Government Documents

The Cochran Block, LLC
7452 School Avenue, Dundalk, MD 21222
[email protected] · cochranblock.org
EIN: 41-3835237

Certifications & Registrations
SAM.gov — Active · CAGE 1CQ66 · UEI W7X3HAQL9CF9 · EIN 41-3835237
Maryland CSB (Certified Small Business) — Approved
SDVOSB (Service-Disabled Veteran-Owned Small Business) — Final Review (VetCert/SBA)
Maryland eMMA — Vendor SUP1095449 · ACH Direct Deposit Active
crates.io — 32 published crates at crates.io/users/gotemcoach
GitHub — 31 repositories at github.com/cochranblock

Audit the source — github.com/cochranblock

Core Competencies
• Memory-safe compiled architecture (Rust) — aligned with CISA Secure-by-Design mandate
• Zero-cloud single-binary deployment — eliminates cloud attack surface entirely
• On-device AI inference — no data exfiltration, runs in air-gapped environments
• DevSecOps binary optimization — 48 KB to 51.5 MB release binaries with full SBOM
• Edge computing and IoT integration — LoRa/915MHz mesh, ARM/RISC-V targets
• Autonomous threat detection — 312 KB APT hunter, zero-config deployment

NAICS Codes
541511 — Custom Computer Programming Services
541512 — Computer Systems Design Services
541519 — Other Computer Related Services
518210 — Computing Infrastructure Providers
541330 — Engineering Services
541690 — Other Scientific and Technical Consulting

Past Performance
• cochranblock.org — Production website. 10 MB binary, $10/month, 31 products, intake forms, booking calendar, community grant app. Self-hosted on bare metal.
• oakilydokily.com — First paying client. Waiver management, digital intake, ESIGN compliance. Bare metal via Cloudflare Zero Trust.
• Pixel Forge — AI sprite generator with on-device diffusion models. 3 MoE models, LoRA fine-tuning. Pure Rust.
• USCYBERCOM J38 JMOC-E — Dev lead for Congressional NDAA-directed offensive cyber operations study.
• 31 public GitHub repos — All code auditable at github.com/cochranblock

Differentiators
• Proven federal contracting posture — CAGE 1CQ66, UEI W7X3HAQL9CF9, SAM.gov Active
• Single-binary = zero infrastructure — 10MB replaces $36K/year cloud stacks for $120/year
• Rust = memory-safe mandate compliance — Aligned with CISA Secure-by-Design, EO 14028, NIST SP 800-218
• 32 published crates on crates.io at crates.io/users/gotemcoach
• 31 Rust repositories with Proof of Artifacts and Timeline of Invention
• 4 inventions, 3 architecture patterns, 5 techniques — honestly classified at cochranblock.org/arch
• 13 years defense and enterprise — USCYBERCOM J38 dev lead, Congressional NDAA study
• Army 17C (Cyber Operations), JCAC 2014
• All Rights Reserved — The Cochran Block, LLC

Past Performance
• oakilydokily.com — First paying partnership. Waiver management, digital intake, ESIGN. Deployed on bare metal via Cloudflare Zero Trust.
• cochranblock.org — Live production site. 31 products, intake forms, SQLite, booking calendar. 10 MB binary, $10/month total infrastructure.
• USCYBERCOM J38 JMOC-E — Dev lead for Congressional NDAA-directed offensive cyber operations study.

Contact
Michael Cochran, Owner
[email protected]
cochranblock.org/book — Schedule a call
cochranblock.org/deploy — Start a project

Problem Statement
Federal agencies spend $36,000+/year per application on cloud infrastructure. These deployments create single points of failure, expose sensitive data to third-party providers, and require dedicated DevOps teams. Forward-deployed and disconnected environments cannot rely on cloud connectivity for mission-critical operations.

Technical Innovation
CochranBlock has developed a compiled single-binary architecture in Rust that eliminates cloud dependency entirely. A complete web application — server, database, authentication, TLS, asset pipeline — compiles into a 10 MB binary that runs on commodity hardware ($10/month total infrastructure). This architecture is proven in production at cochranblock.org, serving multiple domains from a single laptop.

Key Technical Capabilities
• Single-binary deployment — Entire application stack compiles to one executable. No containers, no orchestration, no package managers. Deploy by copying one file.
• On-device AI inference — Local LLM execution via custom Mixture-of-Experts architecture. No API calls, no data exfiltration risk. Runs on consumer GPUs.
• Edge-native by design — Operates in disconnected, intermittent, and limited-bandwidth (DIL) environments. Zero external dependencies at runtime.
• Distributed C2 mesh — Multi-node orchestration via SSH with tokenized command compression. Nodes operate independently and resync when connectivity restores.
• Zero-trust architecture — AES-256-GCM encryption, HKDF key derivation, Argon2id password hashing. No plaintext secrets in source. Cloudflare Zero Trust tunnel integration.
• Embedded storage — sled (embedded key-value store) + bincode serialization + zstd compression. No external database servers. Data lives with the application.
• 97% cost reduction — Demonstrated: $36,000/year cloud → $120/year bare metal. Same availability, same performance, fraction of the attack surface.

Relevant SBIR/STTR Technology Areas
• AI/Autonomy — On-device inference, Mixture-of-Experts routing, edge AI for sensor processing
• Cybersecurity — Zero-trust compiled architecture, embedded encryption, no third-party attack surface
• Edge Computing — DIL-capable single-binary deployment, IoT gateway (LoRa/915MHz)
• Advanced Computing — Compiled Rust replacing interpreted cloud stacks, WASM-capable architecture
• Command and Control — Distributed node mesh with compressed tokenized command protocol

Proof of Concept — Live Production Systems
• cochranblock.org — 15-product portfolio site. 10 MB binary. SQLite intake forms. Booking calendar. Cloudflare tunnel. $10/month.
• oakilydokily.com — Waiver management and digital intake with ESIGN compliance. Bare metal deployment.
• Kova augment engine — Local LLM inference, agentic tool loop, distributed node C2, cargo/git tokenization. Single binary.
• Approuter — Reverse proxy with automatic Cloudflare tunnel management, app registry, multi-domain routing. Single binary.
• 31 repositories — All source code publicly auditable at github.com/cochranblock

Phase I Objectives (6 months, $250K)
1. Formalize the single-binary deployment framework as a reusable platform for federal applications
2. Demonstrate on-device AI inference for classified/sensitive workloads with zero cloud dependency
3. Deploy proof-of-concept in a simulated DIL environment with multi-node mesh recovery
4. Deliver security assessment and ATO-ready documentation package

Phase II Path ($2M, 18–24 months)
1. Harden for IL4/IL5 deployment with FIPS 140-3 cryptographic module integration
2. Build agency-specific application templates (case management, intake, reporting)
3. Integrate with DoD identity providers (CAC/PIV authentication)
4. Develop training curriculum for agency adoption

Commercialization
The technology has immediate dual-use application. Commercial clients (startups, SMBs) pay $3,500 base deployment + $225/hour consulting. Federal clients access through SBIR Phase III, GSA Schedule 70, or direct contract. Year 1 projected gross: $150,000.

Principal Investigator
Michael Cochran — Army 17C (Cyber Operations), JCAC 2014. 13 years defense and enterprise. USCYBERCOM J38 JMOC-E dev lead for Congressional NDAA-directed offensive cyber operations study. 30% service-connected disabled veteran.

Solicitation Target: DoD SBIR 26.1 Phase I (Army/CYBERCOM) — AI/Autonomy, Cybersecurity, Edge Computing
Estimated Open: April 2026 · Phase I: $250,000 / 6 months

Topic Alignment
DoD requires mission-critical applications that operate in disconnected, intermittent, and limited-bandwidth (DIL) environments without dependence on commercial cloud providers. Current containerized deployments require network connectivity, container orchestration, and cloud-hosted databases — none of which are available at the tactical edge.

Proposed Innovation
CochranBlock's compiled single-binary architecture eliminates every external dependency. A complete application — web server, database, AI inference engine, encryption, and asset pipeline — ships as one 10 MB executable. No Docker. No Kubernetes. No package manager. No internet required at runtime. Copy the file, run it, the mission continues.

Technical Objectives — Phase I
1. Deploy single-binary web application in a simulated JWICS/SIPRNet disconnected environment with zero external dependencies
2. Demonstrate on-device AI inference (classification, NLP, anomaly detection) using custom Mixture-of-Experts model running on commodity GPU hardware
3. NanoSign model integrity — 36-byte BLAKE3 signatures on all AI model files, verified at load time. Unsigned or tampered models are rejected before inference. Zero-infrastructure supply chain security for AI at the tactical edge
4. Validate multi-node mesh recovery — nodes operate independently during network partition and resync state when connectivity restores
5. Deliver threat model and security architecture document suitable for ATO initiation at IL4

Technical Objectives — Phase II ($2M / 24 months)
1. FIPS 140-3 cryptographic module integration for IL5 deployment
2. CAC/PIV authentication integration via PKCS#11
3. Cross-domain solution compatibility assessment (CDS guard integration points)
4. Field trial with operational unit in DIL exercise environment
5. Transition plan for PEO/PM adoption

Past Performance
• PI served as dev lead at USCYBERCOM J38 JMOC-E for a Congressional NDAA-directed offensive cyber operations study
• Army 17C (Cyber Operations), JCAC 2014, 30% service-connected disabled veteran
• 31 Rust repositories demonstrating every claimed capability — auditable at github.com/cochranblock
• cochranblock.org running in production as a single 10 MB binary on $10/month infrastructure

Solicitation Target: NSF SBIR Phase I (America's Seed Fund) — Artificial Intelligence, Software
Estimated Open: April–May 2026 (rolling after restart) · Phase I: $275,000 / 6 months

Topic Alignment
NSF Seed Fund seeks deep technology innovations with commercial potential. Current AI deployment requires cloud API calls — sending sensitive data to third-party servers, paying per-token fees, and depending on network connectivity. There is no production-grade framework for running full AI inference on local hardware inside a compiled application.

Proposed Innovation
CochranBlock has built a working on-device AI inference system (Kova) that runs local LLM models through a custom Mixture-of-Experts router inside a single compiled Rust binary. No API calls. No data leaves the device. The system includes an agentic tool loop (read, write, edit, search, execute), tokenized command compression for minimal context overhead, and distributed node orchestration for scaling across commodity hardware.

Technical Objectives — Phase I
1. Package on-device inference engine as a reusable Rust library crate (WASM-safe, no-std compatible)
2. Benchmark inference latency and quality on standardized tasks (external cloud APIs may be used solely as calibration reference points; never in the production path)
3. Demonstrate privacy-preserving AI for healthcare (HIPAA), legal (attorney-client privilege), and defense (classified) use cases
4. NanoSign model signing — 36-byte BLAKE3 integrity verification for AI model files. Prevents model poisoning and ensures provenance without key infrastructure
5. Publish reproducible benchmarks and make the inference runtime available under commercial license

Technical Objectives — Phase II ($1M / 24 months)
1. Train domain-specific expert models (cybersecurity, code generation, document analysis) from production data
2. Build model marketplace for community-contributed experts with quality gates
3. Mobile deployment (Android/iOS) — on-device inference on consumer phones
4. Enterprise SDK with API compatibility layer for drop-in cloud replacement

Commercialization Path
• Direct sales: $3,500 base deployment for SMBs replacing $36K/year cloud AI bills
• Enterprise licensing: Per-seat for on-device inference runtime
• Federal: SBIR Phase III transition to DoD/IC for classified AI workloads
• Commercial licensing with support

Solicitation Target: DHS SBIR FY2026 — Cybersecurity and Infrastructure Security Agency (CISA)
Estimated Open: Summer 2026 · Phase I: $250,000 / 6 months

Topic Alignment
CISA's mission includes securing federal civilian networks and critical infrastructure. Current architectures depend on cloud-hosted security tools, SaaS SIEM platforms, and containerized microservices — each adding third-party attack surface. When an adversary compromises the cloud provider, every tenant is exposed. Critical infrastructure operators need security tools that run locally, operate offline, and present zero external attack surface.

Proposed Innovation
CochranBlock's zero-trust architecture is secure by compilation, not configuration. The entire application compiles to a single binary with AES-256-GCM encryption, HKDF key derivation, and Argon2id password hashing built in. No plaintext secrets in source. No external secret managers. No runtime dependency injection. The binary IS the security boundary — if it's not compiled in, it doesn't exist.

Technical Objectives — Phase I
1. Deploy zero-trust edge node at a simulated critical infrastructure site (water/power/transportation) with zero cloud dependency
2. Demonstrate real-time log aggregation and anomaly detection using on-device AI inference — no data exfiltration to cloud SIEM
3. NanoSign AI model integrity verification — BLAKE3-based 36-byte model signing prevents supply chain poisoning of on-device ML models. Self-verifying, no key infrastructure, no network required
4. Validate IoT device monitoring via LoRa/915MHz mesh network for air-gapped OT environments
5. Produce NIST 800-53 control mapping for the single-binary architecture
6. Deliver pen test results and security assessment from independent third party

Technical Objectives — Phase II ($2M / 24 months)
1. Integration with CISA's Continuous Diagnostics and Mitigation (CDM) program
2. Automated SBOM generation from compiled binary (full dependency tree at build time)
3. Incident response playbook execution engine running on-device
4. Multi-site mesh deployment with encrypted state synchronization
5. FedRAMP-equivalent security documentation package

Past Performance
• PI: 13 years defense and enterprise cybersecurity. USCYBERCOM J38 JMOC-E dev lead.
• Army 17C (Cyber Operations) — trained at JCAC (Joint Cyber Analysis Course), 2013
• Live production system (cochranblock.org) running zero-cloud architecture with Cloudflare Zero Trust integration
• 31 repositories — full supply chain transparency, every dependency auditable

Zero vendor lock-in. All core code is All Rights Reserved. Government or Prime owns their deployment 100%. No recurring licensing. No proprietary runtime. No vendor dependency.

Every repo ships with a Timeline of Invention (TOI) and Proof of Artifacts (PoA) providing commit-level AI provenance documentation. This eliminates accidental copyright infringement risks from AI-generated code — every human decision and AI contribution is documented, dated, and hash-verified.

No DevOps team required. We replace Kubernetes clusters and microservices with single, memory-safe, statically linked Rust binaries — often under 50 KB. No dependency chains to patch. No container images to rebuild. No orchestration layer to manage.

Patching = rebuild the binary from pinned Cargo.lock + SCP to the server. If the hardware has power, the binary runs. Total sustainment burden: one file.

Modern ATO delays are caused by bloated attack surfaces — cloud supply chains, Docker vulnerabilities, exposed Node/Python runtimes, 500+ transitive dependencies with unknown provenance.

Our architecture eliminates that attack surface:

• Zero cloud supply chain — no AWS, no Azure, no GCP dependency
• Zero unnecessary open ports — one binary, one port, behind Cloudflare Zero Trust
• Zero interpreted runtimes — compiled Rust, memory-safe by construction
• Complete SBOM at compile time — every dependency pinned and auditable
• NIST SP 800-218 (SSDF) compliance documented — see SSDF matrix below

Built by a former USCYBERCOM J38 JMOC-E offensive cyber operations dev lead. The architecture was designed to survive the audits, not to pass them after the fact.

Radical financial transparency. The Open Books page calculates IR&D hours and value in real-time from GitHub commit timestamps. Every hour is machine-verified, not self-reported. The methodology is public. The data is auditable.

IR&D costs documented per FAR 31.205-18. AI tooling costs separately trackable as materials under FAR 31.205-26. Founder hours valued at published $225/hr rate.

This is continuously auditable by design — not DCAA-compliant because we hired an accountant, but because the entire operation is transparent by architecture.

All dependencies sourced from crates.io. Versions pinned in Cargo.lock. Full transitive tree: cargo tree --features approuter. Zero vendored binaries. Zero pre-built shared libraries.

Cryptographic Primitives

NanoSign — AI Supply Chain Integrity

AI model files ship unsigned. NanoSign appends 36 bytes (4-byte magic + 32-byte BLAKE3 hash) to any model file — safetensors, GGUF, ONNX, PyTorch. The file becomes self-verifying with zero infrastructure. No key servers, no PKI, no ceremony. Verification runs at memory bandwidth (~6 GB/s). A 4GB model verifies in under 1 second. Aligns with EO 14028 supply chain transparency requirements, SSDF PS.1 (protect software components), and CMMC SC.L2-3.13.11 (CUI encryption). Reference implementation: 3 lines of Rust.

Attack Surface

• Network exposure: One port (8081) behind approuter (8080) behind Cloudflare tunnel. No direct internet exposure.
• Input validation: All form inputs validated server-side. HTML-escaped output prevents XSS. No SQL injection (parameterized queries via sqlx).
• Error handling: thiserror for typed errors. No stack traces exposed to users. Errors logged via tracing, not displayed.
• Dependencies: 42 direct deps, all from crates.io. No C dependencies except openssl (system library). No vendored binaries.
• Memory safety: 100% Rust. No unsafe blocks in application code. Memory-safety CVE classes eliminated by construction.
• Secrets: No plaintext secrets in source. Environment variables loaded from .env file with restricted permissions.