The OpenType documentation states that for GPOS lookups of type 4.1 (Mark-to-Base Attachment Positioning), the application must do the following:
To identify the base glyph that combines with a mark, the text-processing client must look backward in the glyph string from the mark to the preceding base glyph.
But how far do I need to look back? Is this always the preceding character? Or do I need to skip over all glyphs in the marks coverage table? Or go back until I find a glyph in the base coverage table?
The MarkBasePosFormat1 table has a base coverage subtable that specifies a set of glyphs to match on. When determining if a given lookup will apply, you want to match a glyph sequence that begins with one of the glyphs specified in the base coverage subtable.
Going the other direction, from a mark backwards, you skip over any glyphs that are identified in the Glyph Class Definition subtable of the GDEF table as mark glyphs. When you get to a candidate glyph, you need to check that it's included in the base coverage table.
I see the Harfbuzz implementation has a few other details it checks as it scans backwards, you might want to check that: look for the apply method in the MarkBasePosFormat1 struct. (I'm not suggesting that Harfbuzz is the reference implementation that defines the intent of the spec; but it is widely used and is available as open source.)