Throughout the specification it's very much unclear where certain state in algorithms is pulled from. E.g., https://fedidcg.github.io/FedCM/#fetch-the-manifest does not make it clear it takes a provider as argument (and what the type of that argument is). It also doesn't seem to explain at all where the CSP is coming from that it performs a check with. That would require at least an environment or some such.