Add explicit Authenticode workflows and correct CI helper contracts

tests/README.md

@@ -1,30 +1,62 @@
-# Code Integrity regression tests
+# Regression tests
 
 From an **x64 Visual Studio developer shell**, with the Windows SDK and Python 3:
 
 ```powershell
 python tests\run-digest-tests.py
+python tests\run-common-tests.py
+python tests\run-ci-probe-tests.py
 ```
 
-The runner extracts the production digest, pattern-search, algorithm-mapping,
-and legacy-validation functions without changing their bodies. The C++ harness
-uses real user-mode BCrypt hashing and test doubles for pool allocation, file
-reads, and CI. No driver is installed or loaded. Build outputs are temporary.
+Build outputs are temporary. No driver is installed or loaded. Test runners
+extract the actual production functions or include the probe body unchanged;
+kernel calls, CI calls, and pool allocation are replaced with test doubles.
+The digest harness uses real BCrypt, Crypt32 and the Windows PE SIP provider.
 
-Coverage includes PE32/PE32+ digest fixtures, checksum and certificate exclusions,
-a DOS stub larger than 4 MiB, truncated headers next to inaccessible guard pages,
-invalid offsets and lengths, absent security-directory entries, injected hashing
-and allocation failures, deterministic failure outputs, allocation ownership,
-and rejection of successful-but-short certificate reads before invoking CI.
+## Digest and legacy verification tests
 
-The tests do not validate CI trust policy, asynchronous kernel I/O behavior, or
-general Authenticode hashing of unusual section layouts. The digest implementation
-still uses its existing linear byte-order convention and heuristic signature
-algorithm detection; replacing those requires a separate compatibility corpus.
+Coverage includes PE32/PE32+ files, all four supported hash algorithms, checksum
+and certificate exclusions, overlays, reverse section-header order, multiple
+certificate entries, certificate padding, unsupported section layouts, bounded
+DER algorithm discovery, SHA-1 pattern decoys, truncated ASN.1, explicit catalog
+policy forwarding and cleanup between failed/successful CI attempts.
+
+The test compares digests against `CryptSIPCreateIndirectData` and reads the
+installed system `ci.dll`, `ntdll.dll`, `kernel32.dll`, and `notepad.exe` as a
+real-file corpus. For embedded signatures, Crypt32 independently decodes the SPC
+algorithm and expected file digest. These checks do not verify signature trust.
+
+Guard pages cover truncated headers and invalid ranges in both compatibility
+and strict paths. Fault injection covers allocation/hash failures, deterministic
+outputs, short certificate reads and digest ownership. A DOS stub larger than
+4 MiB exercises the removed scratch-buffer limit. Older entry points retain
+legacy selection/layout behavior; strict Ex APIs enforce their documented subset.
+
+## File and export helper tests
+
+The common harness checks explicit and zero offsets, exact/short/failed reads,
+pending completion, event/object cleanup, and error propagation. Export fixtures
+cover nonidentity name-ordinal mappings, forwarders, empty slots, invalid spans,
+unbounded strings, and deterministic failure outputs. The export API requires a
+valid loader-mapped module; it is not an arbitrary file parser.
 
 ## File-object validation flag probe
 
 See [the flag documentation and VM procedure](../docs/ci-validate-file-object.md)
-for `CiValidateFileObject` flag `0x20`. Run `python tests\run-ci-probe-tests.py`
-from the same developer shell to test probe plumbing with mock CI. The kernel
-probe must still be run in a suitable VM to verify actual policy behavior.
+for `CiValidateFileObject` flag `0x20`. The host runner tests probe plumbing with
+mock CI. The kernel probe must still run in a suitable VM to verify actual
+policy behavior.
+
+## Kernel compile checks and remaining validation
+
+`mincrypt-layout-tests.cpp` asserts default modern x64/ARM64 and pre-Windows-10
+compile layouts. On x64 it also includes the opt-in observed 26100 header's 14
+layout assertions. Compile it with the same WDK/kernel architecture flags and
+include paths as the library. This checks structure definitions, not runtime
+compatibility on those systems. `ci-file-object-probe.cpp` is separately compiled
+as kernel code for x64/ARM64; its real CI behavior is still untested.
+
+The host tests do not establish CI trust policy, real asynchronous kernel I/O,
+real policy ownership under Driver Verifier, revocation/timestamp behavior, or
+all Windows-version/layout combinations. See the
+[implementation ledger](../docs/implementation-status.md) for the remaining work.