machine-checked proofs