proven correct with a mechanically verifiable proof is an L4 variant seL4, which is microkernel of course http://www.sigops.org/sosp/sosp09/papers/klein-sosp0

proven correct with a mechanically verifiable proof is an L4 variant seL4, which is microkernel of course http://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf http://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf