spark.exposed

Centralization

The reviewed Operator policy exposes a Lightspark-only SSP coordination surface with an IP-restricted anonymous subset

The pinned Operator policy defines a Lightspark-only SSP coordination surface. Nineteen operational methods use an anonymous application policy behind an internal IP restriction; newer SSP flows additionally require a session. This identifies a privileged network security boundary, not public access or misuse. 1

1 sourceEvidence reviewed through August 24, 2026

What the evidence shows

Technical and product details

  1. Documented behavior

    In the pinned Operator source, policy_lightspark.go is compiled only with the lightspark build tag and describes SparkSspInternalService as the “Lightspark-only SSP coordination surface.” 1

    Supporting material shown on this page

    Lightspark-only SSP policyPinned source code · github.com · checked 2026-08-24
    Relevant lines from the pinned source · open raw file
    10// Every method is IP-protected; subsets either accept anonymous callers (legacy "ops" RPCs) or require a session token
11// (newer flows that go through the same sspcore client used by external partners).
12//
13// Despite the "internal" name these aren't AuthOperatorBrontide: the SSP isn't a signing operator, so it can't complete
14// the Noise_XK handshake against the operator set, and this service is only registered on the public listener. The IP
15// allowlist really is the only caller gate for the anonymous subset.
16func init() {
  2. Documented behavior

    Nineteen listed operational RPCs use AuthAnonymous with InternalOnly: true. The source comment says this subset is protected by an IP allowlist, while a separate set of newer SSP flows requires both a session token and the internal-only policy. 1

    Supporting material shown on this page

    Lightspark-only SSP policyPinned source code · github.com · checked 2026-08-24
    Relevant lines from the pinned source · open raw file
    10// Every method is IP-protected; subsets either accept anonymous callers (legacy "ops" RPCs) or require a session token
11// (newer flows that go through the same sspcore client used by external partners).
12//
13// Despite the "internal" name these aren't AuthOperatorBrontide: the SSP isn't a signing operator, so it can't complete
14// the Noise_XK handshake against the operator set, and this service is only registered on the public listener. The IP
15// allowlist really is the only caller gate for the anonymous subset.
16func init() {
  3. Documented behavior

    The anonymous subset includes queries and repair or synchronization operations such as CancelStuckTransfer, InitiateCounterTransfer, QueryNodes, SyncTransfer, and QueryStaticDepositAddresses. 1

    Supporting material shown on this page

    Lightspark-only SSP policyPinned source code · github.com · checked 2026-08-24
    Relevant lines from the pinned source · open raw file
    10// Every method is IP-protected; subsets either accept anonymous callers (legacy "ops" RPCs) or require a session token
11// (newer flows that go through the same sspcore client used by external partners).
12//
13// Despite the "internal" name these aren't AuthOperatorBrontide: the SSP isn't a signing operator, so it can't complete
14// the Noise_XK handshake against the operator set, and this service is only registered on the public listener. The IP
15// allowlist really is the only caller gate for the anonymous subset.
16func init() {

Interpretation

Why this matters for Spark's trust model

The policy documents a privileged operational surface whose anonymous subset relies on network location rather than per-request session authentication. That makes the IP allowlist and the private SSP environment part of the security boundary. 1

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • “Anonymous” here means no application-level session in the reviewed policy; it does not mean publicly reachable. The code expressly describes IP restriction, and the method names are consistent with legitimate recovery and synchronization work. This record does not show unauthorized access, misuse, or the live allowlist configuration. 1

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Lightspark-only SSP policy

Pinned source code · github.com · Pinned or archival · checked 2026-08-24

Open original source

How sources, absence findings, and limitations were evaluated