Context
Follow-up from #6274 (token coverage de-pinned to invariants + ratchet floors) and #6278 (weekly auto-refresh of the tracked catalogs).
The token_coverage test now asserts invariants + non-vacuity floors (total >= 2858, rules_text >= 1490, source_card_refs >= 9821). Those catch truncation / partial-regen (the #6199 class), but — as documented in the coverage.rs comment added by #6274 — they do not establish provenance: that the committed crates/engine/data/known-tokens.toml is the deterministic tokens-gen output for its declared MTGJSON vintage. No unit test can, because the generator input (data/mtgjson/sets) is gitignored and absent from the test binary.
Proposal (optional defense-in-depth)
Add a PR-scoped, vintage-aware provenance gate in CI (ci.yml card-data job, which already fetches MTGJSON and runs oracle-gen):
./scripts/fetch-token-sets.sh to populate data/mtgjson/sets.cargo run --profile tool --features cli --bin tokens-gen -- --input data/mtgjson/sets --output /tmp/kt.toml.- Vintage-aware compare: read the fetched MTGJSON
.meta.date and the committed crates/engine/data/mtgjson-vintage.
Priority
Low. #6278 makes the automated regen the catalog's sole update path (provenance-by-construction), and the floors catch the realistic threat. This gate is defense-in-depth against a manual/rogue edit to the committed catalog.
Context
Follow-up from #6274 (token coverage de-pinned to invariants + ratchet floors) and #6278 (weekly auto-refresh of the tracked catalogs).
The
token_coveragetest now asserts invariants + non-vacuity floors (total >= 2858,rules_text >= 1490,source_card_refs >= 9821). Those catch truncation / partial-regen (the #6199 class), but — as documented in the coverage.rs comment added by #6274 — they do not establish provenance: that the committedcrates/engine/data/known-tokens.tomlis the deterministictokens-genoutput for its declared MTGJSON vintage. No unit test can, because the generator input (data/mtgjson/sets) is gitignored and absent from the test binary.Proposal (optional defense-in-depth)
Add a PR-scoped, vintage-aware provenance gate in CI (ci.yml card-data job, which already fetches MTGJSON and runs oracle-gen):
./scripts/fetch-token-sets.shto populatedata/mtgjson/sets.cargo run --profile tool --features cli --bin tokens-gen -- --input data/mtgjson/sets --output /tmp/kt.toml..meta.dateand the committedcrates/engine/data/mtgjson-vintage.cmp /tmp/kt.toml crates/engine/data/known-tokens.tomlmust be byte-identical; fail on mismatch (tampering / non-determinism).Priority
Low. #6278 makes the automated regen the catalog's sole update path (provenance-by-construction), and the floors catch the realistic threat. This gate is defense-in-depth against a manual/rogue edit to the committed catalog.