Every Operator receives and stores transfer-participant metadata

What the evidence shows

Technical and product details

1. Documented behavior

   In Spark's reviewed V3 consensus path, the coordinator selects every configured Operator. The participant-side implementation says Prepare runs on every SO and persists Transfer and TransferLeaf rows even on Operators outside the signing set. 12

   Supporting material shown on this page

   all-Operator transfer persistencePinned source code · github.com · checked 2026-07-14

   82// Prepare runs on every SO. It validates the transfer package, decrypts this SO's
   83// slice of the sender key tweaks, persists Transfer + TransferLeaf rows in the
   84// pre-commit `SenderKeyTweakPending` state, and produces local FROST round-2
   85// signature shares for the leaves where this SO is part of the signing set.
   86//
   87// SOs outside the signing set still write rows; they return nil shares.
   88func (h *SendTransferFlowHandler) Prepare(ctx context.Context, op proto.Message) (proto.Message, error) {

   all-Operator consensus selectionPinned source code · github.com · checked 2026-07-14

   374	if err != nil {
   375		return nil, err
   376	}
   377	selection := helper.OperatorSelection{Option: helper.OperatorSelectionOptionAll}
   378	if _, err := engine.Execute(ctx,
   379		pbgossip.ConsensusOperationType_CONSENSUS_OPERATION_TYPE_SEND_TRANSFER,
   380		&selection,

2. Documented behavior

   The reviewed legacy V3 path likewise sends every other Operator the sender identity, receiver identities, transfer package, and refund signatures. Each participant parses those identities and transactions before creating its local transfer rows. 34

   Supporting material shown on this page

   legacy transfer fan-outPinned source code · github.com · checked 2026-07-14

   420		TransferId: req.GetTransferId(),
   421		SenderPackages: []*pbinternal.InitiateTransferSenderPackage{{
   422			SenderIdentityPublicKey:        senderPkg.GetOwnerIdentityPublicKey(),
   423			TransferPackage:                senderPkg.GetTransferPackage(),
   424			ReceiverIdentityPublicKeys:     senderPkg.GetReceiverIdentityPublicKeys(),
   425			RefundSignatures:               cpfpRefundSignatures,
   426			DirectRefundSignatures:         directRefundSignatures,

   participant-side transfer creationPinned source code · github.com · checked 2026-07-14

   645		senderPkg.GetTransferPackage(),
   646		req.GetExpiryTime().AsTime(),
   647		senderIdentityPubKey,
   648		receivers,
   649		leafReceiverMap,
   650		cpfpLeafRefundMap,
   651		directLeafRefundMap,

Scope control

What this does not establish

• This establishes behavior in both reviewed V3 paths. It does not establish production retention periods, staff access, civil identity, or that any one Operator can sign a transfer by itself. 1234

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.