The evidence never travelled. The auditor did.

The SOC 2 auditor needs six months of /hoody/storage/logs and the change records under /audit. The usual answer is a 40GB zip on a transfer service and a week of "can you re-send."

Instead you create a container for the audit and share the directory into it: POST /api/v1/containers/{id}/storage/shares with the source_path, the audit container as target_container_id, mode: readonly, and expires_at set to the engagement's last day. The audit container accepts the share and it appears under /hoody/shares/; the auditor browses it through that container's own hoody-files URL. POSIX semantics hold, file locks included, and the audit box can sit on a different physical server from production.

The auditor reads the real files where they live. Nothing is copied, so nothing is left behind on a laptop. On the last day the share expires and the mount is gone.

The evidence never travelled. The auditor did.