Evidence without review is filing, not signoff. Waivers are reviewed by people with the standing to reject them, scoped so narrowly that reuse requires a new review, and tied to a design revision so that change re-opens them automatically. This lesson defines the reviewers, the scope rules, and the expiry machinery.
Reviewer | Role in the review | Can approve alone? |
|---|---|---|
Design owner | Confirms the protocol argument matches the real design intent | No |
Verification or signoff owner | Confirms the evidence actually demonstrates the argument | No |
Both together | Joint approval records that intent and evidence agree | Yes — this is the only approval |
The design owner cannot approve alone because they are grading their own assumption; the signoff owner cannot approve alone because they cannot confirm intent. Joint approval is the whole point of the meeting.
One waiver covers one finding on one instance: never a class, a module, or a bus en bloc.
The waiver names the design revision it was reviewed against; a new revision re-opens it for confirmation, not automatic renewal.
The waiver names the change that kills it — typically any RTL, constraint, or clocking change touching the crossing — so expiry is a decision made at review time, not in a crisis.
Mode-limited waivers (test-only, debug-only) name the mode and the mechanism that enforces it.
Expiry is administrative, not personal: when the named revision is superseded, the waiver returns to the open list until someone confirms the argument still holds on the new revision. This is deliberately annoying — the friction is what stops waivers surviving changes they were never reviewed against. The dashboard tracks waiver age and revision currency so stale waivers are visible before they are dangerous.
The waiver was scoped to revision C and should have re-opened on the change. Carrying it forward treated a revision-tied permission as permanent.
Design confirms the argument matches intent; signoff confirms the evidence demonstrates the argument. Either alone leaves one half of the claim unchecked.