Add initial draft of Remora model

docs/protocol/Remora.cfg

@@ -0,0 +1,39 @@
+SPECIFICATION Spec
+
+CHECK_DEADLOCK FALSE
+
+\* Fault/recovery and temporal-property configuration.
+CONSTANTS
+    Jobs = {j1}
+    Workers = {w1, w2}
+    InitialWorkers = {w1}
+    NoJob = NoJob
+    NoWorker = NoWorker
+    MaxAttempts = 2
+    MaxProgress = 1
+    LeaseLimit = 1
+    LocalLimit = 1
+    GlobalLimit = 1
+    FaultsEnabled = TRUE
+    FaultServices = {"Coordination"}
+
+INVARIANTS
+    TypeOK
+    StateConsistency
+    AtMostOneAuthoritativeAttempt
+    FencingTokensUnique
+    CommittedResultConsistent
+    CancellationSafety
+    PermitSafety
+    QueueRecoverable
+    AttemptIsolation
+    ResumeValidity
+    ZombieIsolation
+
+PROPERTIES
+    TerminalStateIsImmutable
+    FencingTokensMonotonic
+    CommitIsFencedCAS
+    AtLeastOnceDelivery
+    EventuallyReaped
+    EventuallyTerminal