330,000 lines of machine-checked proofs in Isabelle/HOL verify that the Nitro Isolation Engine correctly enforces confidentiality, integrity, and memory safety between EC2 virtual machines on Graviton5.