Bring the compute to the client's bucket

The client already keeps its archives in a national cloud's object store, in-country, under a contract that took legal six months. They will not move the data. They want the analytics.

You rent a box in the same country and connect the bucket as an S3-compatible backend, giving hoody-files the provider's endpoint. The bucket mounts inside the container as a path. Your pipeline reads from it, writes results back to it, and never stages a copy anywhere else. The national provider stays the system of record; your machine is a process next door.

The client's legal position doesn't change, because nothing the contract covers moved. The bucket is where it was, under the agreement it was under. What changed is that a computer in the same jurisdiction can now read it.