Coq proofs of validity of ILP clustering algorithm