Checkpoint the party/runtime stack before share-program and malicious-mode work.

Ship the TLS mesh, composer, Beaver/Yao/leaf MPC, prep/online paths, apps, and docs so the tree is pushable before elevating share_expr, security_mode, and prep resume.

Co-authored-by: Cursor <cursoragent@cursor.com>

party/registry.hpp

@@ -0,0 +1,51 @@
+/// @file party/registry.hpp
+/// @brief Named (2+1) party flows with tags for filtering and benchmarking.
+#ifndef LIBDPF_PARTY_REGISTRY_HPP__
+#define LIBDPF_PARTY_REGISTRY_HPP__
+
+#include <cstddef>
+#include <ostream>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include "dpf/net/trio.hpp"
+
+namespace dpf
+{
+namespace party
+{
+
+using flow_fn = int (*)(net::role self, net::trio & net);
+
+/// @brief One runnable flow. `tags` is a space-separated tag list.
+struct flow
+{
+    const char * name = nullptr;
+    const char * tags = nullptr;
+    flow_fn run = nullptr;
+    /// @brief When false, skip under `--tag bench` (reject / handshake-only).
+    bool bench = true;
+};
+
+void register_flow(flow f);
+void register_all_flows();
+
+const flow * find_flow(std::string_view name);
+bool flow_has_tag(const flow & f, std::string_view tag);
+
+/// @brief Two-party flow: spawn p0 and p1 only. IKNP has no dealer.
+bool flow_is_pair(const flow & f);
+
+/// @brief All flows, or those matching every comma-separated tag in `filter`.
+///        Empty filter returns every registered flow.
+std::vector<const flow *> select_flows(std::string_view filter);
+
+void list_flows(std::ostream & os, std::string_view filter = {});
+
+std::size_t flow_count();
+
+}  // namespace party
+}  // namespace dpf
+
+#endif  // LIBDPF_PARTY_REGISTRY_HPP__