A green formal result is not tape-out evidence when an AI-authored SystemVerilog assertion has not been tested for whether it constrains a reachable design. As AI can make SVA easier to author, verification teams need a way to decide which proofs belong in a sign-off file and which need human review.
That is the problem behind Proof Firewall, our runnable demonstration of a post-proof governance gate. It does not replace a formal engine. It re-audits an engine result for vacuity, assertion strength, and cone of influence (COI), then routes the result by policy.
The industry context makes the distinction consequential. The 2024 Wilson Research Group / Siemens EDA study cited in our demo specification reported 14% first-silicon success. We are not presenting that figure as a measurement of assertion quality or as a prediction for any team. It does clarify why sign-off evidence deserves scrutiny rather than a wider definition of green.
A formal proof should be governed before it is filed for tape-out sign-off.
Green is a solver result, not a review decision
The formal engine answers a precise question about a property and a model. A sign-off review has a broader question: did that property test a reachable behavior, resist a relevant broken variant, and leave enough evidence for another engineer to inspect the decision?
Those questions remain after the assertion author changes. A fixture-authored “LLM-authored” assertion in our synthetic transition-system IR can be syntactically valid and engine-PROVEN while still being vacuous or weak. In a production direction, the same governance layer would sit around an existing formal workflow as an engine-agnostic gate. That direction does not claim an adapter or RTL ingest in this demo.
The synthetic Tape-Out Sign-Off Board changes from 8/8 PROVEN in the bare flow to 5/8 certified TRUSTWORTHY after the governance audit.
The result is deliberately uncomfortable. On the demo's fixed synthetic board, the bare flow shows 8/8 PROVEN. Proof Firewall certifies 5/8 TRUSTWORTHY, withholding one VACUOUS and two WEAK properties for human review. That 5/8 figure is proof-quality coverage for this fixed synthetic fixture, not a production result, a customer result, or a rate for AI-authored assertions generally.
One proof that proves nothing useful
ARB3 is the concrete catch that makes the case. Its assertion is assert (g0 && g1) |-> (turn == 0). In the synthetic arbiter, the antecedent g0 && g1 is unreachable. The implication can therefore be proven even though it never constrains the behavior it appears to address.
That condition is vacuity: not a syntax error or a solver failure, but a proof whose precondition never fires.
The round-robin arbiter view marks ARB3 VACUOUS: the g0 && g1 antecedent is unreachable in the synthetic fixture.
This is why quality has to be decided outside the assertion author. An AI author can propose the property. A formal engine can establish the implication. Neither event establishes that the implication was meaningful for sign-off. Our gate checks reachability before it accepts the proof as defensible evidence.
The other failure shapes belong to the same review discipline. PIPE3 uses a tautological consequent and is WEAK; the synthetic CDC property CDC2 is also WEAK. A strengthened CDC property becomes VIOLATED and produces a concrete counterexample waveform. We do not treat a returned green status as a substitute for these checks.
Mutation testing asks what the assertion would catch
Reachability catches one empty proof. It cannot establish that an assertion has enough bite. For that, Proof Firewall runs relevant single-point design mutations and records whether the property kills them.
For the featured weak pipeline case, PIPE3 has a 0/6 mutation-kill result. Its consequent, s2 == s2, is tautological, so relevant broken variants survive it. A property can look like a specific pipeline rule while imposing no useful constraint on the design.
COI adds a third check: whether the property meaningfully touches the design signals it is supposed to constrain. Together, reachability, mutation kill-testing, and COI give the policy gate a basis for the labels TRUSTWORTHY, VACUOUS, WEAK, DEAD, BOUNDED-PROVEN, or VIOLATED.
AI can help author assertions. A reviewable policy should decide which proof results are defensible enough to file.
The receipt belongs with the decision
The governance decision has to survive the meeting in which someone asks why a result was certified or withheld. Proof Firewall exports signoff_certificate.json with the per-property verdicts, reachability, mutation results, COI, counterexample records where applicable, and a SHA-256 field. Only TRUSTWORTHY results receive a signed demonstration certificate; the other outcomes are withheld with a reason.
After the synthetic audit is adjudicated, the board exposes the Export Certificate action for the structured demonstration record.
This is a demonstration, not a replacement for JasperGold, VC Formal, Questa Formal, SymbiYosys, or any other formal engine. Its default path uses fixture-authored synthetic transition-system designs and properties, with no customer RTL, GDSII, cloud solver, or API key. The bundled local benchmark classifies 18/18 fixed labeled synthetic items correctly and identifies 6 proofs that the demo's ungated bare-flow baseline would have labeled PROVEN. Those numbers establish the demo's behavior only within that stated synthetic scope.
The fixed labeled synthetic benchmark reports 18/18 cases matched and 6 proofs that the demo's ungated bare-flow baseline would have signed off.
We built Proof Firewall to make the decision boundary inspectable: the optional SVA author proposes, then the model checker and governance policy decide. The demo is available to inspect the 8/8-to-5/8 audit reversal, the ARB3 vacuity finding, and the certificate record. Verification leaders defining an AI-assisted SVA review process can compare proof-review artifacts with us: which fields must be retained for reachability, mutation results, COI, and the policy decision before a result enters the sign-off file?