Function commitment_signed_payload 

pub fn commitment_signed_payload(
    root: &[u8; 32],
    key_count: u32,
    sender_peer_id: &[u8; 32],
    sender_public_key: &[u8],
) -> Vec<u8> 

Canonical bytes the ML-DSA signature covers: the commitment fields minus the signature itself.

sender_public_key is length-prefixed and included so an adversary cannot keep the body and re-sign under a different key.