What Is the Role of the Trust Validator in the Career-Ops Provider System?

The trust validator acts as a lightweight, non-blocking filter that assesses the trustworthiness of every job posting discovered by the scanner, enriching each job with a numeric score, classification flags, and a human-readable trust level before it proceeds to downstream evaluation.

The trust validator is a critical component in the santifer/career-ops repository that serves as an early-stage quality gate for job postings. Unlike blocking filters that might discard entries entirely, this validator ensures every job entering the system carries metadata indicating its reliability. According to the source code in providers/_trust-validator.mjs, the validator runs automatically on every job the scanner discovers, applying heuristic checks to detect spam, phishing attempts, and low-quality listings.

How the Trust Validator Enriches Job Objects

For each job discovered by the scanner, the validator adds three distinct fields to the job object without dropping any entries from the pipeline:

• trustScore (0-100) – A numeric confidence value representing the calculated reliability of the posting
• trustFlags (string[]) – Identifiers of specific heuristics that lowered the score, such as invalid_url or suspicious_domain
• trustLevel (high | medium | low) – A human-readable classification derived from the numeric score

This enrichment strategy ensures that low-trust jobs are flagged rather than filtered, allowing downstream components in scan.mjs to decide whether to auto-apply, discard, or manually review suspicious postings.

Heuristic Checks Inside the Trust Validator

The trust validator applies four distinct heuristics defined in the comment block at the top of providers/_trust-validator.mjs. These checks are implemented using the DEFAULT_SUSPICIOUS_DOMAINS and DEFAULT_ATS_ALLOWLIST constants.

URL Structure Validation

The validator ensures every job posting contains a well-formed http or https URL. Malformed or protocol-less URLs immediately reduce the trust score and trigger the invalid_url flag.

Missing Application URL Detection

Jobs that lack a URL entirely are flagged with missing_url, significantly lowering the trust score since legitimate career opportunities require a valid application endpoint.

Suspicious Domain Detection

The validator penalizes links belonging to known URL-shortening services or other dubious domains. By default, domains like bit.ly and tinyurl.com are tracked in DEFAULT_SUSPICIOUS_DOMAINS, triggering the suspicious_domain flag when detected.

Company-Domain Mismatch Analysis

The validator compares the advertised company name against the job URL's hostname. A mismatch triggers the company_domain_mismatch flag, though this check is bypassed when the hostname belongs to a known ATS (Applicant Tracking System) allow-list such as greenhouse.io or lever.co, defined in DEFAULT_ATS_ALLOWLIST.

Configuring the Trust Validator Behavior

The buildTrustValidator(config) factory function creates customized validator instances based on user-provided configuration from portals.yml. This configurability allows users to adapt the trust validator to their specific needs:

• Enable or disable the validator entirely using the enabled: false option
• Extend suspicious domains by providing additional entries in suspicious_domains
• Expand ATS allow-lists by adding trusted platforms to ats_allowlist

The configuration-driven approach ensures the trust validator remains flexible while maintaining sensible defaults for common job board scenarios.

Integration with the Career-Ops Scanning Pipeline

In scan.mjs, the trust validator loads alongside other filters such as buildLocationFilter and buildSalaryFilter. When the scanner parses a job, it invokes the validator function and merges the resulting score, flags, and level into the job object.

Downstream modes—including oferta and pipeline—can then utilize this trust metadata to:

• Surface high-trust opportunities in priority views
• Auto-filter or quarantine low-trust postings
• Trigger manual review workflows for medium-trust jobs

Implementation Example

import { buildTrustValidator } from './providers/_trust-validator.mjs';

// Configuration from portals.yml
const trustConfig = {
  enabled: true,
  suspicious_domains: ['shorturl.at', 'rebrand.ly'],
  ats_allowlist: ['greenhouse.io', 'lever.co']
};

// Build validator instance
const validateJob = buildTrustValidator(trustConfig);

// High-trust job example
const legitimateJob = {
  url: 'https://jobs.example.com/apply/12345',
  company: 'Acme Corp'
};

console.log(validateJob(legitimateJob));
// → { score: 100, flags: [], level: 'high' }

// Low-trust job with multiple violations
const suspiciousJob = {
  url: 'https://bit.ly/evil',
  company: 'Acme Corp'
};

console.log(validateJob(suspiciousJob));
// → { score: 25, flags: ['suspicious_domain','company_domain_mismatch'], level: 'low' }

Summary

• The trust validator in providers/_trust-validator.mjs enriches every job with trustScore, trustFlags, and trustLevel metadata without blocking entries from the pipeline.
• Four heuristics check URL validity, missing URLs, suspicious domains, and company-domain mismatches against configurable allow-lists.
• Users customize validation behavior through portals.yml via the buildTrustValidator(config) factory function.
• scan.mjs integrates the validator as a non-blocking filter, allowing downstream modes to prioritize high-trust opportunities and flag suspicious postings.

Frequently Asked Questions

What happens to low-trust jobs in Career-Ops?

Low-trust jobs are annotated with reduced scores and relevant flags but are not automatically removed from the system. Downstream components, such as the pipeline or oferta modes, can access the trustLevel and trustFlags fields to decide whether to display, quarantine, or require manual review of these postings.

How does the trust validator handle URL shorteners?

The validator detects URL shorteners by comparing the job's hostname against the DEFAULT_SUSPICIOUS_DOMAINS array, which includes services like bit.ly and tinyurl.com. When detected, the validator assigns the suspicious_domain flag and reduces the trustScore accordingly.

Can I disable the trust validator?

Yes. Users can set enabled: false in the trust validator configuration section of portals.yml. When disabled, buildTrustValidator() returns a pass-through function that does not modify job objects, effectively bypassing all trust checks while maintaining pipeline compatibility.

Where is the trust scoring logic defined?

The core trust scoring logic resides in providers/_trust-validator.mjs, specifically within the buildTrustValidator function and the heuristic check implementations spanning lines 18-48. The constants defining suspicious domains and ATS allow-lists are also declared in this file.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}