naive random thought:
#FramaC and the like should not need human interaction and be able to always check automatically that the post-conditions follow from pre-conditions -- it's proof checking (the C code is the proof term), not search (for which there may be no generic algorithm)
well actually no: this proof term (C code) is only concerned with the explicit arguments (passed as C function arguments) and ignores the implicit hypotheses (pre-conditions); what's more important is that this function returns only the C value and not Cartesian product (dependent sum) of it with the post-conditions
the dependence of the post-conditions on the pre-conditions, the C function arguments, and the result is yet to be constructed, e.g.
forall x, A x -> exists y, B x y
A x is the pre-condition, B x y is the post-condition, x is input argument, and y is the result of C function
y_t f (x_t x) { ... }
f alone isn't enough to build a term of type B x y
to be even more specific, let x_t and y_t be uint8_t, f be increment by one, A x be x < 255, and B x y be x < y