Dragon's Egg: a formally verified, distributed object-capability OS