Hello World

Hello, world. I'm building SignalKit and Assurcast.

A first post from an auditor who codes. Also, a deliberate test of the LinkedIn syndication that just delivered this to your feed.

Hi. I'm Jamie. Ontiveros.me is my IndieWeb presence — the place where I write, publish, and federate out to Assurcast, LinkedIn, Nostr, and a few other networks. Everything you read here originates here first.

I want to use this first post to do three things: introduce myself, sketch the day-job that informs the work, and explain what SignalKit and Assurcast are and why they exist.

Audit by trade, builder by inclination

My day job is auditing. The specific flavor varies, but the through-line is steady: identify risks, examine a system or process, document the controls, test the evidence, surface the exceptions, propose the remediation, and track progress. The intellectual move is trust with verification. Non-auditors can relate. We don't trust the marketing copy. We trust the audit trail.

A couple of decades-plus in this work shaped how I think about everything else, including software.

When you spend your days looking at the gap between what a system claims to do and what it actually does, you start to notice the same gap everywhere. In SaaS terms-of-service. In platform algorithms that decide whether your post reaches the people who already chose to follow you. In analytics dashboards that count things you never agreed to be counted on. In privacy policies written by lawyers who have never opened the underlying database.

The gap is the work. Closing it even on a small surface, even just for myself, is satisfying in a way that's hard to explain to people who haven't done audit work.

Audit thinking applied to publishing infrastructure

For a long time I treated my online presence the way most people do: distributed across silos, owned by no one, easy to lose, expensive to migrate. Short writing on Twitter. Professional identity on LinkedIn. Photos on whichever platform was popular that decade. Newsletters inside whichever Substack-shaped tool I'd signed up for.

This approach doesn't survive an audit. I.e. no source of truth.

So I started building toward the IndieWeb model: my own domain, my own data, my own publishing tool, federation out to silos rather than posting directly into them. POSSE - Publish on your Own Site, Syndicate Elsewhere. This turns out to be the exact pattern an auditor would design for content. The source of truth lives where the verifying party can reach it. Copies on other networks are syndications, not originals. If a silo platform ends tomorrow, the audit trail survives.

That posture is the thing I'm building for everyone with SignalKit, and for the audit and assurance community specifically with Assurcast.

SignalKit

SignalKit is a self-hostable, brand-neutral content platform. Drop the build into a shared-hosting account, configure it from the browser, and you have:

- A blog and short-note publishing surface, with IndieWeb microformats baked into the markup
- Syndication out to Nostr, LinkedIn, and email subscribers (the LinkedIn part is brand new. This post is the first real test)
- An IndieAuth identity provider so you can use your domain to sign in to other IndieWeb tools, including Assurcast.com. 
- A Micropub endpoint so you can publish from any compatible client
- Webmention support so when someone on another site links to you, the link shows up under your post automatically

It's brand-neutral on purpose. The UI says whatever you tell it to say. The same code runs my personal site  and will run anyone else's site who wants to drop it onto a server. Signalkit was based on Assurcast, more below. 

The opinionated part of SignalKit isn't the features. It's the defaults. No third-party trackers. No analytics shipped to a vendor. Configuration in an admin UI rather than environment variables. Encrypted secrets. A correction-of-error practice (in the repo's `docs/coe/` folder) for capturing engineering mistakes systemically rather than as individual "remember better next time" entries. Those are audit defaults applied to developing a publishing tool.

Assurcast

Assurcast is the sibling project. SignalKit is the publishing tool; Assurcast is what I'm building on top of it for the audit and assurance professional community specifically. It's a content platform, a Nostr relay (`wss://relay.assurcast.com/`), and a federation hub for assurance-adjacent writing.

The hypothesis: there's a cohort of audit-and-assurance professionals who want a place to share information and insights that isn't LinkedIn's algorithmic feed and isn't a closed paid-membership platform. Information is meant to be shared on the internet. Assurcast is that place for auditors. The upcoming Nostr relay gives community members a portable identity — your npub follows you across whichever client you use, and the relay's allowlist confirms you're part of the cohort.

Whether Assurcast becomes a thriving community or a small-but-useful one is open. Either way, it serves as the second production instance of the tech stack powering Signalkit. This keeps me and the platform code honest about our self-hosting promise: if it doesn't work at scale, it doesn't work.

What you'll see here

A mix:

- Build notes on SignalKit and Assurcast as features ship.
- Process posts on engineering practices that earn their weight in real conditions. The next post out the door is one of those — why a Correction of Error practice is more reliable than memory, written off the back of a real bug I shipped a few days ago.
- **Audit reflections** at the intersection of audit thinking, artificial intelligence, and software building.
- Short notes — quick observations, links, things I'm reading. Many of these will syndicate to Nostr but not LinkedIn (different audiences, different cadences).

If you want to follow along: RSS, Nostr (the npub will be on the site soon), email (subscribe form on the homepage), or LinkedIn - wherever you already are. If you want to interact, the IndieWeb way is best: link to the post from your own site and your platform will send a webmention if it supports them. I'll see it. We can talk in public, on the open web, the way the open web was supposed to work. If your platform doesn't support webmentions, think about SignalKit. 

In closing

Most of the engineering work on SignalKit, including the LinkedIn syndication path that just delivered this post to your LinkedIn feed, was done collaboratively with an AI agent. At this time that's Claude. I want to be honest about that, the way the COE practice keeps the development process honest about repeat mistakes.

Working with an AI agent on this kind of project is, in my experience, what the future of work will likely resemble. The collaboration produces real output, fast. It also still requires the human to know what's right, decide what's worth shipping, and own the result.

That posture, audit thinking applied to AI collaboration, is part of what I'm trying to figure out, in public, here.

Welcome. Glad you found this post. Hope to see you here or on Assurcast.com. 

— Jamie