Promise network primitives using lightweight formal methods (Alloy)