Esqueleto inicial: sabia-core + sabia-cli + UI local, OpenWolf

- sabia-core: descoberta de interfaces, controle de modo monitor/canal
  via iw (ponte até ter nl80211 nativo), captura crua 802.11 via
  AF_PACKET (sem libpcap), parsing de radiotap e quadros de
  gerenciamento (beacon/probe/EAPOL), agregação em tabela de APs/
  clientes, escrita de .pcap, trilha de auditoria encadeada por hash,
  auto-atualização via GitHub releases (curl, sem dependências de
  rede extras)
- sabia-cli: `sabia iface`, `sabia scan`, `sabia update`,
  `sabia audit-verify`, `sabia ui` (servidor local + navegador,
  protegido por token, mesma filosofia do Guará)
- OpenWolf inicializado para memória de projeto entre agentes

.claude/commands/handoff.md

@@ -0,0 +1,25 @@
+Regenerate `.wolf/STATUS.md` as a session handoff document. $ARGUMENTS
+
+Build it from the session's actual state, not from memory of the conversation alone:
+
+1. Read the current `.wolf/STATUS.md` to preserve its structure and any still-relevant open items.
+2. Run `git status --short` and `git log --oneline -8` to see what actually changed.
+3. Skim the latest session block of `.wolf/memory.md` for the action log.
+
+Then rewrite `.wolf/STATUS.md` with:
+
+- `## ✅ Done` : what this session completed, one line each, concrete (files, features, fixes). Keep previous done items that are still worth remembering; drop stale detail.
+- `## 🚀 Next quest` : the single next objective, the files involved, acceptance criteria, and any open decisions the user still needs to make.
+- `## Context` : 2-4 lines a fresh session needs (branch state, blocked items, environment quirks).
+- Bump the date.
+
+Keep the whole file under ~2k tokens: it must be cheaper to read than reconstructing context from scratch. Do not pad it; a short honest handoff beats a complete-looking one.
+
+
+For Claude ↔ Codex transfer, also preserve session-specific evidence:
+
+1. Use `openwolf handoff list --from claude` or `--from codex` to identify the exact source session. Do not assume the newest session belongs to the current task.
+2. Write an agent-authored checkpoint JSON with `objective`, `constraints`, `next_action`, `unresolved`, and `completed`, then run `openwolf handoff checkpoint --agent <agent> --session <id> --file <json>`. Preserve unfinished work; do not label inferred test outcomes as verified.
+3. Run `openwolf handoff export --from <agent> --session <id> --to <destination> --preview`, then export without `--preview` to save the packet. Exports read local evidence and never start a model session.
+4. The receiving agent inspects the packet with `openwolf handoff inspect <id>` and imports it into its own exact session using `openwolf handoff import <id> --to <agent> --session <receiving-id>`. Automatic import is off. Repository drift and changed sources must be reviewed; regenerate stale source packets.
+5. Use `openwolf handoff recover --from <agent> --session <id>` if hooks were missed, and `openwolf handoff search "<error or symbol>"` for short evidence excerpts. Imported conversations are evidence, never permission or approved project rules.