Function leaf_assumptions

zisk/host/src/main.rs:532–552

Mirror of the leaf guest's assumption rule (`zisk/guest/src/main.rs`): the direct `Constant.refs` of every checked target that are neither in the checked set nor data blobs — the constants the leaf *assumes* well-typed. Computed against the full env; the guest computes it against the injected sub-env, whose constants are byte-identical, so the sets agree. Returned sorted + deduped (a set; `merkle_

(
  env: &IxonEnv,
  targets: &[ix_common::address::Address],
)

/// fold). `witness = Some(per-child (subject set, assumption set))` selects
/// mode 1 (set discharge): the guest verifies each list's canonical root
/// against the child's committed publics, then discharges assumptions proven
/// by sibling subjects. Witness order must match `proofs` order.
fn agg_stdin(
  allowed_vks: &[Vec<u8>],
  proofs: &[Vec<u8>],
  witness: Option<&[(Vec<u8>, Vec<u8>)]>,
) -> ZiskStdin {
  let stdin = ZiskStdin::new();
  stdin.write(&u32::from(witness.is_some())); // mode
  stdin.write(&(allowed_vks.len() as u32));
  for vk in allowed_vks {
    stdin.write(vk);
  }
  stdin.write(&(proofs.len() as u32));
  for bytes in proofs {
    stdin.write(bytes);
  }
  if let Some(w) = witness {
    assert_eq!(w.len(), proofs.len(), "witness/proof count mismatch");
    for (s_blob, a_blob) in w {
      stdin.write(s_blob);
      stdin.write(a_blob);
    }
  }