Gravar-mail: Toward Formal Models and Languages for Verifiable Multi-Robot Systems