feat: formal verification suite — TLA+ specs for Raft, 2PC, MVCC, Replication

Verified with TLC model checker:
- Raft: 475k states, ElectionSafety + StateMachineSafety
- 2PC: 22k states, Atomicity + NoOrphanBlocks
- MVCC: 177k states, NoDirtyReads + ReadOwnWrites + WriteWriteConflict
- Replication: 3.6M states, MonotonicLsn + AcksRemovePending

formal-verification/models/mvcc.cfg

@@ -0,0 +1,16 @@
+CONSTANTS
+  Keys = {k1, k2}
+  Values = {v1, v2}
+  Nil = Nil
+  MaxTxnId = 2
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  NoDirtyReads
+  ReadOwnWrites
+  WriteWriteConflict

formal-verification/models/raft.cfg

@@ -0,0 +1,15 @@
+CONSTANTS
+  Nodes = {n1, n2, n3}
+  Nil = Nil
+  MaxTerm = 3
+  MaxLogLen = 3
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  ElectionSafety
+  StateMachineSafety

formal-verification/models/replication.cfg

@@ -0,0 +1,17 @@
+CONSTANTS
+  Replicas = {r1, r2, r3}
+  MaxLsn = 3
+  MaxSyncCount = 2
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  AcksRemovePending
+  PendingAreKnown
+
+PROPERTIES
+  MonotonicLsn

formal-verification/models/twopc.cfg

@@ -0,0 +1,14 @@
+CONSTANTS
+  Participants = {p1, p2, p3}
+  Nil = Nil
+  MaxTxnId = 2
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  Atomicity
+  NoOrphanBlocks