Verified runtime