOR" == "operator-stack-publisher[bot]" ]]
+          [[ "$source_repo" == "operatorstack/intelligence-flow" ]]
+          [[ "$HEAD_BRANCH" == "sync/intelligence-flow-$short" ]]

labs/15-pitot/pitot-distribution/UPSTREAM.json

@@ -32,7 +32,7 @@
     "conformance/fixtures/negative.jsonl": "503ea76988df595d96ebf695f991b8ea6c892be4a578522dff4ddb0d39b647e4",
     "conformance/fixtures/positive.jsonl": "881efdf58b66ee7d03171c6b4410bf1bce9e1b8db5c8bf969d0e8ec467420c3f",
     "doc.go": "a8abdafac969b1bf4372c8bb023aa51125dc073f03218f4ab9913dfc5ffa877d",
-    "e2e/e2e_coverage_test.go": "6235bd1df7212e4e229be324ac50f592aef70dce8855519d02e6b843656ea109",
+    "e2e/e2e_coverage_test.go": "09a738ca70749be94c462ce9974cdac9a7be0b24b9dc2b20ec0738d4686ebfbf",
     "e2e/e2e_hook_test.go": "5e184dc8907b6e36daeab90bbbb1654fa5336312866412031805a13ba535d1f8",
     "examples/doc.go": "58f3f9eb7d272d7b6eecdb05f43e1613d5e3ef92d15d97c5440bd4b6990c26f9",
     "examples/local-approval/main.go": "51386af324cd7d3bb07fe3ace53503884b02714b96b83073342fde81ce3b83a5",

labs/15-pitot/pitot-distribution/release-notes/2026-07-28-native-auto-merge-gate.md

@@ -0,0 +1,5 @@
+### Pitot syncs now use protected native auto-merge
+
+Pitot gains the generated Linux, macOS, and Windows verification gate. The
+publisher App requests native squash auto-merge, while required checks decide
+when the projected change may land.

labs/15-pitot/pitot/e2e/e2e_coverage_test.go

@@ -10,9 +10,12 @@ import (
 )
 
 func TestAllAdaptersHaveE2EScripts(t *testing.T) {
-	// The e2e package lives in labs/15-pitot/pitot/e2e
-	// The test scripts live in labs/15-pitot/tests
+	// Monorepo: labs/15-pitot/pitot/e2e -> labs/15-pitot/tests.
+	// Public projection: e2e -> tests.
 	testsDir := filepath.Join("..", "..", "tests")
+	if _, err := os.Stat(testsDir); os.IsNotExist(err) {
+		testsDir = filepath.Join("..", "tests")
+	}
 
 	for _, host := range adapters.Supported() {
 		t.Run(string(host), func(t *testing.T) {

labs/15-pitot/publish.config.json

@@ -5,6 +5,7 @@
   "source": { "repo": "operatorstack/intelligence-flow", "lab_path": "labs/15-pitot" },
   "target": { "owner": "operatorstack", "repo": "pitot" },
   "go_module": "github.com/operatorstack/pitot",
+  "sync": { "auto_merge": true },
   "manifest": {
     "path": "pitot-distribution/UPSTREAM.json",
     "committed": true,