feat: parliament daemon, login gate, peer context sync (0.9.13)

Login claims the chair, writes a session ticket, and starts a background
service for discovery plus revision-based context sync. Password Realm
opens require --login (or CST_REALM_PASSWORD); --service/--service-stop
manage the resident agent.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/cst_parliament.h

@@ -44,6 +44,28 @@ int cst_parliament_new_project(const char *project_id);
 int cst_parliament_context_put(const char *text);
 char *cst_parliament_context_get(void);
 
+/* Local login ticket: opens require a fresh chair session (or password env). */
+int cst_parliament_session_write(const char *instance_id);
+int cst_parliament_session_ok(char *instance_id_out, size_t n);
+void cst_parliament_session_clear(void);
+
+/* Apply a peer sync bundle (higher revision already selected by caller). */
+int cst_parliament_apply_sync(unsigned long revision, const char *parliament_id,
+                              const char *project_id, const char *chair,
+                              const char *context);
+
+/* Background parliament service: discover + peer listen + context sync. */
+int cst_parliament_daemon_pidfile(char *out, size_t n);
+int cst_parliament_daemon_running(void);
+/* Start in background (Unix fork). password unlocks Realm in the child.
+ * Returns 0 and writes pid. If already running, returns 0. */
+int cst_parliament_daemon_start(const char *password, const char *instance_id,
+                                int peer_port, char *err, size_t err_sz);
+int cst_parliament_daemon_stop(void);
+/* Foreground service loop (used by --service and the forked child). */
+int cst_parliament_daemon_run(const char *password, const char *instance_id,
+                              int peer_port, char *err, size_t err_sz);
+
 #ifdef __cplusplus
 }
 #endif

include/cst_parliament_cli.h

@@ -11,6 +11,13 @@ int cst_parliament_cli_realm_new(void);
 int cst_parliament_cli_realm_password_init(const char *password);
 int cst_parliament_cli_login(const char *password, const char *instance_id,
                              const char *device_label);
+/* Login then ensure background parliament service (discover + sync). */
+int cst_parliament_cli_login_and_serve(const char *password,
+                                       const char *instance_id,
+                                       const char *device_label, int peer_port);
+int cst_parliament_cli_service(const char *password, const char *instance_id,
+                               int peer_port, int foreground);
+int cst_parliament_cli_service_stop(void);
 int cst_parliament_cli_new_project(const char *project_id);
 int cst_parliament_cli_realm_enroll(const char *instance_id, const char *label);
 int cst_parliament_cli_peer_listen(int port, const char *instance_id);

include/cst_peer.h

@@ -15,9 +15,11 @@ typedef struct {
   cst_realm_cert_t remote;
   char host[64];
   int port;
+  intptr_t sock; /* open until cst_peer_close */
 } cst_peer_session_t;
 
-/* Dial host:port, prove our cert, verify theirs. 0 on success. */
+/* Dial host:port, prove our cert, verify theirs. 0 on success.
+ * Leaves sock open for post-handshake sync; call cst_peer_close. */
 int cst_peer_dial(const char *host, int port, const cst_realm_cert_t *self,
                   const uint8_t self_sk[64], const uint8_t realm_pk[32],
                   int timeout_ms, cst_peer_session_t *out, char *err,
@@ -29,6 +31,21 @@ int cst_peer_accept(intptr_t listen_sock, const cst_realm_cert_t *self,
                     int timeout_ms, cst_peer_session_t *out, char *err,
                     size_t err_sz);
 
+void cst_peer_close(cst_peer_session_t *s);
+
+/* After handshake: exchange parliament revision/context. Higher revision wins
+ * and is written locally via the callbacks. Returns 0 on success. */
+typedef struct {
+  unsigned long revision;
+  char parliament_id[64];
+  char project_id[64];
+  char chair_instance[64];
+  char *context; /* malloc'd when loading; freed by caller after sync */
+} cst_peer_sync_bundle_t;
+
+int cst_peer_sync(cst_peer_session_t *s, cst_peer_sync_bundle_t *local,
+                  int timeout_ms, char *err, size_t err_sz);
+
 #ifdef __cplusplus
 }
 #endif

include/cst_version.h

@@ -3,7 +3,7 @@
 
 #define CST_VERSION_MAJOR 0
 #define CST_VERSION_MINOR 9
-#define CST_VERSION_PATCH 12
+#define CST_VERSION_PATCH 13
 
 #define CST_VERSION_STR_(x) #x
 #define CST_VERSION_STR(x) CST_VERSION_STR_(x)