Domito/docs/implementation-status.md

CI SDK implementation status

This ledger tracks the source audit S01–S18 and the remaining binary research. The original CodeIntegrity-RE audit remains a snapshot of commit 7985b23; it should not be read as describing the corrected source unchanged.

Implemented with host tests or compilation

• S01–S04: subtraction-safe PE ranges, no fixed 4 MiB copy, bounded certificate intervals, deterministic failure outputs, and digest cleanup. Compatibility and explicit paths share the bounded hashing core.
• S05: actual certificate read length checked; allocation bounded against file size; per-operation completion waits through the exact-read helper.
• S06: DomitoReadFileAt uses an explicit offset and private kernel event; DomitoReadFile reads exactly from offset zero. Pending completion cannot outlive its stack state or caller buffer. Short reads return EOF.
• S10: export lookup uses the name ordinal to index the EAT, bounds tables, names and resolved RVAs, and rejects forwarders. A valid loader-mapped module remains a precondition because the API has no externally supplied image size.
• S11–S12: corrected policy pointer typedef and publisher return/ownership docs.
• S14: policy cleanup before embedded/catalog/reload retries, with host tests allocating results even on failures. Real CI failure ownership still needs the VM tests below.
• S17: legacy hash algorithm/length combinations validated and calculation versus verification capabilities documented.
• S18: byte-count SAL, buffer-capacity rules, scalar input annotations, and kernel read context/APC requirements documented.

Implemented within an explicit support boundary

• S07: new bounded DER discovery reads the first outer SPC file-digest AlgorithmIdentifier; new explicit digest API needs no discovery. The old heuristic entry point retains compatibility behavior. Arbitrary BER, nested signatures, and full signature enumeration remain outside this parser.
• S08: unsigned/catalog-only files can be hashed with a caller-chosen SHA-1 or SHA-256 strategy. The policy-explicit legacy helper forwards catalog controls and reports the successful source. Real catalog lookup comparisons across OS versions are pending; no implicit algorithm retry policy is imposed.
• S09: the explicit digest path enforces a contiguous raw-section subset and EOF certificate tables, with Windows SIP and real embedded-digest comparisons. Gaps, overlaps, missing directory slots and nonterminal certificates are rejected. The old linear compatibility entry point is not a universal hasher.
• S13/S15/S16: recovered fields, parameter meanings, policy categories, sizes, name encoding, borrowed lifetimes, and allocator ownership are documented. The opt-in x64 26100 header provides distinct observed layouts and assertions. Default declarations retain source compatibility; later chain fields require a confirmed runtime layout. The sampled 1507 chain header is 56 bytes and has no attributes descriptor at +0x38; 1511 uses 72 bytes; 1607–1803 samples use 104. Distinct views are available in Domito.MinCrypt.Historical.h. Neither NTDDI_VERSION nor total allocation Size identifies the layout.

Requires the test VM or additional matching binaries

Live kernel testing is not available yet. Extracted VM artifacts, host mocks, and compilation do not close these:

1. Run the paired CiValidateFileObject flag 0/0x20 probe on 19041/19045 with TESTSIGNING off and a loadable signed test driver. Preserve complete statuses, policies and fixture/environment identities (issue #3).
2. Complete historical and ARM64 ABI/structure verification and runtime tests. The published export matrix now covers all ten named APIs across 20 exact Windows 10/11 x64 and ARM64 CI files. ISO coverage includes Windows 10 1809/1903 revisions, 1909, 21H2/22H2 ARM64, and Windows 11 23H2 x64 plus 22H2/24H2 ARM64. The ARM64 observations establish export presence; their structure layouts and runtime behavior remain unverified. This closes the initial export-presence matrix; additional releases, servicing revisions and architectures remain unsampled. It does not certify ABI or runtime behavior. The six 1507–1803 sampled bodies establish the 48-byte policy storage and 64-byte hash-capacity gate. Chain constructors establish 56/72/104-byte headers; opt-in views prevent treating 1507 payload as the later attributes descriptor. Unsampled layouts/runtime remain open.
3. Test real CI policy ownership on every failure/retry path under Driver Verifier, including allocation failures and initialized outputs.
4. Compare real embedded/catalog-only SHA-1/SHA-256 results, catalog cache/reload behavior, trust-mask choices, requested signing levels and flag combinations.
5. Measure signing-time propagation, zero/sentinel values, timestamp expiry, revocation freshness/network policy and weak-crypto policy. Record OS policy, Secure Boot/HVCI/WDAC and exact files, not just a boolean result.
6. Establish multiple/nested signature-selection behavior with a signed corpus; extend supported PE gaps/overlays only after differential evidence.
7. Resolve page-hash allocation destruction, normalized-entry/truncation meaning, terminal-entry handling and cross-version layouts before publishing a general page-hash API. CiFreePolicyInfo is not an established destructor for it.
8. Investigate protected-media/initialization and ordinal-only exports separately if they are needed. Recovered export names alone are insufficient contracts.

Checks

Run the three host runners in tests/README.md. Kernel compilation also covers the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant, and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks, not a claim that historical or ARM64 CI runtime ABI has been verified.