Principles of proving concurrent programs in Gypsy