seL4 specification and proofs