That’s true, but the theorem prover still needs a model of your code to check the theorem against. So how do we know it’s checking the theorems against an accurate model.