diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index 9b357a8..737eb34 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -1,9 +1,11 @@
-# Generated from operatorstack/intelligence-flow.
+# Generated by labkit (python -m labkit gen). Do not edit by hand.
+# Edit labs/<lab>/publish.config.json and regenerate; drift fails `labkit doctor`.
+# Install into operatorstack/pitot at .github/workflows/sync-upstream.yml (bootstrap step).
 name: Sync from Intelligence Flow
 
 on:
   schedule:
-    - cron: "17 */6 * * *"
+    - cron: "59 */6 * * *"
   workflow_dispatch:
     inputs:
       source_commit:
@@ -23,20 +25,22 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - name: Create repository automation token
+      - name: Create publisher token
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
           client-id: ${{ vars.OPERATOR_STACK_PUBLISHER_APP_CLIENT_ID || vars.BOATSTACK_APP_CLIENT_ID }}
           private-key: ${{ secrets.OPERATOR_STACK_PUBLISHER_APP_PRIVATE_KEY || secrets.BOATSTACK_APP_PRIVATE_KEY }}
           owner: operatorstack
-          repositories: pitot
+          repositories: |
+            intelligence-flow
+            pitot
           permission-contents: write
           permission-pull-requests: write
       - name: Check out Pitot
         uses: actions/checkout@v4
         with:
-          path: pitot-repo
+          path: public-repo
           token: ${{ steps.app-token.outputs.token }}
       - name: Check out Intelligence Flow
         uses: actions/checkout@v4
@@ -45,39 +49,33 @@ jobs:
           ref: ${{ inputs.source_commit || 'main' }}
           fetch-depth: 0
           path: intelligence-flow
+          token: ${{ steps.app-token.outputs.token }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install labkit
+        shell: bash
+        run: python3 -m pip install --quiet ./intelligence-flow/labkit
       - name: Generate projection
         id: generate
         shell: bash
         run: |
           source_commit="$(git -C intelligence-flow log -1 --format=%H -- labs/15-pitot)"
-          current_commit="$(jq -r '.source.commit // empty' pitot-repo/UPSTREAM.json 2>/dev/null || echo '')"
+          current_commit="$(jq -r '.source.commit // empty' public-repo/UPSTREAM.json 2>/dev/null || echo '')"
           if [[ -n "$current_commit" ]] &&
              ! git -C intelligence-flow merge-base --is-ancestor "$current_commit" "$source_commit"; then
-            echo "Ignoring stale projection request $source_commit"
+            echo "Ignoring stale request; Pitot already records $current_commit."
             echo "stale=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          
-          # Perform the byte level sync for pitot
-          rsync -av --delete --exclude='.git' --exclude='.github' intelligence-flow/labs/15-pitot/pitot/ pitot-repo/
-          
-          # The preview files
-          cp intelligence-flow/labs/15-pitot/public-readme-preview/README.md pitot-repo/
-          cp intelligence-flow/labs/15-pitot/public-readme-preview/CONTRIBUTING.md pitot-repo/
-          rsync -av --delete intelligence-flow/labs/15-pitot/public-readme-preview/assets/ pitot-repo/assets/
-          
-          # The distribution package files
-          if [[ -d intelligence-flow/labs/15-pitot/pitot-distribution/sdk ]]; then
-            mkdir -p pitot-repo/sdk
-            rsync -av --delete intelligence-flow/labs/15-pitot/pitot-distribution/sdk/ pitot-repo/sdk/
-          fi
-          
-          # Copy UPSTREAM.json
-          cp intelligence-flow/labs/15-pitot/pitot-distribution/UPSTREAM.json pitot-repo/
-          
+          python3 -m labkit project \
+            --config intelligence-flow/labs/15-pitot/publish.config.json \
+            --repo public-repo \
+            --source-commit "$source_commit" \
+            --write
           echo "source_commit=$source_commit" >> "$GITHUB_OUTPUT"
           echo "stale=false" >> "$GITHUB_OUTPUT"
-
       - name: Open generated pull request
         if: steps.generate.outputs.stale != 'true'
         env:
@@ -85,35 +83,31 @@ jobs:
           SOURCE_COMMIT: ${{ steps.generate.outputs.source_commit }}
         shell: bash
         run: |
-          cd pitot-repo
+          cd public-repo
           if [[ -z "$(git status --porcelain)" ]]; then
             echo "Pitot already matches Intelligence Flow."
             exit 0
           fi
           git add -A
-          
           body_file="$(mktemp)"
           {
-            echo "## Projection provenance"
-            echo
+            echo "## Projection provenance"; echo
             echo "Generated from \`operatorstack/intelligence-flow@$SOURCE_COMMIT\`."
-            echo "Review provenance before merging."
+            echo "Review the operator contract, provenance, and compatibility before merging."
           } > "$body_file"
-          
           short="${SOURCE_COMMIT:0:12}"
           branch="sync/intelligence-flow-$short"
           existing="$(gh pr list --head "$branch" --state open --json url --jq '.[0].url')"
-          
           git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]"
           git config user.email "${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com"
           git switch -c "$branch"
-          git commit -m "Sync Pitot from Intelligence Flow Labs @ $short"
-          git push --set-upstream origin "$branch"
-          
+          git commit -m "Sync Pitot from Intelligence Flow @ $short"
+          git push --force --set-upstream origin "$branch"
           if [[ -z "$existing" ]]; then
-            pr_url="$(gh pr create               --base main               --head "$branch"               --title "Sync Pitot from Intelligence Flow Labs @ $short"               --body-file "$body_file")"
+            pr_url="$(gh pr create --base main --head "$branch" \
+              --title "Sync Pitot from Intelligence Flow @ $short" \
+              --body-file "$body_file")"
             echo "Opened generated PR: $pr_url"
           else
-            pr_url="$existing"
-            echo "Updated existing PR: $pr_url"
+            echo "Updated existing PR: $existing"
           fi