Extend CI export matrix with Windows 11 x64 and ARM64 samples

NOTES.md

@@ -1,7 +1,7 @@
 # CI API availability observations
 
 See the [CI API compatibility matrix](docs/ci-api-compatibility.md) for the
-per-API tables covering all ten VM, ISO and modern x64 samples, with exact
+per-API tables covering thirteen VM, ISO and modern x64/ARM64 samples, with exact
 versions, file hashes and machine-readable results. The six-sample notes below
 describe the original VM corpus and its subsequent ISO follow-up.
 

README.md

@@ -24,7 +24,7 @@ Built for and tested on **Windows 10 version 1507 (or newer) x64/ARM64**. 32-Bit
   - I do not want to force any consumer of the library to drag C++ paradigms into their project. I do expect the user to utilize a modern compiler though, so the library sources themselves may have some 'C++-ish touches' here and there, for my own convenience 😉
 - Compatibility with every Windows 10 version.
   - APIs not available on older builds will give you a `STATUS_NOT_IMPLEMENTED` instead of hard-linking and therefore making your driver fail to load 🤞
-    - CI entry points are currently static imports from `ci.lib`; consumers must avoid imports unavailable on their target Windows builds. The [CI API compatibility matrix](docs/ci-api-compatibility.md) records all ten named exports across ten exact Windows 10/11 x64 CI files. Export lookup uses the correct name-ordinal mapping and rejects forwarders. Runtime ABI verification remains separate; see the remaining-work ledger below.
+    - CI entry points are currently static imports from `ci.lib`; consumers must avoid imports unavailable on their target Windows builds. The [CI API compatibility matrix](docs/ci-api-compatibility.md) records all ten named exports across thirteen exact Windows 10/11 x64 and ARM64 CI files. Export lookup uses the correct name-ordinal mapping and rejects forwarders. Runtime ABI verification remains separate; see the remaining-work ledger below.
 - No conflicts with WDF or DMF
   - The consuming driver *may* (but doesn't have to) utilize Microsoft WDF or DMF in addition without having to fear any incompatibilities 💪
 - Reliable SAL annotations.

docs/ci-api-compatibility.json

@@ -1,9 +1,9 @@
 {
   "schema_version": 1,
-  "scope": "Observed named PE exports in exact x64 ci.dll samples; not runtime or ABI certification",
+  "scope": "Observed named PE exports in exact architecture-specific ci.dll samples; not runtime or ABI certification",
   "generated_from": {
     "corpus-index.json": "c324dddaa4b88e66eb119e2ce26023face3763fb68d496d6285b836a60d267f8",
-    "iso-corpus-index.json": "1b5f95e4ef2eb6aa6e7d0414cd5a899426ff7092e1ef8afb65f3b50f958bc6dc",
+    "iso-corpus-index.json": "97da9e94d30854f6480429becfff34efe5b5f978a772e0113b54b9f655d8c325",
     "manifest.json": "7712d6e88b81ac155bd1371ada61df2848e943a12abe709b7b2050ce4b91c6e5",
     "ci-26100.8328-evidence.json": "ea0f939df9d8b7abde40e3402c01b2ac398253728f329e8c2b7134de8df6305f"
   },
@@ -298,6 +298,38 @@
         "CiVerifyHashInCatalog": true
       }
     },
+    {
+      "label": "Windows 11 23H2 English ISO",
+      "ci_file_version": "10.0.22621.2792",
+      "architecture": "x64",
+      "sha256": "9ed77b8a53946ced8c3540edb26a765060dff908544634e7b069aa49f2b41559",
+      "source": "iso-corpus-index.json",
+      "named_exports": [
+        "CiCheckSignedFile",
+        "CiFindPageHashesInCatalog",
+        "CiFindPageHashesInSignedFile",
+        "CiFreePolicyInfo",
+        "CiGetCertPublisherName",
+        "CiGetPEInformation",
+        "CiInitialize",
+        "CiSetTrustedOriginClaimId",
+        "CiValidateFileObject",
+        "CiVerifyHashInCatalog"
+      ],
+      "ordinal_only_export_count": 3,
+      "api_presence": {
+        "CiCheckSignedFile": true,
+        "CiFindPageHashesInCatalog": true,
+        "CiFindPageHashesInSignedFile": true,
+        "CiFreePolicyInfo": true,
+        "CiGetCertPublisherName": true,
+        "CiGetPEInformation": true,
+        "CiInitialize": true,
+        "CiSetTrustedOriginClaimId": true,
+        "CiValidateFileObject": true,
+        "CiVerifyHashInCatalog": true
+      }
+    },
     {
       "label": "Windows 11 24H2 sample",
       "ci_file_version": "10.0.26100.8328",
@@ -329,6 +361,70 @@
         "CiValidateFileObject": true,
         "CiVerifyHashInCatalog": true
       }
+    },
+    {
+      "label": "Windows 11 22H2.9 ARM64 ISO",
+      "ci_file_version": "10.0.22621.1702",
+      "architecture": "ARM64",
+      "sha256": "4164ac08fd19628c5ab6cbca6234265ac2bf7f39d5149f57d3845646d8a8ad60",
+      "source": "iso-corpus-index.json",
+      "named_exports": [
+        "CiCheckSignedFile",
+        "CiFindPageHashesInCatalog",
+        "CiFindPageHashesInSignedFile",
+        "CiFreePolicyInfo",
+        "CiGetCertPublisherName",
+        "CiGetPEInformation",
+        "CiInitialize",
+        "CiSetTrustedOriginClaimId",
+        "CiValidateFileObject",
+        "CiVerifyHashInCatalog"
+      ],
+      "ordinal_only_export_count": 3,
+      "api_presence": {
+        "CiCheckSignedFile": true,
+        "CiFindPageHashesInCatalog": true,
+        "CiFindPageHashesInSignedFile": true,
+        "CiFreePolicyInfo": true,
+        "CiGetCertPublisherName": true,
+        "CiGetPEInformation": true,
+        "CiInitialize": true,
+        "CiSetTrustedOriginClaimId": true,
+        "CiValidateFileObject": true,
+        "CiVerifyHashInCatalog": true
+      }
+    },
+    {
+      "label": "Windows 11 24H2 ARM64 ISO",
+      "ci_file_version": "10.0.26100.1591",
+      "architecture": "ARM64",
+      "sha256": "a0eba64a9a3f2006d5832079412eca42cc1b9ed66d19b9b0adb7e59ea354415d",
+      "source": "iso-corpus-index.json",
+      "named_exports": [
+        "CiCheckSignedFile",
+        "CiFindPageHashesInCatalog",
+        "CiFindPageHashesInSignedFile",
+        "CiFreePolicyInfo",
+        "CiGetCertPublisherName",
+        "CiGetPEInformation",
+        "CiInitialize",
+        "CiSetTrustedOriginClaimId",
+        "CiValidateFileObject",
+        "CiVerifyHashInCatalog"
+      ],
+      "ordinal_only_export_count": 3,
+      "api_presence": {
+        "CiCheckSignedFile": true,
+        "CiFindPageHashesInCatalog": true,
+        "CiFindPageHashesInSignedFile": true,
+        "CiFreePolicyInfo": true,
+        "CiGetCertPublisherName": true,
+        "CiGetPEInformation": true,
+        "CiInitialize": true,
+        "CiSetTrustedOriginClaimId": true,
+        "CiValidateFileObject": true,
+        "CiVerifyHashInCatalog": true
+      }
     }
   ]
 }

docs/ci-api-compatibility.md

@@ -1,6 +1,7 @@
 # CI API compatibility matrix
 
-This matrix records **named export presence in ten exact x64 `ci.dll` files**.
+This matrix records **named export presence in 13 exact `ci.dll` files**,
+with architecture stated separately for each sample.
 **Yes** means the complete PE export directory contains the name; **No** means
 it does not. Neither result is inferred from a header, import library or PDB.
 Export presence alone does not establish a compatible ABI or successful verification.
@@ -12,7 +13,7 @@ Do not extrapolate a cell to every servicing revision of that Windows release.
 [Machine-readable matrix](ci-api-compatibility.json) includes exact SHA-256 identities,
 all per-API results and hashes of the retained source inventories.
 
-## Windows 10 1507–1803 samples
+## Windows 10 1507–1803 x64 samples
 
 | API | 10240.16463 | 10586.0 | 14393.2189 | 15063.0 | 16299.125 | 17134.1130 |
 | --- | --- | --- | --- | --- | --- | --- |
@@ -27,20 +28,35 @@ all per-API results and hashes of the retained source inventories.
 | `CiValidateFileObject` | Yes | Yes | Yes | Yes | Yes | Yes |
 | `CiVerifyHashInCatalog` | Yes | Yes | Yes | Yes | Yes | Yes |
 
-## Later Windows 10 and Windows 11 samples
+## Later Windows 10 and Windows 11 x64 samples
 
-| API | 19041.1 | 19041.1865 | 22000.318 | 26100.8328 |
+| API | 19041.1 | 19041.1865 | 22000.318 | 22621.2792 | 26100.8328 |
-| --- | --- | --- | --- | --- |
+| --- | --- | --- | --- | --- | --- |
-| `CiCheckSignedFile` | Yes | Yes | Yes | Yes |
+| `CiCheckSignedFile` | Yes | Yes | Yes | Yes | Yes |
-| `CiFindPageHashesInCatalog` | Yes | Yes | Yes | Yes |
+| `CiFindPageHashesInCatalog` | Yes | Yes | Yes | Yes | Yes |
-| `CiFindPageHashesInSignedFile` | Yes | Yes | Yes | Yes |
+| `CiFindPageHashesInSignedFile` | Yes | Yes | Yes | Yes | Yes |
-| `CiFreePolicyInfo` | Yes | Yes | Yes | Yes |
+| `CiFreePolicyInfo` | Yes | Yes | Yes | Yes | Yes |
-| `CiGetCertPublisherName` | No | Yes | Yes | Yes |
+| `CiGetCertPublisherName` | No | Yes | Yes | Yes | Yes |
-| `CiGetPEInformation` | Yes | Yes | Yes | Yes |
+| `CiGetPEInformation` | Yes | Yes | Yes | Yes | Yes |
-| `CiInitialize` | Yes | Yes | Yes | Yes |
+| `CiInitialize` | Yes | Yes | Yes | Yes | Yes |
-| `CiSetTrustedOriginClaimId` | Yes | Yes | Yes | Yes |
+| `CiSetTrustedOriginClaimId` | Yes | Yes | Yes | Yes | Yes |
-| `CiValidateFileObject` | Yes | Yes | Yes | Yes |
+| `CiValidateFileObject` | Yes | Yes | Yes | Yes | Yes |
-| `CiVerifyHashInCatalog` | Yes | Yes | Yes | Yes |
+| `CiVerifyHashInCatalog` | Yes | Yes | Yes | Yes | Yes |
+
+## Windows 11 ARM64 samples
+
+| API | 22621.1702 | 26100.1591 |
+| --- | --- | --- |
+| `CiCheckSignedFile` | Yes | Yes |
+| `CiFindPageHashesInCatalog` | Yes | Yes |
+| `CiFindPageHashesInSignedFile` | Yes | Yes |
+| `CiFreePolicyInfo` | Yes | Yes |
+| `CiGetCertPublisherName` | Yes | Yes |
+| `CiGetPEInformation` | Yes | Yes |
+| `CiInitialize` | Yes | Yes |
+| `CiSetTrustedOriginClaimId` | Yes | Yes |
+| `CiValidateFileObject` | Yes | Yes |
+| `CiVerifyHashInCatalog` | Yes | Yes |
 
 ## Exact sample identities
 
@@ -62,8 +78,14 @@ all per-API results and hashes of the retained source inventories.
   `d0408a9f64eafb72e8aa1cf127d07d919f0cab38a6bdf2b406255909c85e3a8d`.
 - Windows 11 English x64 v1 ISO: **10.0.22000.318 x64**, SHA-256
   `301ae49ac5b87cf1cbe07d9d3c6486a066d045b6bf55fc8eb392d52951ec69ff`.
+- Windows 11 23H2 English ISO: **10.0.22621.2792 x64**, SHA-256
+  `9ed77b8a53946ced8c3540edb26a765060dff908544634e7b069aa49f2b41559`.
 - Windows 11 24H2 sample: **10.0.26100.8328 x64**, SHA-256
   `c7d23814f3202c51fb23e3ca3d4328855787383cee5d14c4a986a13ec2aeda0b`.
+- Windows 11 22H2.9 ARM64 ISO: **10.0.22621.1702 ARM64**, SHA-256
+  `4164ac08fd19628c5ab6cbca6234265ac2bf7f39d5149f57d3845646d8a8ad60`.
+- Windows 11 24H2 ARM64 ISO: **10.0.26100.1591 ARM64**, SHA-256
+  `a0eba64a9a3f2006d5832079412eca42cc1b9ed66d19b9b0adb7e59ea354415d`.
 
 ## What callers can rely on
 
@@ -84,9 +106,10 @@ all per-API results and hashes of the retained source inventories.
 
 ## Coverage gaps and evidence
 
-**Unknown / not sampled:** x86 and ARM64 export availability; pre-Windows-10;
+**Unknown / not sampled:** x86 export availability; Windows 10 ARM64;
-Windows 10 1809/1903/1909; other 19041 servicing revisions; and Windows 11
+pre-Windows-10; Windows 10 1809/1903/1909; and other servicing revisions
-22621/22631. These are gaps, not negative export results. No interval between
+or architecture/release combinations absent from these tables.
+These are gaps, not negative export results. No interval between
 two samples is certified. Runtime verification and cross-version ABI checks
 remain in the [implementation ledger](implementation-status.md).
 
@@ -101,4 +124,6 @@ Source inventories are retained in the companion
 `corpus-index.json` (VM samples), `iso-corpus-index.json` (ISO samples), and
 `ci-26100.8328-evidence.json` with `manifest.json` (original 26100 sample).
 Regenerate with its `generate_compatibility_matrix.py --output <Domito/docs>`.
+ARM64 cells establish export presence only; the historical x64 layout views
+must not be selected for ARM64 solely because the same API name is exported.
 No Windows binary or PDB is distributed with the matrix.

docs/implementation-status.md

@@ -59,8 +59,10 @@ and compilation do not close these:
    statuses, policies and fixture/environment identities (issue #3).
 2. Complete historical and ARM64 ABI/structure verification and runtime tests.
    The [published export matrix](ci-api-compatibility.md) now covers all ten
-   named APIs across ten exact Windows 10/11 x64 CI files, including 19041.1,
+   named APIs across thirteen exact Windows 10/11 x64 and ARM64 CI files.
-   19041.1865 and 22000.318 ISO samples. This closes the initial export-presence
+   Windows 11 ISO extraction adds 23H2 x64 and 22H2/24H2 ARM64 observations.
+   The ARM64 observations establish export presence; their structure layouts
+   and runtime behavior remain unverified. This closes the initial export-presence
    matrix; additional releases, servicing revisions and architectures remain
    unsampled. It does not certify ABI or runtime behavior. The six 1507–1803
    sampled bodies establish the

docs/mincrypt-contracts.md

@@ -18,7 +18,7 @@ remain open. Compile-target `NTDDI_VERSION` is not runtime layout negotiation.
 ## Historical x64 corpus: availability and structure evolution
 
 The [CI API compatibility matrix](ci-api-compatibility.md) lists observed named
-exports for ten exact x64 CI files, including the later ISO samples. Consult it
+exports for thirteen exact x64/ARM64 CI files, including the later ISO samples. Consult it
 for import availability, and the contracts below for layout and ownership limits.
 
 [NOTES.md](../NOTES.md) lists the exact identities of six sampled Windows 10