Checkpoint the party/runtime stack before share-program and malicious-mode work.

Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>

examples/applications/idpf_agg.cpp

@@ -0,0 +1,52 @@
+#include <algorithm>
+#include <cstdint>
+#include <iostream>
+#include <vector>
+
+#include "dpf.hpp"
+#include "dpf/app_flow.hpp"
+#include "dpf/app_plans.hpp"
+
+// Max and k-th order statistic over secret uint16 values. Each value is
+// one incremental DPF with a unit payload on every prefix length. Servers
+// resume only the live prefixes with eval_until (ePrint 2024/1190).
+//
+//   c++ -std=c++17 -march=native -I include -I thirdparty \
+//       examples/applications/idpf_agg.cpp
+
+int main()
+{
+    const std::vector<std::uint16_t> values{12, 80, 3, 80, 40};
+    using key0_t = decltype(dpf::make_dpf(std::uint16_t{0},
+        dpf::idpf_ones<16>()).first);
+    using key1_t = decltype(dpf::make_dpf(std::uint16_t{0},
+        dpf::idpf_ones<16>()).second);
+    std::vector<key0_t> k0;
+    std::vector<key1_t> k1;
+    for (auto v : values)
+    {
+        auto [a, b] = dpf::make_dpf(v, dpf::idpf_ones<16>());
+        k0.push_back(std::move(a));
+        k1.push_back(std::move(b));
+    }
+
+    const auto opened_max = dpf::idpf_agg_max(k0, k1);
+    const auto opened_k2 = dpf::idpf_agg_kth(k0, k1, 2);
+
+    auto sorted = values;
+    std::sort(sorted.begin(), sorted.end(), std::greater<>{});
+    if (opened_max != sorted[0] || opened_k2 != sorted[1])
+    {
+        std::cerr << "idpf_agg " << opened_max << " " << opened_k2 << "\n";
+        return 1;
+    }
+
+    {
+        if (int rc = dpf::app::run_measured("idpf_agg",
+                dpf::protocol::idpf_agg_plan(0, 16), 16))
+            return rc;
+    }
+
+    std::cout << opened_max << "\n";
+    return 0;
+}