Stokes: Verify where compilers stop.

Problem: Distributed systems rarely break because of isolated syntax bugs. They break at the untyped boundaries between languages and services. Individual compilers work in silos: SQL linters check query syntax, Python type checkers validate dictionary keys, and Rust compilers enforce memory safety. None of them inspect what happens when data crosses between them. The November 18, 2025 Cloudflare outage is a clear example of this failure mode (which I modeled in Stokes' Cloudflame testbed). An unscoped ClickHouse schema query accidentally matched internal shard replica tables, expanding emitted column metadata from 200 to 280 fields. Upstream Python workers serialized all 280 items into dynamic payloads. Downstream, the L7 edge proxy decoded this payload on its packet processing hot path into a fixed stack array ([Feature; 200]) to maintain zero heap allocations and sub-microsecond latency. Converting the 280-element slice via .try_into().unwrap() failed with TryFromSliceError, panicking worker threads and taking down edge proxies worldwide. Every compiler passed in isolation, yet the system crashed at runtime. Solution: Stokes is a cross-boundary verification engine and CI gate. It parses Abstract Syntax Trees across SQL, Protobuf, Python, and Rust using Tree-sitter queries, maps producer-consumer dependencies into a directed reachability graph, and evaluates linear capacity constraints (N_produced <= C_consumed). It catches schema drift before code gets committed, generates reproducible lockfiles (stokes.lock) via normalized AST hashing, and synthesizes zero-allocation fixes. Target Users & Workflow: Stokes is built for platform engineers and infrastructure teams maintaining polyglot pipelines where data stores feed high-performance proxies or workers. Teams use it in three ways: 1. Fast CI Gate: Running `stokes check` in pull request pipelines blocks merges in under 38 ms if upstream schemas exceed downstream buffer sizes. 2. CLI Audits: Developers run `stokes audit` locally to inspect boundary violations and view reachability graphs. 3. Native MCP Server: IDE agents in IBM Bob, Cursor, and Claude Desktop connect to `stokes mcp` over stdio JSON-RPC to inspect and fix boundaries during development. Why Nothing Else Exists Like This: Existing tools cannot solve this architectural gap: - Compilers are monolingual: rustc cannot inspect ClickHouse queries, and sqlfluff cannot inspect Rust buffers. Both report passing exit codes. - IDLs compile to unbounded heap memory: Protobuf repeated fields compile to heap vectors (Vec<T>), which are forbidden on microsecond-latency L7 packet paths. In Cloudflame, an 88-byte struct with 3 heap Strings requires 17.6 KB and 600 pointer dereferences for 200 items, saturating 53.7% of an L1 data cache. Stokes enforces 8-byte Copy FeatureDescriptors (1.6 KB, 4.8% L1D occupancy). - Contract testing is dynamic: Tools like Pact run slow integration HTTP mocks. Stokes statically evaluates C_upstream / B_downstream across heterogeneous ASTs in under 38 ms. - Zero-Allocation Remediation: In Criterion micro-benchmarks, Stokes' synthesized in-place Quickselect runs in 7.66 ns vs 29.74 ns for heap vector sorting (3.9x faster) with strictly 0 bytes heap allocation.