Add reusable certificate and file validation helpers

Fix process-name ownership and module lookup outputs, add explicit SPKI hashing and bounded chain access, and improve WDM integration. Deprecate superseded entry points with migration guidance and align branch code and tests with the library style.

Add CI validation helpers with explicit signature selection and owned results

Document runtime-confirmed CI signer selection and crypto reuse

Expand CI compatibility matrix to twenty verified samples

Extend CI export matrix with Windows 11 x64 and ARM64 samples

Document CI API availability and historical mincrypt layouts

Add explicit Authenticode workflows and correct CI helper contracts

Document CI validation flag 0x20 and add kernel probe

Harden CI digest parsing and failure cleanup

include/Domito.MinCrypt.Historical.h

@@ -0,0 +1,120 @@
+/* Opt-in x64 chain views for exact observed Windows 10 CI artifacts.
+ * Include after ntddk.h. This does not alter Domito's default declarations.
+ * Select a view only after establishing the matching runtime layout from
+ * build/artifact evidence. ChainInfo->Size is TOTAL allocation size; it cannot
+ * identify the header version, because variable payload follows the header.
+ * See docs/mincrypt-contracts.md and NOTES.md for exact sampled versions/hashes.
+ */
+#pragma once
+#include "Domito.MinCrypt.h"
+
+#if !defined(_M_AMD64) && !defined(__x86_64__)
+#error Historical CI views are validated only for the documented x64 artifacts.
+#endif
+
+#pragma pack(push, 8)
+
+// Observed ci.dll 10.0.10240.16463. The variable payload begins at +0x38;
+// AuthenticodeAttributes does not exist at that offset in this header.
+typedef struct _DOMITO_CI10240_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements; // Constructor copies 120-byte elements; borrowed storage.
+    UINT32 NumberOfChainElements;
+    UINT32 RootId; // Opaque identifier, not PolicyBits.
+} DOMITO_CI10240_CHAIN_INFO, *PDOMITO_CI10240_CHAIN_INFO;
+
+// Observed ci.dll 10.0.10586.0. The variable payload begins at +0x48.
+typedef struct _DOMITO_CI10586_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements;
+    UINT32 NumberOfChainElements;
+    UINT32 RootId;
+    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
+} DOMITO_CI10586_CHAIN_INFO, *PDOMITO_CI10586_CHAIN_INFO;
+
+// Observed 10.0.14393.2189, 15063.0, 16299.125 and 17134.1130 x64.
+// The variable payload begins at +0x68. Constructor evidence establishes the
+// 32-byte extension's space, not its semantic contents on every sampled build.
+typedef struct _DOMITO_CI14393_CHAIN_INFO
+{
+    UINT32 Size;
+    MINCERT_BLOB* PublicKeys;
+    UINT32 NumberOfPublicKeys;
+    MINCERT_BLOB* EKUs;
+    UINT32 NumberOfEKUs;
+    PVOID ChainElements;
+    UINT32 NumberOfChainElements;
+    UINT32 RootId;
+    MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
+    UINT8 ReservedExtension[32];
+} DOMITO_CI14393_CHAIN_INFO, *PDOMITO_CI14393_CHAIN_INFO;
+
+#pragma pack(pop)
+
+C_ASSERT(sizeof(DOMITO_CI10240_CHAIN_INFO) == 56);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        PublicKeys
+    ) == 8
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        EKUs
+    ) == 24
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        ChainElements
+    ) == 40
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10240_CHAIN_INFO,
+        RootId
+    ) == 52
+);
+C_ASSERT(sizeof(DOMITO_CI10586_CHAIN_INFO) == 72);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10586_CHAIN_INFO,
+        RootId
+    ) == 52
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI10586_CHAIN_INFO,
+        AuthenticodeAttributes
+    ) == 56
+);
+C_ASSERT(sizeof(DOMITO_CI14393_CHAIN_INFO) == 104);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI14393_CHAIN_INFO,
+        RootId
+    ) == 52
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI14393_CHAIN_INFO,
+        AuthenticodeAttributes
+    ) == 56
+);
+C_ASSERT(
+    FIELD_OFFSET(
+        DOMITO_CI14393_CHAIN_INFO,
+        ReservedExtension
+    ) == 72
+);