Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

Add CI validation helpers with explicit signature selection and owned results

Document runtime-confirmed CI signer selection and crypto reuse

Expand CI compatibility matrix to twenty verified samples

Extend CI export matrix with Windows 11 x64 and ARM64 samples

Document CI API availability and historical mincrypt layouts

Add explicit Authenticode workflows and correct CI helper contracts

Document CI validation flag 0x20 and add kernel probe

Harden CI digest parsing and failure cleanup

docs/implementation-status.md

@@ -0,0 +1,127 @@
+# CI SDK implementation status
+
+This ledger tracks the source audit S01–S18 and the remaining binary research.
+The original CodeIntegrity-RE audit remains a snapshot of commit `7985b23`;
+it should not be read as describing the corrected source unchanged.
+
+## Implemented with host tests or compilation
+
+- Additive CI result/selection helpers now package native file-object validation,
+  opt-in x64 first-success selection and explicit embedded verification, with
+  shared policy/digest cleanup. Existing APIs retain their behavior. See the
+  [helper contracts](ci-validation-helpers.md). Host failure/forwarding tests and
+  x64/ARM64 builds cover the wrappers; WPP probe v2 consumes them and awaits a
+  returned kernel trace. The previous v1 trace establishes the raw native routes.
+
+- **S01–S04:** subtraction-safe PE ranges, no fixed 4 MiB copy, bounded certificate
+  intervals, deterministic failure outputs, and digest cleanup. Compatibility
+  and explicit paths share the bounded hashing core.
+- **S05:** actual certificate read length checked; allocation bounded against
+  file size; per-operation completion waits through the exact-read helper.
+- **S06:** `DomitoReadFileAt` uses an explicit offset and private kernel event;
+  `DomitoReadFile` reads exactly from offset zero. Pending completion cannot
+  outlive its stack state or caller buffer. Short reads return EOF.
+- **S10:** export lookup uses the name ordinal to index the EAT, bounds tables,
+  names and resolved RVAs, and rejects forwarders. A valid loader-mapped module
+  remains a precondition because the API has no externally supplied image size.
+- **S11–S12:** corrected policy pointer typedef and publisher return/ownership docs.
+- **S14:** policy cleanup before embedded/catalog/reload retries, with host tests
+  allocating results even on failures. Real CI failure ownership still needs
+  the VM tests below.
+- **S17:** legacy hash algorithm/length combinations validated and calculation
+  versus verification capabilities documented.
+- **S18:** byte-count SAL, buffer-capacity rules, scalar input annotations, and
+  kernel read context/APC requirements documented.
+
+## Implemented within an explicit support boundary
+
+- **S07:** new bounded DER discovery reads the first outer SPC file-digest
+  AlgorithmIdentifier; new explicit digest API needs no discovery. The old
+  heuristic entry point retains compatibility behavior. Arbitrary BER, nested
+  signatures, and full signature enumeration remain outside this parser.
+- **S08:** unsigned/catalog-only files can be hashed with a caller-chosen
+  SHA-1 or SHA-256 strategy. The policy-explicit legacy helper forwards catalog
+  controls and reports the successful source. Real catalog lookup comparisons
+  across OS versions are pending; no implicit algorithm retry policy is imposed.
+- **S09:** the explicit digest path enforces a contiguous raw-section subset and
+  EOF certificate tables, with Windows SIP and real embedded-digest comparisons.
+  Gaps, overlaps, missing directory slots and nonterminal certificates are
+  rejected. The old linear compatibility entry point is not a universal hasher.
+- **S13/S15/S16:** recovered fields, parameter meanings, policy categories, sizes,
+  name encoding, borrowed lifetimes, and allocator ownership are documented.
+  The opt-in x64 26100 header provides distinct observed layouts and assertions.
+  Default declarations retain source compatibility; later chain fields require
+  a confirmed runtime layout. The sampled 1507 chain header is 56 bytes and has
+  no attributes descriptor at +0x38; 1511 uses 72 bytes; 1607–1803 samples use 104.
+  Distinct views are available in `Domito.MinCrypt.Historical.h`. Neither
+  `NTDDI_VERSION` nor total allocation Size identifies the layout.
+
+## Requires the test VM or additional matching binaries
+
+The first user-run kernel trace is available for Windows 11 22631 x64 with
+TESTSIGNING enabled. It confirms the BthPS3 signer-selection comparison and
+primary-signature CI path below. That one run, extracted artifacts, host mocks
+and compilation do not close the remaining work:
+
+1. Run the paired `CiValidateFileObject` flag `0`/`0x20` probe on 19041/19045
+   with TESTSIGNING off and a loadable signed test driver. Preserve complete
+   statuses, policies and fixture/environment identities (issue #3).
+2. Complete historical and ARM64 ABI/structure verification and runtime tests.
+   The [published export matrix](ci-api-compatibility.md) now covers all ten
+   named APIs across 20 exact Windows 10/11 x64 and ARM64 CI files.
+   ISO coverage includes Windows 10 1809/1903 revisions, 1909, 21H2/22H2 ARM64,
+   and Windows 11 23H2 x64 plus 22H2/24H2 ARM64.
+   The ARM64 observations establish export presence; their structure layouts
+   and runtime behavior remain unverified. This closes the initial export-presence
+   matrix; additional releases, servicing revisions and architectures remain
+   unsampled. It does not certify ABI or runtime behavior. The six 1507–1803
+   sampled bodies establish the
+   48-byte policy storage and 64-byte hash-capacity gate. Chain constructors
+   establish 56/72/104-byte headers; opt-in views prevent treating 1507 payload
+   as the later attributes descriptor. Unsampled layouts/runtime remain open.
+3. Test real CI policy ownership on every failure/retry path under Driver
+   Verifier, including allocation failures and initialized outputs.
+4. Compare real embedded/catalog-only SHA-1/SHA-256 results, catalog cache/reload
+   behavior, trust-mask choices, requested signing levels and flag combinations.
+5. Measure signing-time propagation, zero/sentinel values, timestamp expiry,
+   revocation freshness/network policy and weak-crypto policy. Record OS policy,
+   Secure Boot/HVCI/WDAC and exact files, not just a boolean result.
+6. Extend the observed multiple/nested selection result beyond the first run.
+   On Windows 11 22631 x64 with TESTSIGNING enabled, `0x20` returns Microsoft;
+   `0xA0` and direct primary SHA-256 `CiCheckSignedFile` return Nefarius with the
+   same signing time and matching signer/timestamp policy observations. All
+   calls and policy statuses succeed, the file snapshots match, and no trace
+   events are lost. TESTSIGNING-off, general enumeration, full `0x80` semantics
+   and cross-build/policy behavior remain open. Extend supported PE gaps/overlays
+   only after differential evidence.
+7. Resolve page-hash allocation destruction, normalized-entry/truncation meaning,
+   terminal-entry handling and cross-version layouts before publishing a general
+   page-hash API. `CiFreePolicyInfo` is not an established destructor for it.
+8. Investigate protected-media/initialization and ordinal-only exports separately
+   if they are needed. Recovered export names alone are insufficient contracts.
+
+## Checks
+
+Run the six host runners in `tests/README.md`. Kernel compilation also covers
+the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant,
+and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks,
+not a claim that historical or ARM64 CI runtime ABI has been verified.
+
+## Consumer-driven helpers
+
+The [consumer migration review](consumer-helpers.md) separates verified defects,
+existing corrections, new helpers and downstream policy. Additions include
+handle/path native CI wrappers, explicit SPKI representation/hash helpers,
+strict hex conversion, an explicit-layout x64 chain view, optional publisher
+resolution with matching cleanup, a referenced-process name API and dedicated
+process-name cleanup. The PID path fixes dangling failure output and excessive
+process access; module-base lookup clears stale output. WDM/KMDF linking is
+covered by the package-relative property sheet. No default publisher/root trust
+policy, automatic legacy fallback, or process authorization/cache is introduced.
+
+Four compatibility functions carry MSVC deprecation annotations with explicit
+migration messages: heuristic digest-kind discovery, compatibility PE hashing,
+implicit-policy legacy validation and PID-based process-name lookup. Native CI
+types/functions remain available for low-level callers. The compile-only
+deprecation suite checks actual public headers in C/C++, including modern API
+controls and expected C4996 diagnostics for each older entry point.