Anvil: Verifying Liveness of Cluster Management Controllers

Summary of Anvil: Verifying Liveness of Cluster Management Controllers Wouldn’t it be nice to write some software and confidently say that you know it’s right? That, as long as some assumptions about the world hold, it’s going to do exactly what you want it to, no matter what strange permutations or combinations of failures happen. In broad strokes that’s the promise of formal verification and…