DEV Community

Redman WorkflowAlpha
Redman WorkflowAlpha

Posted on

USB Coding Expert: The Air-Gap Requirement That Shows Up in Procurement, Not in the Feature List

#security #procurement #airgap #infosec

The requirement arrives before the tool does

Nobody writes a ticket that says "buy a USB stick with an AI model on it". What they write
is a requirement, and the tool is whatever happens to satisfy it:

"No external API calls, no telemetry, no code leaves the facility. Tooling must be
removable without residue. No installation on managed endpoints."

Once that sentence is in the request, every cloud-hosted coding assistant is out — not
because it is worse, but because it cannot be made to comply without changing the sentence.
A browser plugin still makes a network call. A self-hosted container still installs
something. A policy memo saying "we won't paste secrets" is not an engineering control, and
the reviewer knows it.

This is the situation USB Coding Expert (https://reggiebro.github.io/WorkflowAlpha.ai/usb-coding-expert/, $149.99
one-time) is built for, and the way it answers is structural rather than contractual.

What the reviewer is actually testing

When someone reviews a tool for a restricted environment, they are usually checking four
things. Here is how a bootable image lands on each:

1. Can you install it?
No. The image boots the machine's own kernel from the USB drive. There is no host-OS
modification, no dual-boot entry, no virtualization layer, and no package on the managed
endpoint's software inventory. Flash it to any USB 3.0 drive, 16 GB or larger, plug it into
any x86-64 machine, select the USB as the boot device, and you are running in under 60
seconds. On a machine with Windows, Linux, or no operating system at all.

2. Does it need a network?
The session operates with zero network connectivity. The model runs on local CPU/GPU
resources — no API calls, no telemetry, no phone-home, no exfiltration path. For a
classified or commercially sensitive codebase this is not a privacy toggle; it is what
makes the tool usable at all. If the code has to stay in the building, the assistant that
reads it should not have a route out of the building.

3. Does it leave anything behind?
In amnesiac mode, nothing. The system runs entirely from the USB in memory. Nothing is
written to the host's hard drive, no registry entries are created, no temporary files
survive the session, and no boot configuration is altered. Shut down, pull the drive, and
the host is byte-for-byte identical to its pre-boot state. "We removed the temp files" is
not an answer a reviewer accepts. "There were no temp files" is.

4. Can it be used on a machine we do not own?
Yes — which is why the page lists security researchers, penetration testers carrying an
air-gapped environment into client sites, developers handling classified code, and people
who code on hotel and conference machines they refuse to install on.

The mode nobody asks about until they do

The image ships with two boot modes, and the choice is made per boot:

  • Amnesiac — the default. The session evaporates. Nothing on the host, nothing on the drive. This is the mode that answers the four questions above in one move.
  • Persistent — an encrypted partition on the USB for projects, configuration, and conversation history between sessions, protected by a passphrase you set. Without the passphrase the partition is unreadable. Note what it does not do: it does not write to the host. Your state lives on your own drive.

If your security review asks "and what about the data on the stick", the persistent mode is
the answer, and it is the answer with a key you hold rather than a vendor.

What is in the box

The package is the image plus everything the image needs, with no download step at setup:

  • Bootable USB image — OS, model, and all runtime dependencies, boots in under 60 seconds
  • Model files — full weights, pre-configured for local inference, no setup download
  • Boot scripts — hardware detection, environment setup, model loading, plus a first-boot wizard for passphrase setup and hardware configuration
  • Documentation — flashing instructions for Windows, macOS, and Linux; boot-mode selection; hardware requirements and compatibility; usage examples; troubleshooting; air-gapped security best practices
  • 30-day support — direct email support after purchase, covering installation issues, hardware compatibility, configuration, and usage, with a 24-hour response target on business days

That last item matters for a procurement path. A 30-day window is where you get the
hardware-compatibility and flashing questions answered in writing while the person who can
answer them is still paid to.

Try the demo before you raise anything

The page has a working interactive demo: describe what you want in plain English, pick a
language — Python, JavaScript, Bash, or Solidity — and it generates real code in the
browser. No install, no account, no signup.

https://reggiebro.github.io/WorkflowAlpha.ai/usb-coding-expert/

Use it to check the part you cannot verify from a spec sheet: whether the output quality is
good enough for the work you are actually doing. The air-gap claims are structural and
inspectable. Code quality is the thing you have to see.

Getting it

The page lists email as the only contact method: workflowalpha.ai@gmail.com. Use that
address to request the package — payment instructions come back from there, and the package
is delivered after confirmation, either as a download link or pre-flashed to a USB drive.

No discount is being offered and no urgency is attached to this. The price is the price and
the page is the source of truth.

Top comments (0)