fontisan 0.4.47 → 0.4.48

data/lib/fontisan/woff_container.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Fontisan
+  # Structural checks on a WOFF 1.0 container, run before the BinData parse.
+  #
+  # The native tiers decode a WOFF through fontisan-rs, which rejects a bad
+  # container with InvalidFontError "woff: <reason>" (no cause). This applies the
+  # same checks in the same order with the same messages, so every tier fails
+  # the same way on the same input (fontist/fontisan#159) rather than leaking
+  # whatever BinData or Zlib raise.
+  module WoffContainer
+    SIGNATURE = 0x774F4646 # 'wOFF'
+    MAX_OUTPUT = 1 << 30
+    PREFIX = "woff: "
+
+    module_function
+
+    # @param data [String] the whole file, binary
+    # @raise [InvalidFontError] with a "woff: ..." message
+    # @return [void]
+    def check!(data)
+      cur = Cursor.new(data)
+      reject("not a WOFF file (bad signature)") unless cur.u32 == SIGNATURE
+      cur.u32 # flavor
+      reject("header length does not match file length") unless cur.u32 == data.bytesize
+      num_tables = cur.u16
+      reject("no tables") if num_tables.zero?
+      cur.skip(2 + 4 + 4)
+      meta_offset = cur.u32
+      meta_length = cur.u32
+      cur.skip(4)
+      priv_offset = cur.u32
+      priv_length = cur.u32
+      [[meta_offset, meta_length], [priv_offset, priv_length]].each do |off, len|
+        reject("metadata or private block out of range") if off != 0 && off + len > data.bytesize
+      end
+      check_directory!(cur, num_tables, data.bytesize)
+    end
+
+    def check_directory!(cur, num_tables, size)
+      total = 12 + (16 * num_tables)
+      tags = Array.new(num_tables) do
+        tag, offset, comp, orig, = cur.u32, cur.u32, cur.u32, cur.u32, cur.u32
+        reject("table compLength exceeds origLength") if comp > orig
+        reject("table data out of range") if offset + comp > size
+        total += (orig + 3) & ~3
+        reject("decoded size too large") if total > MAX_OUTPUT
+        tag
+      end
+      reject("table directory not sorted by unique tag") if tags.each_cons(2).any? { |a, b| a >= b }
+    end
+
+    def reject(message)
+      raise InvalidFontError, "#{PREFIX}#{message}", cause: nil
+    end
+
+    # Bounds-checked big-endian reader.
+    class Cursor
+      def initialize(data)
+        @data = data
+        @pos = 0
+      end
+
+      def skip(count)
+        take(count)
+        nil
+      end
+
+      def u16 = take(2).unpack1("n")
+      def u32 = take(4).unpack1("N")
+
+      private
+
+      def take(count)
+        raise InvalidFontError.new("#{PREFIX}unexpected end of data"), cause: nil if count > @data.bytesize - @pos
+
+        chunk = @data.byteslice(@pos, count)
+        @pos += count
+        chunk
+      end
+    end
+  end
+end

data/lib/fontisan/woff_font.rb

@@ -97,12 +97,15 @@ module Fontisan
       end
       raise Errno::ENOENT, "File not found: #{path}" unless File.exist?(path)
 
+      WoffContainer.check!(File.binread(path))
+
       File.open(path, "rb") do |io|
         font = read(io)
         font.validate_signature!
         font.initialize_storage
         font.io_source = io
         font.read_compressed_table_data(io)
+        font.table_entries.each { |entry| font.table_data(entry.tag.dup.force_encoding("UTF-8")) }
         font
       rescue BinData::ValidityError, EOFError => e
         Kernel.raise(::Fontisan::InvalidFontError,
@@ -218,18 +221,31 @@ module Fontisan
                                     # Table is not compressed
                                     compressed_data
                                   else
-                                    # Decompress using zlib
-                                    Zlib::Inflate.inflate(compressed_data)
+                                    inflate_table(compressed_data, entry.orig_length)
                                   end
 
-      # Verify decompressed size matches expected
-      if @decompressed_tables[tag].bytesize != entry.orig_length
+      @decompressed_tables[tag]
+    end
+
+    # Inflate one table. Same failures and messages as the native tiers (see
+    # WoffContainer): a bad stream, or one longer than origLength, is "zlib
+    # stream is corrupt or too long"; a shorter one is a size mismatch.
+    def inflate_table(data, orig_length)
+      plain = begin
+        Zlib::Inflate.inflate(data)
+      rescue Zlib::Error
+        nil
+      end
+      if plain.nil? || plain.bytesize > orig_length
+        Kernel.raise(::Fontisan::InvalidFontError,
+                     "#{WoffContainer::PREFIX}zlib stream is corrupt or too long", cause: nil)
+      end
+      if plain.bytesize != orig_length
         Kernel.raise(::Fontisan::InvalidFontError,
-                     "Decompressed table '#{tag}' size mismatch: " \
-                     "expected #{entry.orig_length}, got #{@decompressed_tables[tag].bytesize}")
+                     "#{WoffContainer::PREFIX}inflated size does not match origLength", cause: nil)
       end
 
-      @decompressed_tables[tag]
+      plain
     end
 
     # Check if font has a specific table
@@ -388,19 +404,7 @@ module Fontisan
     # @param tag [String] The table tag
     # @return [Class, nil] Table parser class or nil
     def table_class_for(tag)
-      {
-        Constants::HEAD_TAG => Tables::Head,
-        Constants::HHEA_TAG => Tables::Hhea,
-        Constants::HMTX_TAG => Tables::Hmtx,
-        Constants::MAXP_TAG => Tables::Maxp,
-        Constants::NAME_TAG => Tables::Name,
-        Constants::OS2_TAG => Tables::Os2,
-        Constants::POST_TAG => Tables::Post,
-        Constants::CMAP_TAG => Tables::Cmap,
-        Constants::FVAR_TAG => Tables::Fvar,
-        Constants::GSUB_TAG => Tables::Gsub,
-        Constants::GPOS_TAG => Tables::Gpos,
-      }[tag]
+      SfntFont::TABLE_CLASS_MAP[tag] || (Tables::Cff if tag == "CFF ")
     end
 
     # Build an SFNT font file (TTF or OTF) from decompressed WOFF data

data/lib/fontisan.rb

@@ -119,6 +119,13 @@ module Fontisan
   autoload :SfntSource, "fontisan/sfnt_source"
   autoload :SfntTable, "fontisan/sfnt_table"
   autoload :SfntBuilder, "fontisan/sfnt_builder"
+  autoload :Reference, "fontisan/reference"
+  autoload :Engine, "fontisan/engine"
+  autoload :ByteOps, "fontisan/byte_ops"
+  autoload :Native, "fontisan/native"
+  autoload :Ffi, "fontisan/ffi"
+  autoload :FfiPlatform, "fontisan/ffi_platform"
+  autoload :Scan, "fontisan/scan"
   autoload :Stitcher, "fontisan/stitcher"
   autoload :StitcherCli, "fontisan/stitcher_cli"
   autoload :TrueTypeCollection, "fontisan/true_type_collection"
@@ -127,6 +134,8 @@ module Fontisan
   autoload :Type1Font, "fontisan/type1_font"
   autoload :Woff2Collection, "fontisan/woff2_collection"
   autoload :Woff2Font, "fontisan/woff2_font"
+  autoload :SfntDirectory, "fontisan/sfnt_directory"
+  autoload :WoffContainer, "fontisan/woff_container"
   autoload :WoffFont, "fontisan/woff_font"
 
   # SFNT offset table and table directory (defined in sfnt_font.rb)
@@ -212,7 +221,21 @@ module Fontisan
   # @example WOFF with no compression (legal per WOFF 1.0 §5.1)
   #   Fontisan.convert("f.ttf", to: :woff, output: "f.woff", uncompressed: true)
   def self.convert(path, to:, output:, **)
-    Commands::ConvertCommand.new(path, { to: to, output: output, ** }).run
+    # Through the Reference gate on every tier: the gate picks the tier, records
+    # who served the call, and never prints (the Ruby tier used to print progress
+    # here while the native tiers stayed silent).
+    # TODO(2f): UnpackCommand and the Thor CLI still call their commands directly.
+    Reference.convert(path, to: to, output: output, **)
+  end
+
+  # Scan font files into one row per font face, with the names, indexability
+  # result and variable instances an indexer needs. Delegates to
+  # {Reference.scan}; never raises for a bad font (the failure is in the row).
+  #
+  # @param paths [Array<String>] font file paths
+  # @return [Array<Hash>] rows (see docs/reference-facade.md)
+  def self.scan(paths)
+    Reference.scan(paths)
   end
 
   # Validate a font file using specified profile

data/rakelib/bench.rake

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+desc "Run the reference corpus benches (ci tier), print the report and write BENCHMARKS.md"
+task bench: "corpus:fetch" do
+  root = File.expand_path("..", __dir__)
+  ok = system(RbConfig.ruby, File.join(root, "benchmark/ci_gate.rb"), "--mode", "report",
+              "--write", File.join(root, "BENCHMARKS.md"))
+  abort "bench failed" unless ok
+end

data/rakelib/cdylib.rake

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# The :ffi tier's shared library (fontisan#156 card 2d).
+namespace :cdylib do
+  desc "Build ext/fontisan_cdylib with cargo and install it under lib/fontisan/ffi/"
+  task build: :vendor
+
+  desc "Build the cdylib for the active cross target (CARGO_BUILD_TARGET / RUST_TARGET) and vendor it into lib/fontisan/ffi/"
+  task :vendor do
+    require "rbconfig"
+    require "fileutils"
+    ext = File.expand_path("../ext/fontisan_cdylib", __dir__)
+    triple = ENV["CARGO_BUILD_TARGET"] || ENV.fetch("RUST_TARGET", nil)
+    if triple.nil? && ENV.key?("RUBY_TARGET") # a cross build outside rb-sys-dock
+      require "rb_sys/toolchain_info"
+      triple = RbSys::ToolchainInfo.new(ENV.fetch("RUBY_TARGET")).rust_target
+    end
+    args = ["cargo", "build", "--release", "--locked", "--manifest-path", File.join(ext, "Cargo.toml")]
+    args += ["--target", triple] if triple
+    sh(*args)
+    release = File.join(ENV.fetch("CARGO_TARGET_DIR", File.join(ext, "target")), triple.to_s, "release")
+    built = Dir[File.join(release, "{lib,}fontisan_cdylib.{so,dylib,dll}")].first
+    abort "cdylib not found under #{release}" unless built
+
+    dest = File.expand_path("../lib/fontisan/ffi", __dir__)
+    FileUtils.mkdir_p(dest)
+    FileUtils.cp(built, dest)
+  end
+
+  desc "List the fontisan_* symbols the built library exports (nm -gU / dumpbin); fails if any is missing"
+  task :exports do
+    lib = Dir[File.expand_path("../lib/fontisan/ffi/*fontisan_cdylib.*", __dir__)].first
+    abort "no built library under lib/fontisan/ffi (rake cdylib:build)" unless lib
+    listing = if Gem.win_platform? then `dumpbin /exports "#{lib}"` else `nm -gU "#{lib}"` end
+    missing = %w[fontisan_abi_version fontisan_call fontisan_result_free fontisan_cdylib_engine_rev].reject { |s| listing.include?(s) }
+    abort "missing exports: #{missing.join(', ')}" unless missing.empty?
+    puts listing.lines.grep(/fontisan_/)
+  end
+end

data/rakelib/corpus.rake

@@ -0,0 +1,272 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "net/http"
+require "open3"
+require "tmpdir"
+require "uri"
+
+# Reference corpus (fontist/fontisan#157). The manifest is corpus/manifest.json:
+#   source  - a font fetched from a pinned URL; sha256 is of the EXTRACTED font
+#             (archives are not byte-stable, so the zip itself is never hashed)
+#   derived - a small output committed under corpus/derived/, sha256 verified
+module Corpus
+  ROOT = File.expand_path("..", __dir__)
+  MANIFEST = File.join(ROOT, "corpus", "manifest.json")
+  FONTS_DIR = File.join(ROOT, "corpus", "fonts")
+  DERIVED_DIR = File.join(ROOT, "corpus", "derived")
+  MAX_REDIRECTS = 8
+  ATTEMPTS = 3
+
+  class Error < StandardError; end
+
+  module_function
+
+  def manifest
+    JSON.parse(File.read(MANIFEST))
+  end
+
+  def tiers_for(selector)
+    case selector.to_s
+    when "", "ci" then %w[ci]
+    when "large" then %w[large]
+    when "all" then %w[ci large]
+    else raise Error, "TIER must be ci, large or all (got #{selector.inspect})"
+    end
+  end
+
+  def sha256(path)
+    Digest::SHA256.file(path).hexdigest
+  end
+
+  def source_path(entry)
+    File.join(FONTS_DIR, entry.fetch("id"), entry.fetch("file"))
+  end
+
+  def derived_path(entry)
+    File.join(DERIVED_DIR, entry.fetch("file"))
+  end
+
+  def verify!(entry, path)
+    raise Error, "#{entry['id']}: #{path} is missing" unless File.exist?(path)
+
+    actual = sha256(path)
+    return if actual == entry.fetch("sha256")
+
+    raise Error, "#{entry['id']}: sha256 mismatch for #{File.basename(path)}\n  " \
+                 "expected #{entry['sha256']}\n  actual   #{actual}"
+  end
+
+  # Streams url into dest, following redirects, retrying transient failures.
+  def download(url, dest)
+    attempt = 0
+    begin
+      attempt += 1
+      stream(URI(url), dest, MAX_REDIRECTS)
+    rescue StandardError => e
+      FileUtils.rm_f(dest)
+      raise Error, "download failed for #{url}: #{e.message}" if attempt >= ATTEMPTS
+
+      warn "[corpus:fetch] retry #{attempt}/#{ATTEMPTS - 1} for #{url}: #{e.message}"
+      sleep(attempt * 2)
+      retry
+    end
+  end
+
+  def stream(uri, dest, redirects)
+    raise "too many redirects" if redirects.negative?
+
+    Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                                        read_timeout: 120) do |http|
+      http.request_get(uri.request_uri, "User-Agent" => "fontisan-corpus") do |res|
+        case res
+        when Net::HTTPSuccess
+          File.open(dest, "wb") { |f| res.read_body { |chunk| f.write(chunk) } }
+        when Net::HTTPRedirection
+          return stream(URI.join(uri.to_s, res["location"]), dest, redirects - 1)
+        else
+          raise "HTTP #{res.code}"
+        end
+      end
+    end
+  end
+
+  def extract_member(zip_path, member, dest)
+    require "zip"
+    Zip::File.open(zip_path) do |zip|
+      found = zip.find_entry(member) or raise Error, "#{member} not in archive"
+      File.open(dest, "wb") { |out| IO.copy_stream(found.get_input_stream, out) }
+    end
+  end
+
+  def fetch_source(entry)
+    dest = source_path(entry)
+    if File.exist?(dest) && sha256(dest) == entry["sha256"]
+      puts "[corpus:fetch] ok      #{entry['id']}"
+      return
+    end
+
+    FileUtils.mkdir_p(File.dirname(dest))
+    Dir.mktmpdir("corpus-fetch") do |tmp|
+      src = entry.fetch("source")
+      if src["archive_member"]
+        zip = File.join(tmp, "archive.zip")
+        download(src.fetch("url"), zip)
+        extracted = File.join(tmp, "member")
+        extract_member(zip, src["archive_member"], extracted)
+        FileUtils.mv(extracted, dest)
+      else
+        download(src.fetch("url"), dest)
+      end
+    end
+    begin
+      verify!(entry, dest)
+    rescue Error
+      FileUtils.rm_f(dest)
+      raise
+    end
+    puts "[corpus:fetch] fetched #{entry['id']} (#{File.size(dest)} bytes)"
+  end
+
+  def entries(selector)
+    tiers = tiers_for(selector)
+    manifest.fetch("fonts").select { |f| tiers.include?(f["tier"]) }
+  end
+
+  def fetch(selector)
+    list = entries(selector)
+    list.select { |f| f["type"] == "source" }.each { |e| fetch_source(e) }
+    list.select { |f| f["type"] == "derived" }.each do |e|
+      verify!(e, derived_path(e))
+      puts "[corpus:fetch] derived #{e['id']} verified"
+    end
+    sources = list.count { |f| f["type"] == "source" }
+    puts "[corpus:fetch] #{sources} sources and #{list.size - sources} derived entries verified"
+  end
+
+  # --- WOFF2 cross-check with the pinned Google woff2_decompress ----------
+
+  def woff2_decompress
+    out, status = Open3.capture2(File.join(ROOT, "scripts", "build-woff2.sh"))
+    raise Error, "scripts/build-woff2.sh failed" unless status.success?
+
+    out.lines.last.strip
+  end
+
+  def path_for(entry)
+    entry["type"] == "derived" ? derived_path(entry) : source_path(entry)
+  end
+
+  def tables_of(bytes)
+    require_relative "../corpus/derive/sfnt"
+    if bytes.byteslice(0, 4) == "ttcf"
+      CorpusSfnt.parse_ttc(bytes).map { |_v, t| t.to_h }
+    else
+      [CorpusSfnt.parse(bytes).last.to_h]
+    end
+  end
+
+  # WOFF2 drops DSIG, re-serialises glyf/loca (padding) and sets head
+  # flags bit 11, checkSumAdjustment and modified. Everything else must be
+  # byte-equal after decoding by the pinned Google decoder.
+  HEAD_VOLATILE = [8..11, 16..16, 28..35].flat_map(&:to_a).freeze
+
+  def glyph_slices(tables)
+    loca_fmt = tables["head"].byteslice(50, 2).unpack1("n")
+    offs = if loca_fmt.zero?
+             tables["loca"].unpack("n*").map { |o| o * 2 }
+           else
+             tables["loca"].unpack("N*")
+           end
+    offs.each_cons(2).map { |a, b| tables["glyf"].byteslice(a, b - a).sub(/\0+\z/n, "") }
+  end
+
+  def compare_decoded(id, want, got)
+    problems = []
+    unless want.size == got.size
+      return ["#{id}: #{got.size} members decoded, expected #{want.size}"]
+    end
+
+    want.zip(got).each_with_index do |(w, g), i|
+      where = "#{id} member #{i}"
+      expected_tags = w.keys - ["DSIG"]
+      problems << "#{where}: table tags differ" unless expected_tags.sort == g.keys.sort
+      (expected_tags & g.keys).each do |tag|
+        case tag
+        when "glyf", "loca" then next
+        when "head"
+          diff = (0...w[tag].bytesize).reject { |j| w[tag].getbyte(j) == g[tag].getbyte(j) }
+          problems << "#{where}: head differs outside volatile fields: #{diff}" unless (diff - HEAD_VOLATILE).empty?
+        else
+          problems << "#{where}: table #{tag} differs after decode" unless w[tag] == g[tag]
+        end
+      end
+      if w["glyf"] && g["glyf"] && glyph_slices(w) != glyph_slices(g)
+        problems << "#{where}: glyph outlines differ after decode"
+      end
+    end
+    problems
+  end
+
+  def check_woff2(selector)
+    exe = woff2_decompress
+    all = manifest.fetch("fonts")
+    failures = []
+    entries(selector).select { |e| e["woff2_decode"] }.each do |entry|
+      Dir.mktmpdir("corpus-woff2") do |tmp|
+        input = File.join(tmp, "in.woff2")
+        FileUtils.cp(path_for(entry), input)
+        _out, err, status = Open3.capture3(exe, input)
+        # woff2_decompress writes <stem>.ttf even for collections: detect the
+        # format by magic bytes, never by extension.
+        out_path = File.join(tmp, "in.ttf")
+        unless status.success? && File.exist?(out_path)
+          failures << "#{entry['id']}: woff2_decompress failed: #{err.strip}"
+          next
+        end
+        decoded = File.binread(out_path)
+        magic = decoded.byteslice(0, 4)
+        unless ["\x00\x01\x00\x00".b, "OTTO", "true", "ttcf"].include?(magic)
+          failures << "#{entry['id']}: decoded output has magic #{magic.inspect}"
+          next
+        end
+        if (ref_id = entry["woff2_decoded_equals"])
+          ref = all.find { |f| f["id"] == ref_id }
+          want = tables_of(File.binread(path_for(ref)))
+          got = tables_of(decoded)
+          problems = compare_decoded(entry["id"], want, got)
+          failures.concat(problems)
+          next unless problems.empty?
+        end
+        puts "[corpus:check_woff2] ok #{entry['id']} (#{magic == 'ttcf' ? 'collection' : 'single font'})"
+      end
+    end
+    raise Error, "WOFF2 cross-check failed:\n  #{failures.join("\n  ")}" unless failures.empty?
+  end
+end
+
+namespace :corpus do
+  desc "Download and verify the corpus (TIER=ci|large|all, default ci)"
+  task :fetch do
+    Corpus.fetch(ENV.fetch("TIER", "ci"))
+  rescue Corpus::Error => e
+    abort "[corpus:fetch] #{e.message}"
+  end
+
+  desc "Cross-check WOFF2 entries with the pinned Google woff2_decompress"
+  task check_woff2: :fetch do
+    Corpus.check_woff2(ENV.fetch("TIER", "ci"))
+  rescue Corpus::Error => e
+    abort "[corpus:check_woff2] #{e.message}"
+  end
+
+  desc "Regenerate corpus/derived from corpus/derive scripts (provenance; run after fetch)"
+  task derive: :fetch do
+    ruby = %w[quirks malformed fuzz ttc_multi woff2_collection]
+    ruby.each do |name|
+      sh "bundle", "exec", "ruby", File.join(Corpus::ROOT, "corpus", "derive", "#{name}.rb")
+    end
+  end
+end

data/rakelib/corpus_convert.rake

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../scripts/corpus/generate_convert_goldens"
+
+# Convert goldens (card 0c). `corpus:convert:verify` only compares;
+# `corpus:convert:regenerate` is the one task that writes. TIER=ci|large|all,
+# ONLY=<font-id>[,<font-id>] narrows verify/regenerate. Needs `opentype-sanitizer`
+# (OTS_PYTHON=<python with it>) and the pinned woff2_decompress.
+module ConvertTasks
+  module_function
+
+  def tiers
+    Corpus.tiers_for(ENV.fetch("TIER", "ci"))
+  end
+
+  def only
+    ENV["ONLY"]&.split(",")
+  end
+end
+
+namespace :corpus do
+  namespace :convert do
+    desc "Regenerate convert goldens from the reference (TIER, ONLY)"
+    task regenerate: "corpus:fetch" do
+      files = ConvertGoldens.generate(ConvertTasks.tiers, only: ConvertTasks.only)
+      ConvertGoldens.write(files)
+      puts "[corpus:convert:regenerate] wrote #{files.size} goldens"
+    rescue ConvertGoldens::ToolMissing, Corpus::Error => e
+      abort "[corpus:convert:regenerate] #{e.message}"
+    end
+
+    desc "Compare regenerated convert output with the committed goldens; never writes (TIER, ONLY)"
+    task verify: "corpus:fetch" do
+      problems = ConvertGoldens.verify(ConvertTasks.tiers, only: ConvertTasks.only)
+      problems.concat(ConvertGoldens.ots_failures.reject { |f| ConvertGoldens.listed_exceptions.include?(f) }
+                      .map { |f| "#{f}: OTS failure not listed in corpus/TRIAGE_CONVERT.md" })
+      abort "[corpus:convert:verify] #{problems.size} problem(s):\n  #{problems.join("\n  ")}" unless problems.empty?
+      puts "[corpus:convert:verify] ok"
+    rescue ConvertGoldens::ToolMissing => e
+      abort "[corpus:convert:verify] #{e.message}"
+    end
+  end
+end

data/rakelib/corpus_goldens.rake

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# Read goldens (fontist/fontisan#156 card 0b). `corpus:verify` compares only
+# and never writes; `corpus:regenerate` rewrites the goldens and is explicit.
+namespace :corpus do
+  desc "Compare the read goldens with fresh output (TIER=ci|large, default ci); never writes"
+  task verify: :fetch do
+    require_relative "../scripts/corpus/generate_goldens"
+    tier = ENV.fetch("TIER", "ci")
+    problems = CorpusGoldens.verify(tier)
+    abort "[corpus:verify] #{problems.size} problem(s):\n  #{problems.join("\n  ")}" unless problems.empty?
+
+    puts "[corpus:verify] tier #{tier}: #{CorpusGoldens.entries(tier).size} read goldens match"
+  end
+
+  desc "Rewrite the read goldens from the corpus (TIER=ci|large); review the diff"
+  task regenerate: :fetch do
+    require_relative "../scripts/corpus/generate_goldens"
+    tier = ENV.fetch("TIER", "ci")
+    puts "[corpus:regenerate] wrote #{CorpusGoldens.write(tier)} goldens (tier #{tier})"
+  end
+end

data/rakelib/corpus_malformed.rake

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Malformed-input goldens (fontist/fontisan#156, card 0e).
+namespace :corpus do
+  namespace :malformed do
+    desc "Check corpus/goldens/malformed against current Ruby behaviour"
+    task :verify do
+      require_relative "../scripts/corpus/generate_malformed_goldens"
+      problems = MalformedGoldens.verify
+      abort "[corpus:malformed:verify]\n  #{problems.join("\n  ")}" unless problems.empty?
+      puts "[corpus:malformed:verify] ok (#{MalformedGoldens.entries.size} kinds)"
+    end
+
+    desc "Regenerate corpus/goldens/malformed (only in a PR that shows the golden diff)"
+    task :regenerate do
+      require_relative "../scripts/corpus/generate_malformed_goldens"
+      puts "[corpus:malformed:regenerate] wrote #{MalformedGoldens.regenerate} goldens"
+    end
+  end
+end

data/rakelib/corpus_scan.rake

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Scan goldens (fontist/fontisan#156 card 0f). `corpus:scan:verify` compares
+# only and never writes; `corpus:scan:regenerate` rewrites and is explicit.
+namespace :corpus do
+  namespace :scan do
+    desc "Compare corpus/goldens/scan with fresh Reference.scan output (TIER=ci|large); never writes"
+    task verify: "corpus:fetch" do
+      require_relative "../scripts/corpus/generate_scan_goldens"
+      tier = ENV.fetch("TIER", "ci")
+      problems = ScanGoldens.verify(tier)
+      abort "[corpus:scan:verify] #{problems.size} problem(s):\n  #{problems.join("\n  ")}" unless problems.empty?
+
+      puts "[corpus:scan:verify] tier #{tier}: #{ScanGoldens.entries(tier).size} scan goldens match"
+    end
+
+    desc "Rewrite the scan goldens (TIER=ci|large); review the diff"
+    task regenerate: "corpus:fetch" do
+      require_relative "../scripts/corpus/generate_scan_goldens"
+      tier = ENV.fetch("TIER", "ci")
+      puts "[corpus:scan:regenerate] wrote #{ScanGoldens.write(tier)} goldens (tier #{tier})"
+    end
+  end
+end