Current trends in software engineering promote the contention that the use of model-driven approaches should prove as beneficial to high-integrity systems as they have to business applications. Unfortunately, model-driven approaches as they presently stand focus more on attaining greater extents of automation than on warranting absolute end-to-end correctness for the target development process. This paper presents some elements of a novel approach that centres on a correctness-by-construction philosophy rooted on a domainspecific metamodel designed to formally define and constrain the design space and prove the allowable model transformations down to automated code generation.