Stokes
Autonomous Cross-Boundary Systems Invariant Verification Engine
Built on IBM Bob 2.0 | GitHub: yvliet
Overview
Stokes is a static analysis and runtime verification engine for detecting cross-boundary invariant violations in polyglot systems. It integrates with IBM Bob 2.0's multi-agent orchestrator to enforce architectural contracts across Rust, Python, SQL, and Protobuf codebases.
Installation
pip install stokes
Requires Python ≥ 3.11.
Quick Start
# Scan a workspace for boundary violations
stokes scan /path/to/workspace
# Run a full audit with remediation synthesis
stokes audit /path/to/workspace
# Verify invariants (CI/CD gate — non-zero exit on failure)
stokes verify --strict
# Emit the stokes.lock cryptographic boundary lockfile
stokes cert --output stokes.lock
Core Invariants Enforced
| Rule | Severity | Description |
|---|---|---|
| LINT-001 | FATAL ERROR | system.columns without database = currentDatabase() scoping |
| LINT-002 | FATAL ERROR | Unbounded ETL loop without [:MAX_CANONICAL] guard |
| LINT-003 | WARNING | Schema mesh broadcast without SHA-256 digest |
| LINT-004 | FATAL ERROR | .try_into().unwrap() on fixed-size stack buffer |
| LINT-005 | WARNING | Heap allocation on microsecond packet path |
Cardinality Risk Ratio
Risk = C_upstream / B_downstream
Risk <= 1.0 → INVARIANT SATISFIED
Risk > 1.0 → FATAL CONTRACT DRIFT
Key Contracts
- Wire Protocol: 4-byte big-endian length-prefixed frames, 16 MB max budget
- Float Sanitization: Reject NaN / ±Infinity / subnormals; clamp to [0.0, 100.0]
- Dual-Zone Memory: MAX_ACTIVE_FEATURES = 200 (Zone 0: slots 0–127 CORE RESERVED, Zone 1: slots 128–199 DYNAMIC ADAPTIVE)
- Event Bus:
asyncio.Queue(maxsize=1024), 16.6 ms render tick
License
MIT — Copyright © yvliet
Metadata
Release files for stokes 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| stokes-0.2.0.tar.gz | 14.0 kB | Without provenance | Details for stokes-0.2.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| stokes-0.2.0-py3-none-any.whl | Python 3 | none | any | Details for stokes-0.2.0-py3-none-any.whl |
Total release size: 16.6 kB
Release files / stokes-0.2.0.tar.gz
| Download URL | stokes-0.2.0.tar.gz |
|---|---|
| Size | 14.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d62380dc425da4c4a5dd96222cba5dff315821081a5bacc36bdca8ec69d4f409
|
|
BLAKE2b-256 checksum How to use checksums |
4d600ec34dfc9ab489d3bd946692dbe285c61160c0ae2506a0297e4e04039de6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.3
|
Release files / stokes-0.2.0-py3-none-any.whl
| Download URL | stokes-0.2.0-py3-none-any.whl |
|---|---|
| Size | 2.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
cff0f9a323dcf2cebbe0f61ad1bd2d442677add50ce8ef9fb56215be884c09ad
|
|
BLAKE2b-256 checksum How to use checksums |
56291c9e4e97adfd60f9b294f186b62912a0dee7f19b8bed6d3e0756ab9c9daa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.3
|
Security for stokes 0.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.