A proof assistant checks your spec against your code — it can’t check that your spec means what you think it means. Full article coming soon.