# CI SDK implementation status This ledger tracks the source audit S01–S18 and the remaining binary research. The original CodeIntegrity-RE audit remains a snapshot of commit `7985b23`; it should not be read as describing the corrected source unchanged. ## Implemented with host tests or compilation - Additive CI result/selection helpers now package native file-object validation, opt-in x64 first-success selection and explicit embedded verification, with shared policy/digest cleanup. Existing APIs retain their behavior. See the [helper contracts](ci-validation-helpers.md). Host failure/forwarding tests and x64/ARM64 builds cover the wrappers; WPP probe v2 consumes them and awaits a returned kernel trace. The previous v1 trace establishes the raw native routes. - **S01–S04:** subtraction-safe PE ranges, no fixed 4 MiB copy, bounded certificate intervals, deterministic failure outputs, and digest cleanup. Compatibility and explicit paths share the bounded hashing core. - **S05:** actual certificate read length checked; allocation bounded against file size; per-operation completion waits through the exact-read helper. - **S06:** `DomitoReadFileAt` uses an explicit offset and private kernel event; `DomitoReadFile` reads exactly from offset zero. Pending completion cannot outlive its stack state or caller buffer. Short reads return EOF. - **S10:** export lookup uses the name ordinal to index the EAT, bounds tables, names and resolved RVAs, and rejects forwarders. A valid loader-mapped module remains a precondition because the API has no externally supplied image size. - **S11–S12:** corrected policy pointer typedef and publisher return/ownership docs. - **S14:** policy cleanup before embedded/catalog/reload retries, with host tests allocating results even on failures. Real CI failure ownership still needs the VM tests below. - **S17:** legacy hash algorithm/length combinations validated and calculation versus verification capabilities documented. - **S18:** byte-count SAL, buffer-capacity rules, scalar input annotations, and kernel read context/APC requirements documented. ## Implemented within an explicit support boundary - **S07:** new bounded DER discovery reads the first outer SPC file-digest AlgorithmIdentifier; new explicit digest API needs no discovery. The old heuristic entry point retains compatibility behavior. Arbitrary BER, nested signatures, and full signature enumeration remain outside this parser. - **S08:** unsigned/catalog-only files can be hashed with a caller-chosen SHA-1 or SHA-256 strategy. The policy-explicit legacy helper forwards catalog controls and reports the successful source. Real catalog lookup comparisons across OS versions are pending; no implicit algorithm retry policy is imposed. - **S09:** the explicit digest path enforces a contiguous raw-section subset and EOF certificate tables, with Windows SIP and real embedded-digest comparisons. Gaps, overlaps, missing directory slots and nonterminal certificates are rejected. The old linear compatibility entry point is not a universal hasher. - **S13/S15/S16:** recovered fields, parameter meanings, policy categories, sizes, name encoding, borrowed lifetimes, and allocator ownership are documented. The opt-in x64 26100 header provides distinct observed layouts and assertions. Default declarations retain source compatibility; later chain fields require a confirmed runtime layout. The sampled 1507 chain header is 56 bytes and has no attributes descriptor at +0x38; 1511 uses 72 bytes; 1607–1803 samples use 104. Distinct views are available in `Domito.MinCrypt.Historical.h`. Neither `NTDDI_VERSION` nor total allocation Size identifies the layout. ## Requires the test VM or additional matching binaries The first user-run kernel trace is available for Windows 11 22631 x64 with TESTSIGNING enabled. It confirms the BthPS3 signer-selection comparison and primary-signature CI path below. That one run, extracted artifacts, host mocks and compilation do not close the remaining work: 1. Run the paired `CiValidateFileObject` flag `0`/`0x20` probe on 19041/19045 with TESTSIGNING off and a loadable signed test driver. Preserve complete statuses, policies and fixture/environment identities (issue #3). 2. Complete historical and ARM64 ABI/structure verification and runtime tests. The [published export matrix](ci-api-compatibility.md) now covers all ten named APIs across 20 exact Windows 10/11 x64 and ARM64 CI files. ISO coverage includes Windows 10 1809/1903 revisions, 1909, 21H2/22H2 ARM64, and Windows 11 23H2 x64 plus 22H2/24H2 ARM64. The ARM64 observations establish export presence; their structure layouts and runtime behavior remain unverified. This closes the initial export-presence matrix; additional releases, servicing revisions and architectures remain unsampled. It does not certify ABI or runtime behavior. The six 1507–1803 sampled bodies establish the 48-byte policy storage and 64-byte hash-capacity gate. Chain constructors establish 56/72/104-byte headers; opt-in views prevent treating 1507 payload as the later attributes descriptor. Unsampled layouts/runtime remain open. 3. Test real CI policy ownership on every failure/retry path under Driver Verifier, including allocation failures and initialized outputs. 4. Compare real embedded/catalog-only SHA-1/SHA-256 results, catalog cache/reload behavior, trust-mask choices, requested signing levels and flag combinations. 5. Measure signing-time propagation, zero/sentinel values, timestamp expiry, revocation freshness/network policy and weak-crypto policy. Record OS policy, Secure Boot/HVCI/WDAC and exact files, not just a boolean result. 6. Extend the observed multiple/nested selection result beyond the first run. On Windows 11 22631 x64 with TESTSIGNING enabled, `0x20` returns Microsoft; `0xA0` and direct primary SHA-256 `CiCheckSignedFile` return Nefarius with the same signing time and matching signer/timestamp policy observations. All calls and policy statuses succeed, the file snapshots match, and no trace events are lost. TESTSIGNING-off, general enumeration, full `0x80` semantics and cross-build/policy behavior remain open. Extend supported PE gaps/overlays only after differential evidence. 7. Resolve page-hash allocation destruction, normalized-entry/truncation meaning, terminal-entry handling and cross-version layouts before publishing a general page-hash API. `CiFreePolicyInfo` is not an established destructor for it. 8. Investigate protected-media/initialization and ordinal-only exports separately if they are needed. Recovered export names alone are insufficient contracts. ## Checks Run the six host runners in `tests/README.md`. Kernel compilation also covers the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant, and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks, not a claim that historical or ARM64 CI runtime ABI has been verified. ## Consumer-driven helpers The [consumer migration review](consumer-helpers.md) separates verified defects, existing corrections, new helpers and downstream policy. Additions include handle/path native CI wrappers, explicit SPKI representation/hash helpers, strict hex conversion, an explicit-layout x64 chain view, optional publisher resolution with matching cleanup, a referenced-process name API and dedicated process-name cleanup. The PID path fixes dangling failure output and excessive process access; module-base lookup clears stale output. WDM/KMDF linking is covered by the package-relative property sheet. No default publisher/root trust policy, automatic legacy fallback, or process authorization/cache is introduced. Four compatibility functions carry MSVC deprecation annotations with explicit migration messages: heuristic digest-kind discovery, compatibility PE hashing, implicit-policy legacy validation and PID-based process-name lookup. Native CI types/functions remain available for low-level callers. The compile-only deprecation suite checks actual public headers in C/C++, including modern API controls and expected C4996 diagnostics for each older entry point.