A safety-critical avionics project requires the most rigorous form of review for its requirements specification. The review must include defined roles, formal entry and exit criteria, metrics collection, and a trained moderator. Which review type should be selected?