Struct DeterministicStewardList 

pub struct DeterministicStewardList { /* private fields */ }

Implementations

impl DeterministicStewardList

pub fn empty( conversation_id: impl Into<Vec<u8>>, config: StewardListConfig, ) -> Self

Joiner-side: empty list. The coordinator fills it from the ConversationSync it receives after the welcome.

pub fn with_creator( conversation_id: impl Into<Vec<u8>>, creator_identity: Vec<u8>, config: StewardListConfig, ) -> Result<Self, CoreError>

Creator-side: bootstrap with the creator as the sole steward at epoch 0. No election, no retries.

Trait Implementations

impl Debug for DeterministicStewardList

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl StewardListPlugin for DeterministicStewardList

fn config(&self) -> &StewardListConfig

Steward list bounds + protocol-level flags.

fn set_config(&mut self, config: StewardListConfig)

Replace the active config — joiner sync path adopts the conversation-wide values. Preserves list and retry state; subsequent install_list calls use the new bounds.

fn current_list(&self) -> Option<&StewardList>

Borrow the active list. None for joiners pre-ConversationSync.

fn election_epoch(&self) -> Option<u64>

Epoch at which the active list was elected. None if no list.

fn retry_round(&self) -> u32

Current retry round (0 for fresh elections, bumped on each rejected proposal within the same MLS epoch). Distinct from the list’s frozen retry_round historical tag.

fn max_retries(&self) -> u32

Conversation-configured ceiling on steward-election retries. Joiners pick this up via ConversationSync.

fn set_max_retries(&mut self, max: u32)

fn is_steward(&self, identity: &[u8]) -> bool

True iff identity sits in the active list.

fn is_exhausted(&self, epoch: u64) -> bool

True iff epoch falls outside the list’s covered window [election_epoch, election_epoch + len). A new election MUST follow once the list is exhausted.

fn epoch_steward<F: Fn(&[u8]) -> bool>( &self, epoch: u64, eligible: F, ) -> Option<&[u8]>

Steward responsible for epoch, walking the rotation past any candidate for whom eligible returns false. Pass |_| true for the nominal position.

fn epoch_and_backup<F: Fn(&[u8]) -> bool>( &self, epoch: u64, eligible: F, ) -> (Option<&[u8]>, Option<&[u8]>)

Live epoch steward + backup, guaranteed distinct when ≥2 are eligible. Backup is None when fewer than two stewards are eligible.

fn steward_members<F: Fn(&[u8]) -> bool>(&self, eligible: F) -> Vec<Vec<u8>>

Steward roster filtered by eligible. Used by the coordinator to build ConversationSync.steward_members so joiners don’t inherit ghosts or members queued for removal.

fn election_proposer<F: Fn(&[u8]) -> bool>(&self, eligible: F) -> Option<&[u8]>

Deterministic election proposer when the list exhausts. Walks rotation from index 0; returns None if no steward is eligible.

fn install_list( &mut self, epoch: u64, candidate_pool: &[Vec<u8>], sn: usize, retry_round: u32, ) -> Result<Vec<StewardListEvent>, CoreError>

Generate and install a steward list of size sn from candidate_pool. retry_round is the seed fed into the SHA256 sort and stored on the resulting list as its historical tag — pass the round from the accepted election proposal, or 0 for creator bootstrap and sn_min auto-fills (no election).

fn validate_proposed( &self, proposed: &[Vec<u8>], epoch: u64, candidate_pool: &[Vec<u8>], retry_round: u32, ) -> Result<bool, CoreError>

True iff proposed matches what this plug-in would generate for the same parameters. Coordinator calls this on the joiner path before applying an election result.

fn propose_election<F: Fn(&[u8]) -> bool>( &self, epoch: u64, candidate_pool: &[Vec<u8>], self_identity: &[u8], eligible: F, recovery: bool, ) -> Result<ElectionDecision, CoreError>

Decide whether this node SHOULD file a steward-election proposal and, if so, return the proposal contents. Coordinator passes the candidate pool it built (MLS members minus pending-removal targets minus any extra excludes), the eligibility predicate (typically the same set as the pool), recovery = true to bypass the list-exhaustion gate, and the node’s own identity. Plug-in handles authorization + ordering; coordinator handles has_election_in_flight + the I/O submit.

fn maybe_auto_fill( &mut self, epoch: u64, members: &[Vec<u8>], ) -> Result<Vec<StewardListEvent>, CoreError>

Re-install the list when membership policy says it must change (e.g. RFC rule: members.len() < sn_min ⇒ everyone is a steward). Coordinator calls this after every membership-changing commit without checking the rule itself; the plug-in decides whether to act. Returns events only when a re-install actually fired.

fn bump_retry(&mut self) -> Vec<StewardListEvent>

Increment the retry round. Emits StewardListEvent::RetryExhausted once the new round exceeds max_retries.

fn reset_retry(&mut self)

Reset the retry round to 0 (called on accepted election or successful commit).