Anatomy of a Formal Proof