Definition program_proved (p: program) :=
exists G, semax_func G p G
/\ table_get G 0 = Some  (0::nil, fun s => allocpool (eval (Var 0) s)).

Axiom semax_go:  forall vars G (P: funspec) x ys,
typecheck vars (Go x ys) = true ->
semax vars G (fun s => cont P (eval x s) && call P (eval_list ys s)) (Go x ys) .