Domito/docs/implementation-status.md

CI SDK implementation status

This ledger tracks the source audit S01–S18 and the remaining binary research. The original CodeIntegrity-RE audit remains a snapshot of commit 7985b23; it should not be read as describing the corrected source unchanged.

Implemented with host tests or compilation

• S01–S04: subtraction-safe PE ranges, no fixed 4 MiB copy, bounded certificate intervals, deterministic failure outputs, and digest cleanup. Compatibility and explicit paths share the bounded hashing core.
• S05: actual certificate read length checked; allocation bounded against file size; per-operation completion waits through the exact-read helper.
• S06: DomitoReadFileAt uses an explicit offset and private kernel event; DomitoReadFile reads exactly from offset zero. Pending completion cannot outlive its stack state or caller buffer. Short reads return EOF.
• S10: export lookup uses the name ordinal to index the EAT, bounds tables, names and resolved RVAs, and rejects forwarders. A valid loader-mapped module remains a precondition because the API has no externally supplied image size.
• S11–S12: corrected policy pointer typedef and publisher return/ownership docs.
• S14: policy cleanup before embedded/catalog/reload retries, with host tests allocating results even on failures. Real CI failure ownership still needs the VM tests below.
• S17: legacy hash algorithm/length combinations validated and calculation versus verification capabilities documented.
• S18: byte-count SAL, buffer-capacity rules, scalar input annotations, and kernel read context/APC requirements documented.

Implemented within an explicit support boundary

• S07: new bounded DER discovery reads the first outer SPC file-digest AlgorithmIdentifier; new explicit digest API needs no discovery. The old heuristic entry point retains compatibility behavior. Arbitrary BER, nested signatures, and full signature enumeration remain outside this parser.
• S08: unsigned/catalog-only files can be hashed with a caller-chosen SHA-1 or SHA-256 strategy. The policy-explicit legacy helper forwards catalog controls and reports the successful source. Real catalog lookup comparisons across OS versions are pending; no implicit algorithm retry policy is imposed.
• S09: the explicit digest path enforces a contiguous raw-section subset and EOF certificate tables, with Windows SIP and real embedded-digest comparisons. Gaps, overlaps, missing directory slots and nonterminal certificates are rejected. The old linear compatibility entry point is not a universal hasher.
• S13/S15/S16: recovered fields, parameter meanings, policy categories, sizes, name encoding, borrowed lifetimes, and allocator ownership are documented. The opt-in x64 26100 header provides distinct observed layouts and assertions. Default layouts remain compatible; runtime layout identity cannot be inferred from NTDDI_VERSION or ChainInfo->Size alone.

Requires the test VM or additional matching binaries

The VM is not available yet. Host mocks and compilation do not close these:

1. Run the paired CiValidateFileObject flag 0/0x20 probe on 19041/19045 with TESTSIGNING off and a loadable signed test driver. Preserve complete statuses, policies and fixture/environment identities (issue #3).
2. Verify historical and ARM64 ABI, structure evolution and first-available export versions using matching binaries/symbols and runtime tests. Preserve default layouts until that evidence supports changing them.
3. Test real CI policy ownership on every failure/retry path under Driver Verifier, including allocation failures and initialized outputs.
4. Compare real embedded/catalog-only SHA-1/SHA-256 results, catalog cache/reload behavior, trust-mask choices, requested signing levels and flag combinations.
5. Measure signing-time propagation, zero/sentinel values, timestamp expiry, revocation freshness/network policy and weak-crypto policy. Record OS policy, Secure Boot/HVCI/WDAC and exact files, not just a boolean result.
6. Establish multiple/nested signature-selection behavior with a signed corpus; extend supported PE gaps/overlays only after differential evidence.
7. Resolve page-hash allocation destruction, normalized-entry/truncation meaning, terminal-entry handling and cross-version layouts before publishing a general page-hash API. CiFreePolicyInfo is not an established destructor for it.
8. Investigate protected-media/initialization and ordinal-only exports separately if they are needed. Recovered export names alone are insufficient contracts.

Checks

Run the three host runners in tests/README.md. Kernel compilation also covers the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant, and 14 assertions in the opt-in observed-build header. Those are build checks, not a claim that historical or ARM64 CI runtime ABI has been verified.