Verified symbolic execution with Kripke specification monads (and no meta-programming)