Thank you. I took a look at both and while stateright seems to check/derive implementation against the spec, antithesis rather seems to do testing instead of verification.