Paxos algorithm specified and proved in TLA+/PlusCal, with separate processes and invariants for proposers and acceptors.