Principles of proving concurrent programs in Gypsy | Synapse