Feat wasm verification

.github/workflows/ci.yml

@@ -30,14 +30,18 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Install LLVM 16
+      - name: Install LLVM 16 + WABT
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
           echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
           sudo apt-get update
           sudo apt-get install -y \
             clang-16 llvm-16 llvm-16-dev libclang-16-dev \
             cmake ninja-build libboost-all-dev zlib1g-dev
+          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
+          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
+          sudo tar xzf /tmp/wabt.tar.gz -C /opt
+          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
 
       - name: Configure CMake
         run: |
@@ -70,7 +74,7 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Install LLVM 16 + cppcheck
+      - name: Install LLVM 16 + cppcheck + WABT
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
           echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
@@ -79,6 +83,10 @@ jobs:
             clang-16 clang-tidy-16 llvm-16 llvm-16-dev libclang-16-dev \
             cmake ninja-build libboost-all-dev zlib1g-dev \
             cppcheck
+          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
+          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
+          sudo tar xzf /tmp/wabt.tar.gz -C /opt
+          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
 
       - name: Generate compile_commands.json
         run: |
@@ -152,14 +160,18 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Install LLVM 16
+      - name: Install LLVM 16 + WABT
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
           echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list
           sudo apt-get update
           sudo apt-get install -y \
             clang-16 llvm-16 llvm-16-dev libclang-16-dev \
             cmake ninja-build libboost-all-dev zlib1g-dev
+          # WABT 1.0.41 (apt tem 1.0.27, API incompatível com WasmRuntimeStubs.c)
+          wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
+          sudo tar xzf /tmp/wabt.tar.gz -C /opt
+          sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
 
       - name: Configure CMake with Sanitizers
         run: |
@@ -189,3 +201,90 @@ jobs:
           # Known: BTree.c:276 off-by-one (tracked for fix in Phase 2)
           UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=0"
         run: cd build && ctest --output-on-failure
+
+  # ===========================================================
+  # Job 4: WASM End-to-End Tests (Docker)
+  # ===========================================================
+  # Runs the full pipeline inside the published map2check-dev image,
+  # which already contains LLVM 16 + KLEE 3.1 + WABT + wasi-sdk.
+  # This catches regressions that unit tests miss (KLEE flags,
+  # isRequired, target function, wasm-rt linking, etc.).
+  e2e-wasm:
+    name: WASM E2E Tests (Docker)
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    needs: [build-and-test]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo docker image prune -a -f || true
+
+      - name: Pull map2check-dev image
+        run: docker pull ghcr.io/hbgit/map2check-dev:latest
+
+      - name: Build + install Map2Check in container
+        run: |
+          docker run --rm \
+            -u root \
+            -v "${{ github.workspace }}:/workspace" \
+            -w /workspace \
+            -e CC=/usr/bin/clang-16 \
+            -e CXX=/usr/bin/clang++-16 \
+            ghcr.io/hbgit/map2check-dev:latest bash -c '
+              # Install WABT + wasi-sdk (published image lacks them)
+              if [ ! -f /opt/wabt-1.0.41/include/wasm-rt.h ]; then
+                wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
+                tar xzf /tmp/wabt.tar.gz -C /opt && rm /tmp/wabt.tar.gz
+                ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
+              fi
+              if [ ! -d /opt/wasi-sdk-33.0-x86_64-linux ]; then
+                wget -q "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-33/wasi-sdk-33.0-x86_64-linux.tar.gz" -O /tmp/wasi-sdk.tar.gz
+                tar xzf /tmp/wasi-sdk.tar.gz -C /opt && rm /tmp/wasi-sdk.tar.gz
+              fi
+
+              # Build and install to a release-style layout
+              rm -rf build_e2e install_e2e
+              mkdir -p build_e2e && cd build_e2e
+              cmake .. -G Ninja \
+                -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \
+                -DENABLE_TEST=ON \
+                -DMAP2CHECK_DYNAMIC_LINK=ON \
+                -DCMAKE_INSTALL_PREFIX=/workspace/install_e2e
+              ninja
+              ninja install
+
+              # Symlink KLEE runtime + compiler-rt files missing from install rules
+              mkdir -p /workspace/install_e2e/lib/klee
+              ln -sf /opt/klee/lib/klee/runtime /workspace/install_e2e/lib/klee/runtime
+              ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_e2e/lib/clang
+            '
+
+      - name: Run WASM integration tests
+        run: |
+          docker run --rm \
+            -u root \
+            -v "${{ github.workspace }}:/workspace" \
+            -w /workspace \
+            -e MAP2CHECK_PATH=/workspace/install_e2e \
+            -e WASI_SDK_PATH=/opt/wasi-sdk-33.0-x86_64-linux \
+            ghcr.io/hbgit/map2check-dev:latest bash -c '
+              # Ensure WABT + wasi-sdk are available in this fresh container
+              if [ ! -f /opt/wabt-1.0.41/include/wasm-rt.h ]; then
+                wget -q "https://github.com/WebAssembly/wabt/releases/download/1.0.41/wabt-1.0.41-linux-x64.tar.gz" -O /tmp/wabt.tar.gz
+                tar xzf /tmp/wabt.tar.gz -C /opt && rm /tmp/wabt.tar.gz
+                ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c
+              fi
+              if [ ! -d /opt/wasi-sdk-33.0-x86_64-linux ]; then
+                wget -q "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-33/wasi-sdk-33.0-x86_64-linux.tar.gz" -O /tmp/wasi-sdk.tar.gz
+                tar xzf /tmp/wasi-sdk.tar.gz -C /opt && rm /tmp/wasi-sdk.tar.gz
+              fi
+              bash tests/integration/test_wasm_pipeline.sh
+              bash tests/integration/test_wasm_entrypoint.sh
+            '

.opencode/skills/book-to-skill/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [virgiliojr94]

.opencode/skills/book-to-skill/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,24 @@
+---
+name: Bug report
+about: Something went wrong during extraction or skill generation
+title: "[bug] "
+labels: bug
+---
+
+## What happened
+
+## What you expected
+
+## Source document
+- Format: <!-- PDF / EPUB / DOCX / … -->
+- Pages / size:
+- Language:
+- Does `python3 scripts/extract.py --check` show the relevant extractor installed? <!-- yes/no -->
+
+## Repro
+<!-- The exact command and (if shareable) a small sample file or input -->
+
+## Environment
+- OS:
+- Python version:
+- book-to-skill version / commit:

.opencode/skills/book-to-skill/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,17 @@
+---
+name: Feature request
+about: Suggest an improvement to extraction, generation, or the skill format
+title: "[feat] "
+labels: enhancement
+---
+
+## Problem
+<!-- What are you trying to do that's hard or impossible today? -->
+
+## Proposed change
+
+## How would we know it's better?
+<!-- A measurable acceptance criterion: a token delta, a test, a before/after.
+     Changes that add weight without a demonstrated gain are unlikely to land. -->
+
+## Alternatives considered

.opencode/skills/book-to-skill/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,70 @@
+<!--
+PR title: use Conventional Commits, e.g. `fix(extractor): scan full text`, `feat(cli): ...`.
+Fill EVERY section marked (Required). Sections marked (Optional) can be deleted if not applicable.
+A PR that leaves Required sections empty or unchecked will be asked to complete them before review.
+-->
+
+## Summary (Required)
+<!-- In 1-3 sentences and plain language: what does this PR do? Someone skimming
+     should understand the change without reading the diff. -->
+
+
+## Type of change (Required)
+<!-- Mark all that apply with [x]. -->
+- [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
+- [ ] ✨ Feature (non-breaking change that adds capability)
+- [ ] ⚡ Performance (faster / cheaper, no behavior change)
+- [ ] ♻️ Refactor (no behavior change)
+- [ ] 📝 Docs only
+- [ ] 🔒 Security
+- [ ] 🧹 Chore / CI / tooling
+- [ ] 💥 Breaking change (changes existing behavior or a public interface)
+
+## What it does (Required)
+<!-- Be specific. Use the lines that apply, delete the rest. -->
+- **Fixes:** <!-- the exact wrong behavior, and the root cause -->
+- **Improves:** <!-- what gets better, and by how much (numbers, not adjectives) -->
+- **Adds:** <!-- the new capability and who it is for -->
+
+## Motivation & context (Required)
+<!-- Why is this needed? What problem or use case drives it? -->
+Closes #<!-- issue number, or "n/a" with a one-line reason if there is no issue -->
+
+## How it works (Required for anything non-trivial)
+<!-- The approach: key decision(s), why this way, any alternative you rejected.
+     For a one-line fix, "see diff" is fine. -->
+
+
+## Evidence (Required)
+<!-- Proof, not claims. This project's rule is "measure, don't assert". -->
+- **Tests:** <!-- which tests you added/changed and what they assert -->
+- **Before / after:** <!-- terminal output, repro of the bug, or measured numbers.
+     For performance: a `tools/discovery_tax.py` number or a timed before/after.
+     For a bug fix: the failing input and the now-correct output. -->
+
+```
+<!-- paste the before/after terminal output here -->
+```
+
+## Screenshots / output (Required if behavior or output changes — Optional for pure internal refactor)
+<!-- Drag in an image: the bug vs the fix, the generated skill, the dashboard, etc.
+     A picture of broken-vs-fixed is the fastest way to get a PR reviewed.
+     Delete this section only for invisible internals. -->
+
+
+## Checklist (Required — all must be checked)
+- [ ] One focused change (one feature/fix per PR; not a stack of unrelated work)
+- [ ] Branch is rebased on the latest `master` and has no merge conflicts
+- [ ] Tests added/updated for behavior changes
+- [ ] `pytest -q` is green on a clean checkout
+- [ ] `ruff check .` is clean
+- [ ] `python3 tools/validate_skill.py SKILL.md` passes (if `SKILL.md` changed)
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]`
+- [ ] No raw book text shipped; no net `SKILL.md` bloat without justification
+
+## Breaking changes & back-compat (Optional)
+<!-- What breaks, who is affected, and the migration path. Delete if none. -->
+
+## Notes for reviewers (Optional)
+<!-- Anything that helps review: areas you are unsure about, follow-ups you left
+     out on purpose, things explicitly out of scope. -->

.opencode/skills/book-to-skill/.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  # Keep GitHub Actions fresh (and enables pinning actions to SHAs later).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+    # One PR per week with all action bumps grouped, instead of one PR per action.
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Python dependencies (the pyproject extras: pdf/epub/docx/rtf/technical).
+  # Surfaces security alerts and version bumps for the optional extractors.
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: deps
+    groups:
+      python:
+        patterns: ["*"]