Program Proof Architecture