Function challenge 

pub fn challenge(r_bytes: &[u8; 32], a_bytes: &[u8; 32], msg: &[u8]) -> Scalar

The ed25519 challenge scalar c = SHA-512(R ‖ A ‖ M) reduced mod ℓ.

This deliberately does NOT carry the FROST domain separator — the whole point is to produce a signature that any RFC-8032 verifier accepts. The only prefix is the implicit one baked into SHA-512 of R || A || M, exactly as RFC 8032 §5.1.7 prescribes.