Air-gapped frontier coding agents for regulated codebases

The problem

Regulated engineering orgs ban cloud coding assistants because every prompt ships proprietary code to a third-party API. Developers route around the ban with personal laptops and shadow AI, leaving infosec blind. Existing self-hosted assistants run small models that cannot do repo-scale agentic work, so the teams that need AI help most get the weakest tools.

The idea

Why now

Step-5 open weights landed Oct 15: the first 600B-class open-weight model scoring AA index 44 at roughly one-eighth the per-task cost of Claude Opus 5, with 1M-token context for whole-codebase work. Meanwhile Copilot's June 2026 switch to metered AI credits made heavy agentic usage painfully expensive, so self-hosted economics finally beat cloud for large teams.

What it combines

stepfun-step-5-preview-open-bf16-weights-released (frontier-class open weights with 1M context) + janas-run-llms-bigger-than-your-ram-from-ssd (SSD offloading puts huge models on modest hardware) + autotrust-jev-35b (typed judgments as a machine-readable approval gate). Open weights alone are a download; offloaded, gated, and harnessed they become a product an infosec team can actually sign off on.

MVP

Weekend MVP: docker-compose with vLLM serving a small open coder model plus an Aider-style agent loop and a Jev-gated tool-call policy file. Deliberately skip: the 600B weights, SSO, multi-user, and the audit UI. Prove one thing: a repo task completes end-to-end with a tcpdump showing zero external network calls.

How it makes money

The moat

GitHub/Microsoft cannot ship this in one quarter: their revenue is metered cloud usage (AI credits), so an air-gapped appliance destroys their meter, and their frontier models are closed, so they have no open weights to ship offline. It would cannibalize their billing model and require an architecture they do not have.

Distribution

Direct B2B to platform-engineering and infosec teams at banks, insurers, and defense contractors. Wedge: 'the only AI coding tool your auditors will approve.' Also listable on the GitHub Enterprise Server marketplace, which already serves air-gapped customers.

Why it wins

TabbyML, Sourcegraph Cody, and Continue.dev are self-hosted but built on small models; none offer 600B-class long-context agentic coding with per-action judgment gates and audit trails designed for regulated sign-off.

Risks

Even with offloading, 600B BF16 is slow on modest hardware, which could kill the demo. De-risk by starting from the 27B-active MoE quantized, measuring tokens/sec on a single RTX box, and only promising the full model where the numbers hold.

Build it with

• StepFun Step-5-Preview — open BF16 weights releasedFrontier-class 600B MoE with 1M context as the coding engine, at one-eighth the API cost
• Janas: run LLMs bigger than your RAM from SSDSSD offloading pattern so the huge model runs on workstation-class hardware
• autotrust JEV-35B: 35B-A3B open decision model with calibrated probabilitiesTyped judgments as the approve/deny/escalate gate on every agent tool call

Repo to start from

airgap-coder: one-box compose file (vLLM + agent harness + Jev policy gates) plus an egress test proving no data leaves the machine.

Evidence

• GitHub Copilot Enterprise plan pricing ($39/user/month)
• GitHub ships AI secret detection for air-gapped Enterprise Server
• Bank staff run restricted AI tools on personal laptops (shadow AI)
• GitHub Copilot metered billing backlash (credit shock for agent users)
• Step-5-Preview BF16 open weights on Hugging Face