KNOXAI — Operator Onboarding
Description: KNOXAI — operator-run guild certifying AI models are free of CSAM and harmful content. Hardware-keyed, dual-signed, peer-reviewed.

For Named Operator Only · Eyes Only · Do Not Forward
Operator Onboarding · Document v0.1 · 2026-04-16

# KNOXAI

The Guild Handbook
Platform: The Cochran Block, LLC
Operator #0: Michael Cochran (Founder)
Operator #1: Harris
Operator #2: You?
Founding Advisor: TBD
Jurisdiction: Maryland, USA
CAGE · UEI: 1CQ66 · W7X3HAQL9CF9
OA Effective: 2026-04-14 (signed, public)
Doc Status: Operator-facing

## 01 What You Just Agreed To

You're joining KNOXAI as a vetted operator. That means you'll run AI-model audits, sign certificates with a hardware key you hold, and get paid per cert signed. You are not an employee of The Cochran Block, LLC. You are an independent operator in a peer-reviewed guild, paid through the platform on a revenue-split basis.

You accepted a TAC member's referral. That member vouched for you. Your performance reflects on them.

Three things you are agreeing to by reading this

1. You will run the methodology as written. You will not shortcut gates.

2. Your hardware signing key will never leave your physical control.

3. If you find illegal material during an audit, you will report it per the platform's mandatory-reporting path (§8). No discretion.

Everything else — pricing, splits, rotation, rep scoring — is detail you can negotiate or adjust. These three are non-negotiable. Break any of them and you're expelled from the directory, named publicly, and the guild refunds any cert you signed before we knew.

## 02 Pick Your Lane

Every operator is tagged with one or more specialties. Tags drive customer routing, reputation, and rate tiers. You self-declare at onboarding; your TAC referrer confirms or amends.

Tag | Who you are | Gates you're strongest on
--- | --- | ---
redteam | Offensive cyber, adversarial prompting, "find what's hidden" | 2, 5
ml-research | Published adversarial ML / membership inference / unlearning | 3
ml-eng | Training pipeline internals, framework-level auditor | 4
data | Dataset provenance, statistical corpus analysis | 4
safety | AI safety research, eval design, harmful-output classifiers | 2, 5
cleared | Active U.S. security clearance (orthogonal) | Gov tier only

Most operators carry 1–2 tags. Triple-tag operators exist (founder-level, MATS alumni with clearance, etc.) — they're the rare unicorns and they command the highest per-audit rates.

Dual-signed certs

Portfolio and Gov tier certs require two operators with complementary tags to sign. Example: one `redteam` + one `ml-research`. Two hardware keys, two touch events, two different people in two different houses. No single compromised operator can forge a dual-signed cert.

## 03 Build Your Signing Device

Every operator holds their own hardware signing key. The platform does not hold keys. The platform cannot forge signatures. If a cert is signed by you, you signed it, on your hardware, with your finger.

### Parts list (≈ $40)

ESP32-WROOM-32 | Any DevKitC or equivalent (CP2102 or CH340 USB bridge). ~$8.
Fingerprint sensor | R307 or FPC1020 module. UART, 150-template on-chip storage. ~$15–20.
LoRa SX1276 / RFM95W | 915 MHz module (US) or 868 MHz (EU). ~$8. Optional in v0.1 but required for vault deployment.
RGB LED + 3× 220Ω resistors | Status indicator. ~$1.
Dupont wires, breadboard | Initial bring-up. ~$5.
18650 Li-ion + charging board | Battery + TP4056 module. ~$6.
Fire safe with bolt-down kit | Combination lock, fire-rated (UL 350). ~$80–120. Single coax passthrough hole drillable.

### Provisioning flow (one-shot, irreversible)

    # 1. Flash the signer firmware
    knoxai-sign flash --port /dev/ttyUSB0

    # 2. Enable ESP32 secure boot + flash encryption (burns eFuses FIRST, before key)
    knoxai-sign secure-boot --confirm-irreversible

    # 3. Generate P-256 keypair inside ESP32, burn private key to eFuse
    knoxai-sign provision --operator-id <your-slug>

    # 4. Export public key (one-time operation, private key stays in silicon)
    knoxai-sign export-pubkey > pubkey-<your-slug>.pem

    # 5. Enroll fingerprints — all 10, each mapped to a cert action (§6)
    knoxai-sign enroll-fingers

    # 6. Submit pubkey to the directory
    knoxai-sign directory submit pubkey-<your-slug>.pem

Order matters

Enable secure boot + flash encryption BEFORE burning the signing key. If you burn the key first, firmware dumps are readable on physical theft of the device. Order of eFuse burns is permanent. There is no "undo." Run the provision wizard and don't skip steps.

### Where the device lives

Inside a bolted-down fire safe in your home. Drilled coax passthrough for the LoRa antenna. Antenna mounted on the outside of the safe. The device is battery-powered, in listen mode, for months at a time. You open the safe only during a signing ceremony.

The vault is portable. You can move it. You can take it with you when you move houses. The only thing that has to stay within ~10 feet of the vault during signing is any machine running `knoxai-sign` — bt (my case), a laptop, or a phone with a USB LoRa dongle.

## 04 The Methodology

The audit is five gates. Every cert says which gates passed and which were skipped (with documented reason). Gate coverage depends on your specialty tags — skip the lanes that aren't yours.

### Gate 1 — Hash scan all operators

Pipeline work. Run the submitted model over a test-prompt battery, hash every output with PhotoDNA-compatible (or PDQ if NCMEC partnership not yet active), compare against the platform's hash database. Any match auto-fails and auto-reports per §8.

No judgment call required. Automated end-to-end. Every operator runs this regardless of specialty.

Gate 2 — Red-team battery

Own this if you're tagged `redteam` or `safety`.

You run the platform's curated prompt battery (500+ prompts, refreshed quarterly) PLUS your own bespoke vectors for the specific model class. You craft prompts the platform doesn't know about — that's the part that can't be automated. You know what adversaries look like.

Each output gets classified by the platform's open-weights safety classifier stack (CLIP nudity + age detector + Llama Guard 3 + Detoxify). You review borderline cases personally. False positives are expensive for the customer; don't rubber-stamp.

Output: a pass/fail + the full prompt-and-response log (hash included in cert artifact).

Gate 3 — Membership inference

Own this if you're tagged `ml-research`.

Take the platform's curated set of known-bad training artifacts (NCMEC hash list partnership, or proxy set for v0.1). For each artifact, run the caption-conditioned generation protocol: prompt the model with the caption, measure reproduction fidelity via SSIM, LPIPS, perceptual hash distance.

High fidelity above threshold = model has memorized that specific image = model was trained on that specific image. That's a Gate 3 fail. You document the fidelity score per artifact in the cert artifact bundle.

This is the academic-rigor gate. Read the Carlini membership inference papers if you haven't. Reference implementations exist in the `knoxai-audit` crate.

Gate 4 — Dataset attestation (engineering side)

Own this if you're tagged `ml-eng`.

Customer submits a signed TOML manifest declaring training corpus. You validate: does the declared base model's SHA256 match the actual base? Do the declared fine-tune dataset hashes match what exists on disk at the cited URLs? Is LAION-5B (or a flagged derivative) in the chain? If so, did they re-scrub, and can you verify?

This is forensic engineering. You're not trusting the customer's declaration — you're verifying it against reality. When it doesn't match, the cert fails and the publisher is on record lying.

Gate 4 — Dataset attestation (data-science side)

Own this if you're tagged `data`.

Same gate, different angle. You look at the declared corpus statistically — distribution of image sizes, caption-length histograms, source-domain breakdown, suspicious shards. You know what a real LAION-5B subset's statistics look like. You can smell a synthesized or laundered manifest.

Cross-reference against flagged-dataset fingerprints maintained by the platform. Flag statistical anomalies for deeper review before you sign.

Gate 5 — Harmful output beyond CSAM

Own this if you're tagged `safety` or `redteam`.

Broader harm audit: bioweapon synthesis, CBRN planning, extremism, grooming-text generation, revenge-porn of identifiable real people, coordinated fraud. Tiered severity. Some categories auto-fail; others annotate the cert with a severity flag.

You use Llama Guard 3 + ShieldGemma + custom eval harnesses. Prompts drawn from the platform's library + your own. If you're coming from Anthropic / OpenAI / DeepMind safety, this lane uses skills you already use daily.

## 05 Taking Jobs

Customer submits a model to the platform. The dispatch server looks at the model type, the requested tier, and the operator directory. Then one of three things happens:

- Standard tier ($20): first available operator with matching tags auto-assigned. You get a notification, 15 minutes to accept or decline. Decline without penalty.
- Operator tier ($500): customer picked you specifically from the directory. You get 24 hours to accept. If you decline, customer picks the next operator.
- Portfolio / Gov tier: platform coordinates. You get a call from Michael or a TAC member. These are named engagements.

### SLA expectations

Standard | 72 hours from accept to cert delivery (automated gates should finish in under 4 hours; you review + sign within the rest)
Operator | 5 business days. Personal attention is the product; customers accept the longer window.
Portfolio | Negotiated per engagement. Usually monthly audit cadence.
Gov | Contract-specific. Clearance ops overhead applies.

## 06 The Signing Ceremony

You've run the gates. You have an audit-artifact hash. Time to sign.

1. Open the vault.
2. LED pulses amber — device received the audit hash over LoRa, waiting for biometric authorization. 30-second timeout.
3. Press the correct finger on the fingerprint sensor. Each finger maps to a cert action:

   R thumb | Full pass (all 5 gates)
   R index | Partial pass (documented skip)
   R middle | First-party cert (self-audit, rare)
   R ring | Revocation of a prior cert
   R pinky | Advisory sign-off (TAC review)
   L thumb | Emergency blacklist (mandatory NCMEC report)
   L index | Annual re-cert renewal
   L middle | Provenance (non-model document, receipts)
   L ring | Duress (silent — looks valid, carries coercion flag)
   L pinky | Kill switch (decommission this device, rotate key)

4. Sensor matches on-chip (template never exits the sensor). ESP32 reads your private key from eFuse. ECDSA P-256 sign.
5. LED goes green. Signature + cert action code returned over LoRa.
6. Close the vault.

Rules of the ceremony

- One touch = one cert. No batch mode. The firmware doesn't have the code path.
- Wrong finger = wrong cert type. An impersonator with a latex copy doesn't know your mapping.
- 30-second timeout. No touch = auto-reject. Prevents remote exploits waiting you out.
- Never sign a hash you didn't personally compute. Running gates on someone else's say-so is expulsion.

## 07 Getting Paid

### Revenue splits

Tier | Operator | Platform
--- | --- | ---
Standard ($20/yr) | 80% = $16 | 20%
Operator ($500/yr) | 70% = $350 | 30%
Portfolio ($5K–50K/yr) | 60% | 40%
Gov (per-engagement) | 50% | 50%

For dual-signed certs (Portfolio + Gov), the operator share is split 50/50 between the two operators. Platform take is unchanged.

### Payment flow

- Customer pays the platform via Stripe at cert purchase.
- You deliver the signed cert. Platform validates the hardware signature against your directory pubkey.
- Within 24 hours of validated delivery: your operator share lands in your Stripe Connect account.
- 1099-NEC issued at year-end by The Cochran Block, LLC for any calendar year you earn > $600.

You are a 1099 contractor. You handle your own taxes. The platform does not withhold. International operators: Stripe Connect handles the payout to your local currency; you're responsible for your jurisdiction's tax treatment.

## 08 Blacklist + Mandatory Reporting

You will eventually find something. Here's what to do.

### When a gate triggers a CSAM finding

1. Do not share the finding outside the reporting channel. Not in Slack, not with the customer, not with anyone. It is now evidence.
2. Sign the cert with your L thumb finger (emergency blacklist). This triggers:
   - Publisher flagged on `knox.cochranblock.org/blacklist`
   - Automated NCMEC CyberTipline report filed by the platform under 18 USC §2258A
   - Customer account frozen; refund not issued
   - Platform legal notified immediately
3. Preserve your local audit-artifact bundle. Encrypted storage. Platform legal will coordinate chain of custody with law enforcement if it comes to that.

Federal mandatory reporting

The Cochran Block, LLC is an electronic communication service provider under 18 USC §2258A. The platform files the required report. You are not required to file individually — but you must notify the platform within 60 minutes of finding. Failure to notify within 24 hours is expulsion.

### When a gate triggers non-CSAM harm (extremism, bioweapon, etc.)

Sign the cert with R index (partial pass). The cert records the severity class but does not trigger a federal report. Publisher may remediate and re-submit for re-cert. Platform may decline certain categories at its discretion (TAC decision).

## 09 Things That Get You Expelled

Any of the following results in immediate expulsion, public delisting, and refund of every cert you've signed in the preceding 90 days:

- Sharing your hardware signing device with another person, even briefly
- Signing a cert without personally running the gates you attest to
- Cert-farming (accepting obviously-clean re-submissions to bump your rate stats)
- Signing a cert for your own financial interest (undisclosed conflict of interest)
- Failing to trigger the blacklist path on a confirmed CSAM finding
- Discussing the specifics of a customer's model with anyone outside the audit
- Publicly claiming KNOXAI affiliation you don't have (e.g., "KNOXAI Certified" without an active cert)
- Accepting outside payment from a customer whose model you audited (no kickbacks)

Expulsion is permanent and named. Your operator entry moves to the public expelled list at `knox.cochranblock.org/expelled`. TAC is notified. Your referrer is notified. Your referrer's standing is reviewed.

## 10 Key Rotation + Succession

### If your signing device is compromised (lost, stolen, suspected tamper)

1. Notify platform within 60 minutes.
2. Platform publishes a revocation notice under your operator slug. Your old pubkey is flagged.
3. You provision a new device (§3). New pubkey gets a new slug (`your-name-2`). Old slug is frozen, not reused.
4. Certs you signed under the old key remain verifiable for their validity window (unless platform determines fraud, in which case they're retroactively revoked).

### If you die or become incapacitated

Your Operating Agreement analog (or the platform's operator agreement) specifies your successor. Options:

- No successor: your slug is retired; certs you signed remain valid through their expiration. No new certs under your key, ever.
- Named successor (another operator): they inherit your Portfolio-tier customer relationships (if any), but must provision their own hardware key. Your key dies with you. Your successor signs going forward under their own slug.

## 11 Your Public Reputation

Your operator entry is public at `knox.cochranblock.org/operators/<your-slug>`. The following is visible to anyone:

- Name (real name or pseudonym; your choice at onboarding)
- Specialty tags
- Pubkey fingerprint
- Joined date
- Total certs signed · pass rate · fail rate · revocation count
- Median time-to-turnaround per tier
- Dispute count (customer complaints that went to arbitration)
- Referrer (the TAC member who brought you in)
- Status: active · under review · expelled

The following is NEVER visible publicly:

- Your earnings
- Your customer list
- The specific models you audited
- Any personally-identifiable info you didn't opt to display
- Your physical address

## 12 Escalation

In order:

1. Your TAC referrer. The person who brought you in. First line for methodology questions, judgment calls, "does this feel off."
2. Any other TAC member. Directory at `knox.cochranblock.org/tac`. Peer escalation.
3. Michael (Operator #0, founder). `mcochran@cochranblock.org` — 24h response. Signal available on request.
4. Platform legal — for mandatory-reporting coordination, chain of custody, subpoena response. Contact via Michael only.

## 13 Appendix — Operator #0 Reference Entry

What your directory entry will look like. This is mine — use it as a template.

slugmichael-cochran
real nameMichael Cochran
locationBaltimore County, Maryland, USA
specialtiesredteam, ml-eng, cleared, founder
roleOperator #0 · KNOXAI founder
veteranUSCYBERCOM Offensive Cyber Operator · 100+ missions
entityThe Cochran Block, LLC · CAGE 1CQ66 · UEI W7X3HAQL9CF9
jurisdictionMaryland LLC, formed 2026-03-24, Doc #2345892
OA signed2026-04-14 · /operations · full stack: /constitution
pubkey`pending device provisioning`
repos31 public · github.com/cochranblock · Unlicense
notable workkova · approuter · approuter-acme · pixel-forge · nanobyte · tmuxisfree · ghost-fabric · aptnomo · cochranblock · rogue-repo · oakilydokily · illbethejudgeofthat · provenance-docs · call-shield · deglaze · battle-bros · any-gpu · pocket-server · header-writer · worldview · whyyoulying · wowasticker · ronin-sites
crates.iogotemcoach · 32 published
statusactive · founder · self-signed founding cert
joined2026-04-16 (Day 1)
referrer— (founder; no upstream referrer)
statscerts signed: 0 · pass rate: — · pre-launch

My resume is the reason this guild exists. Twenty-three public repos, one signed OA, one veteran-owned LLC with federal identifiers, one hundred-plus missions spent finding what's hidden in systems. My entry is the quality bar. Yours doesn't have to match it — you bring your own bar, I bring mine — but the format and transparency are the same.

Michael Cochran · Operator #0 · Founder · KNOXAI
mcochran@cochranblock.org · The Cochran Block, LLC · Baltimore County, MD
Document version 0.1 · 2026-04-16 · Revisions tracked at knox.cochranblock.org/onboarding-history
Feedback is welcome and will be reflected in v0.2. Your TAC referrer is your first stop.