The source's documents never touch a laptop or a cloud drive

The reporter has a container on a bare metal server the newsroom rents. The files go straight to the container's files URL. Reading happens in a workspace: a file panel, a PDF viewer, ripgrep server-side for names and dates. Outbound traffic is routed at the host through a SOCKS5 exit the reporter chose, so any link a document opens leaves from somewhere else. The laptop holds a browser tab.

The disk is LUKS-encrypted with the key held off the machine. Hoody's API sees a container; the proxy serving the files runs on that server, and Hoody is not aware of what they contain.

The documents exist in one rack, under one rented lease, read through a window that forgets.