chore: push all design docs, V2 plan specs, and current working state

Includes AirPlan design documents, AircOding-alpha1-plan, AirPlanV2,
AirPlan-ParaV2, AirPlan-Para V1 reference docs, and all working code
changes across packages.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

AirPlan/docs/spec/AirPlan-ParaV2/.agents/skills/airndb/references/windump-tcpdump-notes.md

@@ -0,0 +1,83 @@
+# WinDump / Tcpdump Notes
+
+Source: https://www.winpcap.org/windump/docs/manual.htm
+
+## AirNDB Summary
+
+- WinDump follows tcpdump-style packet capture usage on Windows.
+- `-D` lists available capture interfaces.
+- `-i <interface>` selects the capture interface. On Windows this is often the interface number from `-D`.
+- `-c <count>` stops after a bounded number of packets.
+- `-w <file>` writes raw packets to a pcap file.
+- `-r <file>` reads packets back from a pcap file.
+- `-n` avoids host name resolution; `-nn` also avoids service name resolution.
+- `-s <snaplen>` controls packet snapshot length. AirNDB uses `-s 0` for pcap captures so packets are not truncated.
+- Filter expressions use BPF primitives such as `host`, `net`, `port`, `src`, `dst`, `tcp`, `udp`, `icmp`, `arp`, `and`, `or`, and `not`.
+
+## Windows Notes
+
+- Prefer `WinDump.exe` or `windump` when `tcpdump` is unavailable on Windows.
+- WinDump normally requires a packet capture driver such as WinPcap/Npcap and may require an elevated terminal.
+- Interface names can be long adapter paths; the numeric index from `windump -D` is usually easier to use.
+- Store pcap artifacts in a project-local ignored directory such as `docs/network/airndb-captures/`.
+
+## AirNDB Auto Setup
+
+- On `/airndb enter`, AirNDB checks for `tcpdump`, `windump`, or `WinDump.exe`.
+- If no capture tool is available on Windows, AirNDB downloads the official `WinDump.exe` linked from the WinDump install page:
+
+```text
+https://www.winpcap.org/windump/install/bin/windump_3_9_5/WinDump.exe
+```
+
+- AirNDB verifies SHA1 before using the file:
+
+```text
+d59bc54721951dec855cbb4bbc000f9a71ea4d95
+```
+
+- AirNDB stores the binary at `AirPlan/state/airndb/tools/WinDump.exe` and writes `AirPlan/state/airndb/tool.env`:
+
+```text
+AIRNDB_TCPDUMP=<absolute path to WinDump.exe>
+```
+
+- AirNDB does not silently install WinPcap/Npcap drivers. If `WinDump.exe -D` fails after download, tell the user to install Npcap or WinPcap and retry from an elevated terminal.
+
+## Safe Defaults
+
+- Start with interface discovery before capture:
+
+```bash
+windump -D
+tcpdump -D
+```
+
+- Prefer short, bounded capture:
+
+```bash
+tcpdump -i <iface> -nn -s 0 -w <file>.pcap -c 200 '<bpf>'
+```
+
+- Read back a pcap summary:
+
+```bash
+tcpdump -nn -r <file>.pcap '<bpf>'
+```
+
+## BPF Examples
+
+```text
+host 192.0.2.10
+tcp and port 443
+udp and port 53
+src host 192.0.2.10 and dst port 443
+net 10.0.0.0/8 and not port 22
+icmp or icmp6
+```
+
+## Evidence Rules
+
+- Record exact command, interface, filter, packet count, capture window, pcap path, and summary path.
+- Keep pcap files private unless reviewed; they can contain tokens, cookies, payload, internal hostnames, and addresses.
+- If application payload is encrypted, use packet timing, DNS, TCP/TLS handshakes, retransmissions, resets, or connection failures as evidence instead of expecting plaintext.