refactor Coq proofs into separate modules