# What Is the Role of the Trust Validator in the Career-Ops Provider System?

> Discover the trust validator's role in the Career-Ops system. It filters job postings, assigns trust scores, and classifies them for efficient downstream evaluation.

- Repository: [Santiago Fernández de Valderrama/career-ops](https://github.com/santifer/career-ops)
- Tags: deep-dive
- Published: 2026-07-03

---

**The trust validator acts as a lightweight, non-blocking filter that assesses the trustworthiness of every job posting discovered by the scanner, enriching each job with a numeric score, classification flags, and a human-readable trust level before it proceeds to downstream evaluation.**

The trust validator is a critical component in the `santifer/career-ops` repository that serves as an early-stage quality gate for job postings. Unlike blocking filters that might discard entries entirely, this validator ensures every job entering the system carries metadata indicating its reliability. According to the source code in `providers/_trust-validator.mjs`, the validator runs automatically on every job the scanner discovers, applying heuristic checks to detect spam, phishing attempts, and low-quality listings.

## How the Trust Validator Enriches Job Objects

For each job discovered by the scanner, the validator adds three distinct fields to the job object without dropping any entries from the pipeline:

- **`trustScore`** (0-100) – A numeric confidence value representing the calculated reliability of the posting
- **`trustFlags`** (string[]) – Identifiers of specific heuristics that lowered the score, such as `invalid_url` or `suspicious_domain`
- **`trustLevel`** (`high` | `medium` | `low`) – A human-readable classification derived from the numeric score

This enrichment strategy ensures that **low-trust jobs are flagged rather than filtered**, allowing downstream components in `scan.mjs` to decide whether to auto-apply, discard, or manually review suspicious postings.

## Heuristic Checks Inside the Trust Validator

The trust validator applies four distinct heuristics defined in the comment block at the top of `providers/_trust-validator.mjs`. These checks are implemented using the `DEFAULT_SUSPICIOUS_DOMAINS` and `DEFAULT_ATS_ALLOWLIST` constants.

### URL Structure Validation

The validator ensures every job posting contains a well-formed `http` or `https` URL. Malformed or protocol-less URLs immediately reduce the trust score and trigger the `invalid_url` flag.

### Missing Application URL Detection

Jobs that lack a URL entirely are flagged with `missing_url`, significantly lowering the trust score since legitimate career opportunities require a valid application endpoint.

### Suspicious Domain Detection

The validator penalizes links belonging to known URL-shortening services or other dubious domains. By default, domains like `bit.ly` and `tinyurl.com` are tracked in `DEFAULT_SUSPICIOUS_DOMAINS`, triggering the `suspicious_domain` flag when detected.

### Company-Domain Mismatch Analysis

The validator compares the advertised company name against the job URL's hostname. A mismatch triggers the `company_domain_mismatch` flag, though this check is bypassed when the hostname belongs to a known ATS (Applicant Tracking System) allow-list such as `greenhouse.io` or `lever.co`, defined in `DEFAULT_ATS_ALLOWLIST`.

## Configuring the Trust Validator Behavior

The `buildTrustValidator(config)` factory function creates customized validator instances based on user-provided configuration from [`portals.yml`](https://github.com/santifer/career-ops/blob/main/portals.yml). This configurability allows users to adapt the trust validator to their specific needs:

- **Enable or disable** the validator entirely using the `enabled: false` option
- **Extend suspicious domains** by providing additional entries in `suspicious_domains`
- **Expand ATS allow-lists** by adding trusted platforms to `ats_allowlist`

The configuration-driven approach ensures the trust validator remains flexible while maintaining sensible defaults for common job board scenarios.

## Integration with the Career-Ops Scanning Pipeline

In `scan.mjs`, the trust validator loads alongside other filters such as `buildLocationFilter` and `buildSalaryFilter`. When the scanner parses a job, it invokes the validator function and merges the resulting `score`, `flags`, and `level` into the job object.

Downstream modes—including `oferta` and `pipeline`—can then utilize this trust metadata to:
- Surface high-trust opportunities in priority views
- Auto-filter or quarantine low-trust postings
- Trigger manual review workflows for medium-trust jobs

## Implementation Example

```javascript
import { buildTrustValidator } from './providers/_trust-validator.mjs';

// Configuration from portals.yml
const trustConfig = {
  enabled: true,
  suspicious_domains: ['shorturl.at', 'rebrand.ly'],
  ats_allowlist: ['greenhouse.io', 'lever.co']
};

// Build validator instance
const validateJob = buildTrustValidator(trustConfig);

// High-trust job example
const legitimateJob = {
  url: 'https://jobs.example.com/apply/12345',
  company: 'Acme Corp'
};

console.log(validateJob(legitimateJob));
// → { score: 100, flags: [], level: 'high' }

// Low-trust job with multiple violations
const suspiciousJob = {
  url: 'https://bit.ly/evil',
  company: 'Acme Corp'
};

console.log(validateJob(suspiciousJob));
// → { score: 25, flags: ['suspicious_domain','company_domain_mismatch'], level: 'low' }

```

## Summary

- The trust validator in `providers/_trust-validator.mjs` enriches every job with `trustScore`, `trustFlags`, and `trustLevel` metadata without blocking entries from the pipeline.
- Four heuristics check URL validity, missing URLs, suspicious domains, and company-domain mismatches against configurable allow-lists.
- Users customize validation behavior through [`portals.yml`](https://github.com/santifer/career-ops/blob/main/portals.yml) via the `buildTrustValidator(config)` factory function.
- `scan.mjs` integrates the validator as a non-blocking filter, allowing downstream modes to prioritize high-trust opportunities and flag suspicious postings.

## Frequently Asked Questions

### What happens to low-trust jobs in Career-Ops?

Low-trust jobs are annotated with reduced scores and relevant flags but are **not automatically removed** from the system. Downstream components, such as the `pipeline` or `oferta` modes, can access the `trustLevel` and `trustFlags` fields to decide whether to display, quarantine, or require manual review of these postings.

### How does the trust validator handle URL shorteners?

The validator detects URL shorteners by comparing the job's hostname against the `DEFAULT_SUSPICIOUS_DOMAINS` array, which includes services like `bit.ly` and `tinyurl.com`. When detected, the validator assigns the `suspicious_domain` flag and reduces the `trustScore` accordingly.

### Can I disable the trust validator?

Yes. Users can set `enabled: false` in the trust validator configuration section of [`portals.yml`](https://github.com/santifer/career-ops/blob/main/portals.yml). When disabled, `buildTrustValidator()` returns a pass-through function that does not modify job objects, effectively bypassing all trust checks while maintaining pipeline compatibility.

### Where is the trust scoring logic defined?

The core trust scoring logic resides in `providers/_trust-validator.mjs`, specifically within the `buildTrustValidator` function and the heuristic check implementations spanning lines 18-48. The constants defining suspicious domains and ATS allow-lists are also declared in this file.