Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

Add CI validation helpers with explicit signature selection and owned results

Document runtime-confirmed CI signer selection and crypto reuse

Expand CI compatibility matrix to twenty verified samples

Extend CI export matrix with Windows 11 x64 and ARM64 samples

Document CI API availability and historical mincrypt layouts

Add explicit Authenticode workflows and correct CI helper contracts

Document CI validation flag 0x20 and add kernel probe

Harden CI digest parsing and failure cleanup

README.md

@@ -24,12 +24,28 @@ Built for and tested on **Windows 10 version 1507 (or newer) x64/ARM64**. 32-Bit
   - I do not want to force any consumer of the library to drag C++ paradigms into their project. I do expect the user to utilize a modern compiler though, so the library sources themselves may have some 'C++-ish touches' here and there, for my own convenience 😉
 - Compatibility with every Windows 10 version.
   - APIs not available on older builds will give you a `STATUS_NOT_IMPLEMENTED` instead of hard-linking and therefore making your driver fail to load 🤞
-    - **Caution:** this claim comes with an asterisk though; due to PatchGuard (or some other security mechanism) I couldn't get run-time dynamic linking for `ci.dll` exports to work, so you need to actively avoid implementing code depending on exports that do not exist on earlier versions of Windows. Once I have a compatibility matrix for all of them I'll update the documentation accordingly.
+    - CI entry points are currently static imports from `ci.lib`; consumers must avoid imports unavailable on their target Windows builds. The [CI API compatibility matrix](docs/ci-api-compatibility.md) records all ten named exports across 20 exact Windows 10/11 x64 and ARM64 CI files. Export lookup uses the correct name-ordinal mapping and rejects forwarders. Runtime ABI verification remains separate; see the remaining-work ledger below.
 - No conflicts with WDF or DMF
   - The consuming driver *may* (but doesn't have to) utilize Microsoft WDF or DMF in addition without having to fear any incompatibilities 💪
 - Reliable SAL annotations.
   - I made sure to enrich the majority of the code with correct, tested annotations for Code Analysis to help you spot potential accidental API misuse 😎
 
+## Authenticode validation helpers
+
+The [CI validation helpers](docs/ci-validation-helpers.md) provide shared result
+ownership/cleanup, file-object validation with explicit selection policy, and
+algorithm-explicit embedded verification using CI. First-success selection is
+an opt-in x64 experiment; existing APIs retain their behavior. Always enforce
+the expected signer/trust policy separately from a successful CI return status.
+
+## Consumer helpers
+
+[Migration and contracts](docs/consumer-helpers.md) cover file-handle/path CI
+validation, bounded x64 chain views, optional publisher-name extraction,
+certificate/SPKI hashing (including explicit legacy content-only pins), strict
+hex conversion, process-name cleanup and combined module/export lookup.
+Application authorization and trust policies remain caller-provided.
+
 ## How to use
 
 - Add the `include` directory to your project's headers search path.
@@ -55,7 +71,11 @@ Built for and tested on **Windows 10 version 1507 (or newer) x64/ARM64**. 32-Bit
 
 ### Using the property sheet
 
-Copy the provided `Domito.props` file into the directory of your `.vcxproj` file and customize it like below:
+Import `Domito.props` from the Domito package, or set `DomitoRootPath` explicitly
+if copying the sheet elsewhere. Its default root is its own directory. The sheet
+links both WDM and KMDF final drivers; static-library consumers must also import
+it into the final driver project. `DomitoLibraryPlatform` defaults to `$(Platform)`.
+For example:
 
 ```xml
   <!-- The rest of the project file -->
@@ -71,6 +91,14 @@ Copy the provided `Domito.props` file into the directory of your `.vcxproj` file
   <!-- The rest of the project file -->
 ```
 
+## Code Integrity API notes
+
+- [Algorithm-explicit Authenticode hashing and legacy catalog policy](docs/authenticode-digests.md)
+- [Mincrypt contracts, lifetimes, flags and opt-in x64 26100 layouts](docs/mincrypt-contracts.md)
+- [Implemented corrections and remaining VM/binary work](docs/implementation-status.md)
+
+- [CiValidateFileObject flag 0x20: evidence, limitations, and kernel test procedure](docs/ci-validate-file-object.md)
+
 ## Sources & 3rd party credits
 
 This library benefits from these awesome projects ❤ (appearance in no special order):