IronFleet: Proving Practical Distributed Systems Correct [pdf]research.microsoft.com2 pointspron10 years ago