Explainer
“Air-gapped” describes a network with no connection to outside networks. It gets used loosely in AI tooling, so this explainer sets out what it means for a coding agent, and where Topsoil does and does not fit.
A truly air-gapped network has no path to the internet or to other networks. Software and data cross the gap only by deliberate, controlled transfer. Any AI model used there has to run on hardware inside the gap.
| Situation | What reaches the model | What it takes |
|---|---|---|
| Fully disconnected network | Nothing outside; the model runs inside | Model servers and inference hardware inside the network, and a process for bringing updates across |
| Private network path to a cloud model service | Requests go over a private connection, such as AWS PrivateLink, rather than the public internet | A cloud account and a private endpoint the machine can route to |
| Restricted egress | Only allow-listed endpoints are reachable | A firewall or proxy policy that lists the model endpoint |
Topsoil is not designed for a fully disconnected network. It needs a reachable model endpoint: Amazon Bedrock, a custom HTTPS endpoint, or a customer-hosted gateway. What it does offer is a small, known set of destinations. Network egress is limited to the endpoints you configure, there is no Thazen service, telemetry, crash reporter or CDN fetch, and the desktop app supports public Bedrock endpoints, custom HTTPS endpoints and reachable PrivateLink and VPC paths.
That makes Topsoil a fit for the second and third situations above: a private path to Bedrock in your own AWS account, or a tightly restricted egress policy. See the network paths.
Questions
Not in a fully disconnected one. Topsoil needs a reachable Amazon Bedrock, custom HTTPS or gateway endpoint. It does work over private network paths such as AWS PrivateLink, and with egress restricted to the endpoints you configure.
A pilot runs in your own AWS account, with your models and your material, and ends with findings you can act on.