Struct SsaCommitmentBuilder 

pub struct SsaCommitmentBuilder<S: PixSpec> {
    id: SsaId<S::Pseudonym>,
    poly_threshold: usize,
    poly_surplus: usize,
    num_polys: usize,
    target_useful_shares: u64,
    committed_polynomials: HashMap<PolynomialIndex, PixGroup<S>>,
    total_committed: usize,
    complete: bool,
    exit_commitment_secret: PixScalar<S>,
    exit_commitment_public: PixGroup<S>,
    commitment_proof: Option<SsaCommitmentProof<S>>,
    full_ssa_commitment: Option<(PixGroup<S>, S::DepositAddress)>,
}

Builds a complete SSA from the incoming client constant-term commitments of the SSA-part polynomials for a specific Session Stealth Address (SSA).

One commitment per polynomial arrives, so “the SSA commitment is known” and “every polynomial is reconstructible” are the same event: committed_polynomials.len() == num_polys.

Fields

id: SsaId<S::Pseudonym>

poly_threshold: usize

Shares needed to reconstruct one polynomial, as negotiated at session establishment.

The commitments no longer carry the degree, so this is the only source for it. It is handed to every SsaPartBuilder as its min_shares.

poly_surplus: usize

Shares the peer said it would emit per polynomial beyond Self::poly_threshold, as negotiated at session establishment.

Handed to every SsaPartBuilder as its max_credited_surplus. Kept alongside the threshold rather than derived from it: the two are independent halves of the negotiated PixParams word, and the ratio between them is an operator choice.

num_polys: usize

target_useful_shares: u64

Useful shares that constitute full recovery, taken from PixParams::target_useful_shares rather than recomputed here.

Carried down to SsaCycle so the number a consumer compares against its own expectation has one source. It reaches SsaRecoveryProgress::target_useful_shares, which is documented as a protocol-violation detector — and two derivations of a detector can disagree, at which point the disagreement reads as the violation.

committed_polynomials: HashMap<PolynomialIndex, PixGroup<S>>

Constant-term commitments received so far, decoded: each is decompressed and subgroup-checked exactly once, on arrival. Keeping the compressed representation instead would force a second decompression when the part builders are created, and decompression is the dominant per-commitment cost.

Drained when the part builders are handed out.

total_committed: usize

Commitments received so far, counted across polynomials that have since been handed out. Used for is_empty, which would otherwise report empty again after the drain.

complete: bool

exit_commitment_secret: PixScalar<S>

exit_commitment_public: PixGroup<S>

commitment_proof: Option<SsaCommitmentProof<S>>

First SsaCommitmentProof the peer supplied, checked once the constant-term set is complete — that is the point at which the commitment it opens becomes known.

Only the first is kept: any single valid proof is sufficient, and Schnorr proofs are randomised, so there is nothing to reconcile between several of them.

full_ssa_commitment: Option<(PixGroup<S>, S::DepositAddress)>

Implementations

impl<S: PixSpec> SsaCommitmentBuilder<S>

pub fn new( id: SsaId<S::Pseudonym>, params: PixParams, exit_commitment_secret: PixScalar<S>, exit_commitment_public: PixGroup<S>, ) -> Self

Takes the whole negotiated triple rather than the two fields it used to read.

The surplus is the third, and it was the one previously dropped on the floor at the call site: the Session layer held a PixParams and destructured two fields out of it. Keeping the type intact is what makes the per-polynomial surplus budget available down here — see SsaPartBuilder::max_credited_surplus.

pub fn is_empty(&self) -> bool

true if not a single coefficient commitment has been received yet.

Counts rather than inspecting committed_polynomials, which is drained when the part builders are handed out and would therefore report empty again afterwards.

pub fn get_deposit_address(&self) -> Option<&S::DepositAddress>

pub fn missing_runs( &self, max_runs: usize, ) -> Vec<(PolynomialIndex, PolynomialIndex)>

Polynomial-index runs whose constant-term commitment has not arrived, lowest first.

Empty once the set is complete. The runs are what the Exit puts on the wire to ask the peer to re-send the pieces a lost packet took with it: loss is chunk-shaped, because the sender splits the set into packet-sized slices of consecutive polynomial indices, so one lost packet is one run of a couple of dozen indices and “nothing arrived at all” is a single run.

Truncated to max_runs, which is how many the asking message can carry. Lowest-first rather than an arbitrary subset so that successive asks converge on the same prefix instead of interleaving, and so the answer to one is never a subset of the answer to the next.

An empty result therefore means the set is complete, and nothing else — max_runs is raised to one rather than honoured at zero, so a caller that branches on emptiness cannot be told “nothing is missing” by its own budget.

pub fn add_transposed( &mut self, coeff_index: CoefficientIndex, proof: Option<SsaCommitmentProof<S>>, polynomial_coeff_commitments: impl Iterator<Item = (PolynomialIndex, PixGroupRepr<S>)>, ) -> Result<CommitmentProgress<S>, S::Pseudonym>