Checkpoint the party/runtime stack before share-program and malicious-mode work.

Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/dpf/net/comm_hook.hpp

@@ -0,0 +1,58 @@
+/// @file dpf/net/comm_hook.hpp
+/// @brief Replaceable transport under trio helpers.
+/// @details Protocols call `trio::exchange_with`, `send_to` / `recv_from`,
+///          `deal` / `accept_deal`, and `trio::batch`. Those helpers go through
+///          a `comm_hook` when one is installed. A null hook keeps the current
+///          framed mesh. `channel::send` / `recv` stay the raw bypass.
+#ifndef LIBDPF_INCLUDE_DPF_NET_COMM_HOOK_HPP__
+#define LIBDPF_INCLUDE_DPF_NET_COMM_HOOK_HPP__
+
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <vector>
+
+#include "dpf/net/channel.hpp"
+#include "dpf/net/round_sink.hpp"
+
+namespace dpf
+{
+namespace net
+{
+
+class trio;
+
+/// @brief Byte-level transport for trio helpers and RoundSink factories.
+/// @details Overrides replace the mesh without changing protocol call sites.
+///          Peer ids are `0..2` (`role` as unsigned). Default implementations
+///          in `mesh_comm_hook` match today's `channel` framing.
+class comm_hook
+{
+public:
+    virtual ~comm_hook() = default;
+
+    /// @brief One-way send on the link to `peer_id`.
+    virtual void send_bytes(trio & net, unsigned peer_id, msg tag,
+        const void * data, std::size_t n) = 0;
+
+    /// @brief One-way receive from `peer_id`.
+    virtual std::vector<std::uint8_t> recv_bytes(trio & net, unsigned peer_id,
+        msg tag) = 0;
+
+    /// @brief Duplex exchange. Lower role id sends first.
+    virtual std::vector<std::uint8_t> exchange_bytes(trio & net,
+        unsigned peer_id, msg tag, const void * data, std::size_t n) = 0;
+
+    /// @brief Homogeneous vector exchange (one frame each way, same length).
+    virtual std::vector<std::uint8_t> exchange_vec_bytes(trio & net,
+        unsigned peer_id, msg tag, const void * data, std::size_t nbytes) = 0;
+
+    /// @brief Round-batched peer sink for `count` instances.
+    virtual std::unique_ptr<RoundSink> batch(trio & net, std::size_t count,
+        std::vector<std::size_t> slot_bytes) = 0;
+};
+
+}  // namespace net
+}  // namespace dpf
+
+#endif  // LIBDPF_INCLUDE_DPF_NET_COMM_HOOK_HPP__