What I’m wondering about is why we don’t need to understand/verify the generated kernel and only the spec?
Is there an implicit trust we must put in that kernel?
Is there an implicit trust we must put in that kernel?
Then you know that the statement in the file you reviewed holds about that function.