3 ms·

There's also agda and coq, at various points on the spectrum between programming language and theorem prover.