loki-mode 7.5.13 → 7.5.15

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.5.13
+# Loki Mode v7.5.15
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -381,4 +381,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.5.13 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.5.15 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.5.13
+7.5.15

package/autonomy/lib/sentrux-gate.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Loki Mode -- sentrux architectural-drift helper (v7.5.14).
+#
+# Why this exists:
+#   Loki's existing 11 quality gates and 3-reviewer council catch correctness
+#   and behavioral regressions, but no current gate emits a deterministic,
+#   per-iteration architecture-drift signal. sentrux (https://github.com/sentrux/sentrux)
+#   is a Rust CLI that scores codebase structure (modularity, acyclicity,
+#   depth, equality, redundancy) into a single 0-1 number, with a
+#   `gate --save` baseline plus `gate` compare workflow that catches when
+#   an iteration silently degrades architecture.
+#
+# Why opt-in only:
+#   sentrux is an external Rust binary (v0.5.x as of this release) that users
+#   install themselves via brew or curl. We do NOT bundle it, do NOT auto-install,
+#   and do NOT touch the iteration hot path by default. Every entry point in
+#   this file no-ops gracefully when sentrux is not on PATH.
+#
+# Verified facts (v7.5.14, 2026-05-03):
+#   - sentrux v0.5.7 binary works on darwin-arm64.
+#   - `sentrux gate --save <path>` writes <path>/.sentrux/baseline.json with
+#     real JSON: {timestamp, quality_signal (0..1), coupling_score, cycle_count,
+#     god_file_count, hotspot_count, complex_fn_count, max_depth,
+#     total_import_edges, cross_module_edges}.
+#   - `sentrux gate <path>` prints a "Quality:      <before> -> <after>"
+#     line and either "DEGRADED" or "No degradation detected".
+#   - Defect: `sentrux gate` exits 0 even when output reports DEGRADED. This
+#     helper parses stdout and the JSON file rather than relying on exit code.
+#
+# Public API:
+#   sentrux_available                       -> 0 if binary on PATH, 1 otherwise
+#   sentrux_version                         -> prints "X.Y.Z" or empty on fail
+#   sentrux_baseline_save <path>            -> writes <path>/.sentrux/baseline.json
+#   sentrux_baseline_quality <path>         -> prints quality_signal*10000 as int
+#                                              (or empty on missing/malformed)
+#   sentrux_gate_diff <path>                -> prints "<before>|<after>|<verdict>"
+#                                              where verdict is OK|DEGRADED|UNKNOWN
+#
+# All functions are pure helpers: no global state mutations, no side effects
+# beyond what sentrux itself writes inside <path>/.sentrux/.
+
+# Guard against double-source.
+if [ "${__LOKI_SENTRUX_GATE_SH_LOADED:-0}" = "1" ]; then
+    return 0 2>/dev/null || true
+fi
+__LOKI_SENTRUX_GATE_SH_LOADED=1
+
+sentrux_available() {
+    command -v sentrux >/dev/null 2>&1
+}
+
+sentrux_version() {
+    if ! sentrux_available; then
+        return 1
+    fi
+    sentrux --version 2>/dev/null | head -1 | awk '{print $NF}' | tr -d 'v'
+}
+
+# Run sentrux gate --save against <path>. Returns 0 on success, 1 on failure
+# or if sentrux is unavailable. stderr from sentrux is preserved for debugging
+# but stdout is suppressed.
+sentrux_baseline_save() {
+    local path="${1:-.}"
+    if ! sentrux_available; then
+        return 1
+    fi
+    if [ ! -d "$path" ]; then
+        return 1
+    fi
+    sentrux gate --save "$path" >/dev/null 2>&1
+}
+
+# Read quality_signal from <path>/.sentrux/baseline.json and print it as an
+# integer in the 0-10000 range (matching sentrux's stdout convention). Prints
+# empty string and returns 1 on missing file, malformed JSON, or missing field.
+sentrux_baseline_quality() {
+    local path="${1:-.}"
+    local baseline="$path/.sentrux/baseline.json"
+    if [ ! -f "$baseline" ]; then
+        return 1
+    fi
+    # Use python3 for JSON parsing -- jq is not always installed and python3
+    # is already a hard requirement in cmd_doctor. Pin float math to int via
+    # round() so callers get a stable, comparable integer.
+    local q
+    q=$(python3 -c "
+import json, sys
+try:
+    with open(sys.argv[1]) as f:
+        d = json.load(f)
+    v = d.get('quality_signal')
+    if v is None:
+        sys.exit(1)
+    print(int(round(float(v) * 10000)))
+except Exception:
+    sys.exit(1)
+" "$baseline" 2>/dev/null)
+    if [ -z "$q" ]; then
+        return 1
+    fi
+    printf '%s' "$q"
+}
+
+# Run sentrux gate against <path> and print "<before>|<after>|<verdict>".
+# verdict is OK | DEGRADED | UNKNOWN. Returns 0 if a valid verdict was parsed,
+# 1 only when sentrux is unavailable, the path is missing, or no Quality line
+# could be parsed from output. before/after are integers (0-10000) or empty.
+#
+# Important: sentrux gate's exit code is inconsistent in v0.5.7 -- it has been
+# observed to exit 0 on DEGRADED in some shapes and 1 in others. This helper
+# captures stdout regardless of exit code and relies on text parsing as the
+# source of truth.
+sentrux_gate_diff() {
+    local path="${1:-.}"
+    if ! sentrux_available; then
+        return 1
+    fi
+    if [ ! -d "$path" ]; then
+        return 1
+    fi
+    local out
+    # Deliberately do NOT gate on sentrux's exit code -- capture output either
+    # way. The `|| true` on the substitution keeps a nonzero gate exit from
+    # tripping callers running under `set -e`.
+    out=$(sentrux gate "$path" 2>/dev/null || true)
+    if [ -z "$out" ]; then
+        printf '%s' "||UNKNOWN"
+        return 1
+    fi
+    local quality_line before after verdict
+    # Match "Quality:      4333 -> 4321" or with arrow variants.
+    quality_line=$(printf '%s\n' "$out" | grep -E '^Quality:' | head -1 || true)
+    if [ -n "$quality_line" ]; then
+        before=$(printf '%s' "$quality_line" | grep -oE '[0-9]+' | sed -n '1p')
+        after=$(printf '%s' "$quality_line" | grep -oE '[0-9]+' | sed -n '2p')
+    fi
+    if printf '%s' "$out" | grep -q 'DEGRADED'; then
+        verdict="DEGRADED"
+    elif printf '%s' "$out" | grep -q 'No degradation detected'; then
+        verdict="OK"
+    else
+        verdict="UNKNOWN"
+    fi
+    printf '%s|%s|%s' "${before:-}" "${after:-}" "$verdict"
+}

package/autonomy/loki

@@ -3096,6 +3096,11 @@ cmd_dashboard_help() {
     echo ""
     echo "Usage: loki dashboard <command> [options]"
     echo ""
+    echo "Note: 'loki dashboard' is the operations/observability UI (port ${DASHBOARD_DEFAULT_PORT})."
+    echo "      It is NOT the same as 'loki web' (Purple Lab, port ${PURPLE_LAB_DEFAULT_PORT}, where you input PRDs)."
+    echo "      Use 'loki dashboard' to monitor agents, tasks, costs, council, escalations."
+    echo "      Use 'loki web' to submit a PRD and watch agents build."
+    echo ""
     echo "Commands:"
     echo "  start    Start the dashboard server"
     echo "  stop     Stop the dashboard server"
@@ -3644,6 +3649,11 @@ cmd_web_help() {
     echo ""
     echo "Usage: loki web [command] [options]"
     echo ""
+    echo "Note: 'loki web' is Purple Lab (the PRD-input/build-watch UI, port ${PURPLE_LAB_DEFAULT_PORT})."
+    echo "      It is NOT the same as 'loki dashboard' (operations UI, port ${DASHBOARD_DEFAULT_PORT})."
+    echo "      Use 'loki web' to submit a PRD and watch agents build it."
+    echo "      Use 'loki dashboard' to monitor running agents, tasks, costs, council, escalations."
+    echo ""
     echo "Commands:"
     echo "  start    Start Purple Lab (default)"
     echo "  stop     Stop Purple Lab server"
@@ -6795,6 +6805,16 @@ cmd_doctor() {
         echo -e "  ${YELLOW}WARN${NC}  OTEL - not configured (set LOKI_OTEL_ENDPOINT)"
         warn_count=$((warn_count + 1))
     fi
+    # sentrux check (v7.5.14, optional architectural-drift gate)
+    if command -v sentrux &>/dev/null; then
+        local _sentrux_ver
+        _sentrux_ver=$(sentrux --version 2>/dev/null | head -1 | awk '{print $NF}')
+        echo -e "  ${GREEN}PASS${NC}  sentrux ${_sentrux_ver:-unknown} (architectural drift gate: loki sentrux help)"
+        pass_count=$((pass_count + 1))
+    else
+        echo -e "  ${YELLOW}WARN${NC}  sentrux - not installed (optional, brew install sentrux/tap/sentrux)"
+        warn_count=$((warn_count + 1))
+    fi
     echo ""
 
     echo -e "${CYAN}System:${NC}"
@@ -6951,6 +6971,20 @@ if disk_gb is not None:
     elif disk_gb < 5:
         disk_status = 'warn'
 
+# v7.5.15: expose the sentrux architectural-drift gate state in --json so
+# dashboards/automation can surface it the same way the text-mode block does
+# (added in v7.5.14). Sibling of checks/disk -- intentionally not counted in
+# the summary tally to keep summary numbers backwards-compatible.
+sentrux_found = shutil.which('sentrux') is not None
+sentrux_version = get_version('sentrux') if sentrux_found else None
+sentrux_status = 'pass' if sentrux_found else 'warn'
+sentrux = {
+    'found': sentrux_found,
+    'version': sentrux_version,
+    'status': sentrux_status,
+    'required': 'optional'
+}
+
 pass_count = sum(1 for c in checks if c['status'] == 'pass')
 fail_count = sum(1 for c in checks if c['status'] == 'fail')
 warn_count = sum(1 for c in checks if c['status'] == 'warn')
@@ -6965,6 +6999,7 @@ result = {
         'available_gb': disk_gb,
         'status': disk_status
     },
+    'sentrux': sentrux,
     'summary': {
         'passed': pass_count,
         'failed': fail_count,
@@ -6977,6 +7012,199 @@ print(json.dumps(result, indent=2))
 "
 }
 
+# Architectural-drift gate (v7.5.14, opt-in).
+#
+# Wraps the external sentrux Rust binary -- https://github.com/sentrux/sentrux --
+# to give users a deterministic per-iteration architecture-drift signal that
+# complements the existing 11 quality gates and 3-reviewer council. This is a
+# manual subcommand only in v7.5.14; iteration-loop integration is deferred
+# pending a real-PRD smoke test (tracked in CHANGELOG).
+#
+# Subcommands:
+#   loki sentrux baseline [<path>]   -- save .sentrux/baseline.json
+#   loki sentrux gate     [<path>]   -- compare current vs baseline
+#   loki sentrux status   [<path>]   -- print current baseline + verdict
+#
+# Default path is the current working directory.
+cmd_sentrux() {
+    # shellcheck source=autonomy/lib/sentrux-gate.sh
+    if ! source "$_LOKI_SCRIPT_DIR/lib/sentrux-gate.sh" 2>/dev/null \
+       && ! source "$(dirname "$0")/lib/sentrux-gate.sh" 2>/dev/null; then
+        echo -e "${RED}sentrux helper missing -- expected at autonomy/lib/sentrux-gate.sh${NC}" >&2
+        return 1
+    fi
+
+    local sub="${1:-help}"
+    if [ "$#" -gt 0 ]; then shift; fi
+
+    # Parse --force flag (used by init-rules); collect remaining args into target.
+    local force=0
+    local positional=()
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --force|-f) force=1; shift ;;
+            --) shift; while [ "$#" -gt 0 ]; do positional+=("$1"); shift; done ;;
+            *) positional+=("$1"); shift ;;
+        esac
+    done
+    local target="${positional[0]:-.}"
+
+    case "$sub" in
+        baseline)
+            if ! sentrux_available; then
+                echo -e "${YELLOW}sentrux not installed.${NC} Install via:" >&2
+                echo "  brew install sentrux/tap/sentrux" >&2
+                echo "  or download from https://github.com/sentrux/sentrux/releases" >&2
+                return 2
+            fi
+            if sentrux_baseline_save "$target"; then
+                local q
+                q=$(sentrux_baseline_quality "$target" || echo "?")
+                echo -e "${GREEN}Baseline saved.${NC} Quality: $q (path: $target)"
+                return 0
+            fi
+            echo -e "${RED}Failed to save baseline.${NC}" >&2
+            return 1
+            ;;
+        gate)
+            if ! sentrux_available; then
+                echo -e "${YELLOW}sentrux not installed.${NC} Run 'loki sentrux baseline' for setup hints." >&2
+                return 2
+            fi
+            local diff verdict before after
+            diff=$(sentrux_gate_diff "$target")
+            verdict=$(printf '%s' "$diff" | awk -F'|' '{print $3}')
+            before=$(printf '%s' "$diff" | awk -F'|' '{print $1}')
+            after=$(printf '%s' "$diff" | awk -F'|' '{print $2}')
+            case "$verdict" in
+                OK)
+                    echo -e "${GREEN}OK${NC}  Quality: $before -> $after (no degradation)"
+                    return 0
+                    ;;
+                DEGRADED)
+                    echo -e "${RED}DEGRADED${NC}  Quality: $before -> $after"
+                    echo "  Architecture regressed since the saved baseline."
+                    echo "  Inspect with: sentrux scan $target"
+                    return 1
+                    ;;
+                *)
+                    echo -e "${YELLOW}UNKNOWN${NC}  Could not parse sentrux output."
+                    echo "  Try: sentrux gate --save $target  (to refresh baseline)"
+                    return 2
+                    ;;
+            esac
+            ;;
+        status)
+            if ! sentrux_available; then
+                echo "sentrux: not installed (optional)"
+                echo "install: brew install sentrux/tap/sentrux"
+                return 0
+            fi
+            local v
+            v=$(sentrux_version || echo "unknown")
+            echo "sentrux: v$v"
+            local q
+            if q=$(sentrux_baseline_quality "$target"); then
+                echo "baseline ($target): quality=$q"
+            else
+                echo "baseline ($target): not saved (run: loki sentrux baseline $target)"
+            fi
+            return 0
+            ;;
+        init-rules)
+            # Scaffold a conservative default .sentrux/rules.toml in <target>/.sentrux/.
+            # Does not require sentrux binary -- the file is plain text.
+            local rules_dir="$target/.sentrux"
+            local rules_file="$rules_dir/rules.toml"
+            local abs_path
+            if [ -e "$rules_file" ] && [ "$force" -ne 1 ]; then
+                echo -e "${YELLOW}Refusing to overwrite existing $rules_file${NC}" >&2
+                echo "  Re-run with --force to replace it." >&2
+                return 1
+            fi
+            if ! mkdir -p "$rules_dir" 2>/dev/null; then
+                echo -e "${RED}Failed to create $rules_dir${NC}" >&2
+                return 2
+            fi
+            if ! cat > "$rules_file" <<'SENTRUX_RULES_EOF'
+# Sentrux architectural rules scaffolded by `loki sentrux init-rules` (Loki Mode v7.5.15).
+# Conservative defaults -- tighten per-project as needed.
+# See https://github.com/sentrux/sentrux for full spec.
+
+[constraints]
+# Block any iteration that introduces an import cycle.
+max_cycles = 0
+# Block files that grow into "god files" (very high churn + many dependents).
+no_god_files = true
+# Cap cyclomatic complexity per function (sentrux default is liberal).
+max_cc = 30
+
+# Layer enforcement is project-specific. Uncomment + edit when you know the
+# layout you want enforced. Example for a typical app:
+#
+# [[layers]]
+# name = "core"
+# paths = ["src/core/*"]
+# order = 0
+#
+# [[layers]]
+# name = "app"
+# paths = ["src/app/*"]
+# order = 2
+#
+# [[boundaries]]
+# from = "src/app/*"
+# to = "src/core/internal/*"
+# reason = "app must not depend on core internals"
+SENTRUX_RULES_EOF
+            then
+                echo -e "${RED}Failed to write $rules_file${NC}" >&2
+                return 2
+            fi
+            # Resolve absolute path for friendly output (portable across macOS/Linux).
+            if command -v python3 >/dev/null 2>&1; then
+                abs_path=$(python3 -c "import os,sys; print(os.path.abspath(sys.argv[1]))" "$rules_file" 2>/dev/null || echo "$rules_file")
+            else
+                abs_path=$(cd "$(dirname "$rules_file")" 2>/dev/null && pwd)/$(basename "$rules_file")
+            fi
+            echo -e "${GREEN}Wrote $abs_path${NC}"
+            echo "Edit it to add layer/boundary rules, then run: loki sentrux baseline $target"
+            return 0
+            ;;
+        help|--help|-h|"")
+            echo -e "${BOLD}loki sentrux${NC} - Architectural drift gate (opt-in, requires sentrux binary)"
+            echo ""
+            echo "Usage:"
+            echo "  loki sentrux baseline   [<path>]         Save current architecture as baseline"
+            echo "  loki sentrux gate       [<path>]         Compare current vs baseline (exit 1 on DEGRADED)"
+            echo "  loki sentrux status     [<path>]         Show binary version + saved baseline quality"
+            echo "  loki sentrux init-rules [<path>] [--force]"
+            echo "                                           Scaffold a default .sentrux/rules.toml"
+            echo ""
+            echo "Default path is the current directory."
+            echo ""
+            echo "About:"
+            echo "  Wraps the sentrux CLI (https://github.com/sentrux/sentrux), a Rust tool that"
+            echo "  scores codebase structure into a single 0-10000 quality signal. Useful as a"
+            echo "  supplement to Loki's existing 11 quality gates when you want an objective"
+            echo "  per-iteration architectural-drift number."
+            echo ""
+            echo "  Iteration-loop auto-gating is planned for a future release; for now this"
+            echo "  subcommand is the manual integration surface."
+            echo ""
+            echo "Install sentrux:"
+            echo "  brew install sentrux/tap/sentrux"
+            echo "  curl -fsSL https://raw.githubusercontent.com/sentrux/sentrux/main/install.sh | sh"
+            return 0
+            ;;
+        *)
+            echo -e "${RED}Unknown subcommand: $sub${NC}" >&2
+            echo "Run 'loki sentrux help' for usage." >&2
+            return 1
+            ;;
+    esac
+}
+
 # Show version
 cmd_version() {
     echo "Loki Mode v$(get_version)"
@@ -11974,6 +12202,9 @@ main() {
         doctor)
             cmd_doctor "$@"
             ;;
+        sentrux)
+            cmd_sentrux "$@"
+            ;;
         setup-skill)
             cmd_setup_skill "$@"
             ;;

package/autonomy/run.sh

@@ -5916,6 +5916,29 @@ except (json.JSONDecodeError, FileNotFoundError, OSError):
 # Results stored in .loki/quality/test-results.json
 # ============================================================================
 
+# v7.5.15 (Triage #14): wrap pytest with a configurable timeout so a
+# deadlocked or infinite-loop test under /test cannot hang the gate
+# indefinitely. Uses `timeout` on Linux, `gtimeout` (coreutils) on macOS,
+# and degrades gracefully if neither is available (logs a warning, runs
+# unbounded). Configurable via LOKI_PYTEST_TIMEOUT (default 300s).
+#
+# Usage: _loki_run_pytest_with_timeout <target_dir> [pytest_args...]
+# Stdout: combined pytest output
+# Exit: 0 on pass, non-zero on fail. Exit 124 indicates the timeout fired.
+_loki_run_pytest_with_timeout() {
+    local target_dir="$1"; shift
+    local pytest_timeout="${LOKI_PYTEST_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
+    local _to_cmd=()
+    if command -v gtimeout >/dev/null 2>&1; then
+        _to_cmd=(gtimeout "${pytest_timeout}s")
+    elif command -v timeout >/dev/null 2>&1; then
+        _to_cmd=(timeout "${pytest_timeout}s")
+    else
+        log_warn "Neither gtimeout nor timeout available; pytest gate will run unbounded (install coreutils on macOS)"
+    fi
+    (cd "$target_dir" && "${_to_cmd[@]}" pytest "$@" 2>&1)
+}
+
 enforce_test_coverage() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local quality_dir="$loki_dir/quality"
@@ -6037,9 +6060,19 @@ enforce_test_coverage() {
         fi
         if [ "$has_python_project" = "true" ] && command -v pytest &>/dev/null; then
             test_runner="pytest"
-            local output
-            output=$(cd "${TARGET_DIR:-.}" && pytest --tb=short 2>&1) || test_passed=false
-            details="pytest: $(echo "$output" | tail -5 | tr '\n' ' ')"
+            local output pytest_exit
+            # v7.5.15 (Triage #14): wrapped with configurable timeout via helper.
+            output=$(_loki_run_pytest_with_timeout "${TARGET_DIR:-.}" --tb=short)
+            pytest_exit=$?
+            if [ "$pytest_exit" -eq 124 ]; then
+                local _pt_to="${LOKI_PYTEST_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
+                test_passed=false
+                log_warn "pytest gate timed out after ${_pt_to}s (exit 124)"
+                details="pytest: TIMED OUT after ${_pt_to}s -- $(echo "$output" | tail -3 | tr '\n' ' ')"
+            else
+                [ "$pytest_exit" -ne 0 ] && test_passed=false
+                details="pytest: $(echo "$output" | tail -5 | tr '\n' ' ')"
+            fi
         fi
     fi
 
@@ -10487,11 +10520,79 @@ PRD_PARSE_EOF
 # Main Autonomous Loop
 #===============================================================================
 
+#-------------------------------------------------------------------------------
+# Sentrux architectural-drift gate hooks (v7.5.15).
+#
+# Opt-in via LOKI_SENTRUX_GATE=1. Default OFF -- zero behavior change for users
+# who don't opt in. The helper at autonomy/lib/sentrux-gate.sh is sourced inside
+# run_autonomous() under the same guard. Both hook functions no-op silently if
+# the helper is not loaded or the sentrux binary is not on PATH.
+#-------------------------------------------------------------------------------
+_loki_sentrux_iteration_start() {
+    local target="${1:-${TARGET_DIR:-.}}"
+    if [ "${LOKI_SENTRUX_GATE:-0}" != "1" ]; then
+        return 0
+    fi
+    if ! type sentrux_available >/dev/null 2>&1 || ! sentrux_available; then
+        return 0
+    fi
+    sentrux_baseline_save "$target" >/dev/null 2>&1 || true
+    return 0
+}
+
+_loki_sentrux_iteration_end() {
+    local iter="${1:-0}"
+    local target="${2:-${TARGET_DIR:-.}}"
+    if [ "${LOKI_SENTRUX_GATE:-0}" != "1" ]; then
+        return 0
+    fi
+    if ! type sentrux_available >/dev/null 2>&1 || ! sentrux_available; then
+        return 0
+    fi
+    local diff before after verdict
+    diff=$(sentrux_gate_diff "$target" 2>/dev/null || true)
+    if [ -z "$diff" ]; then
+        return 0
+    fi
+    before="${diff%%|*}"
+    local rest="${diff#*|}"
+    after="${rest%%|*}"
+    verdict="${rest#*|}"
+    if type log_info >/dev/null 2>&1; then
+        log_info "sentrux gate iter=$iter verdict=$verdict before=${before:-?} after=${after:-?}"
+    fi
+    if [ "$verdict" = "DEGRADED" ]; then
+        local state_dir="$target/.loki/state"
+        mkdir -p "$state_dir" 2>/dev/null || true
+        local finding_path="$state_dir/findings-sentrux-${iter}.json"
+        local ts
+        ts=$(date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || echo "")
+        local before_json="${before:-0}"
+        local after_json="${after:-0}"
+        # Guard against non-numeric values when serializing to JSON.
+        if ! [[ "$before_json" =~ ^[0-9]+$ ]]; then before_json=0; fi
+        if ! [[ "$after_json"  =~ ^[0-9]+$ ]]; then after_json=0; fi
+        printf '{"type":"architectural-drift","iteration":%s,"before":%s,"after":%s,"verdict":"DEGRADED","timestamp":"%s","source":"sentrux"}\n' \
+            "$iter" "$before_json" "$after_json" "$ts" \
+            > "$finding_path" 2>/dev/null || true
+    fi
+    return 0
+}
+
 run_autonomous() {
     local prd_path="$1"
 
     log_header "Starting Autonomous Execution"
 
+    # Sentrux architectural-drift gate (opt-in via LOKI_SENTRUX_GATE=1, v7.5.15).
+    # Source the helper only when the gate is enabled to avoid hot-path overhead
+    # for the default-off case. Failure to source is non-fatal -- the wrapper
+    # functions degrade to no-ops via type checks.
+    if [ "${LOKI_SENTRUX_GATE:-0}" = "1" ]; then
+        # shellcheck disable=SC1090,SC1091
+        source "${SCRIPT_DIR}/lib/sentrux-gate.sh" 2>/dev/null || true
+    fi
+
     # Auto-detect PRD if not provided
     if [ -z "$prd_path" ]; then
         log_step "No PRD provided, searching for existing PRD files..."
@@ -10670,6 +10771,9 @@ except Exception as exc:
         # Auto-track iteration start (for dashboard task queue)
         track_iteration_start "$ITERATION_COUNT" "$prd_path"
 
+        # Sentrux architectural-drift baseline snapshot (opt-in, v7.5.15).
+        _loki_sentrux_iteration_start "${TARGET_DIR:-.}"
+
         local prompt
         prompt=$(build_prompt "$retry" "$prd_path" "$ITERATION_COUNT")
 
@@ -11149,6 +11253,9 @@ if __name__ == "__main__":
         # Auto-track iteration completion (for dashboard task queue)
         track_iteration_complete "$ITERATION_COUNT" "$exit_code"
 
+        # Sentrux architectural-drift gate diff + finding emission (opt-in, v7.5.15).
+        _loki_sentrux_iteration_end "$ITERATION_COUNT" "${TARGET_DIR:-.}"
+
         # End OTEL phase span (if OTEL is enabled)
         if [ -n "${LOKI_OTEL_ENDPOINT:-}" ]; then
             emit_event_pending "otel_span_end" \

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.5.13"
+__version__ = "7.5.15"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -5955,6 +5955,68 @@ async def get_findings(iteration: int):
                         detail=f"No findings for iteration {iteration}")
 
 
+@app.get("/api/quality/architecture")
+async def get_quality_architecture():
+    """Return the sentrux architectural-drift series.
+
+    Globs `.loki/state/findings-sentrux-*.json` (written by the iteration
+    loop when LOKI_SENTRUX_GATE=1), sorts by iteration ascending, and
+    returns a series suitable for plotting drift over time.
+
+    Per-file JSON parse errors are logged and skipped; the endpoint stays
+    200 OK even when no files exist or every file is corrupt.
+    """
+    base = _get_loki_dir()
+    state_dir = base / "state"
+    series: list[dict[str, Any]] = []
+    if state_dir.exists():
+        try:
+            paths = list(state_dir.glob("findings-sentrux-*.json"))
+        except OSError as exc:
+            logger.warning("sentrux: failed to glob %s: %s", state_dir, exc)
+            paths = []
+        for path in paths:
+            try:
+                text = path.read_text(encoding="utf-8", errors="replace")
+                data = json.loads(text)
+            except (OSError, IOError) as exc:
+                logger.warning("sentrux: skipping unreadable %s: %s",
+                               path.name, exc)
+                continue
+            except json.JSONDecodeError as exc:
+                logger.warning("sentrux: skipping corrupt JSON %s: %s",
+                               path.name, exc)
+                continue
+            if not isinstance(data, dict):
+                logger.warning("sentrux: skipping non-object payload in %s",
+                               path.name)
+                continue
+            try:
+                iteration = int(data.get("iteration"))
+                before = int(data.get("before"))
+                after = int(data.get("after"))
+            except (TypeError, ValueError) as exc:
+                logger.warning("sentrux: skipping %s, bad ints: %s",
+                               path.name, exc)
+                continue
+            verdict = data.get("verdict")
+            if verdict not in ("DEGRADED", "OK", "UNKNOWN"):
+                verdict = "UNKNOWN"
+            timestamp = data.get("timestamp")
+            if not isinstance(timestamp, str):
+                timestamp = ""
+            series.append({
+                "iteration": iteration,
+                "before": before,
+                "after": after,
+                "verdict": verdict,
+                "timestamp": timestamp,
+            })
+    series.sort(key=lambda e: e["iteration"])
+    current = series[-1]["after"] if series else None
+    return {"series": series, "current": current, "samples": len(series)}
+
+
 @app.get("/api/learnings")
 async def get_learnings(limit: int = 50):
     """Read recent learnings (newest first)."""