Provably correct reactive control from natural language