JobHub

A private, account-based job-search tool. It finds jobs, matches roles, prepares résumés from evidence and plans your calendar. I defined the product and its data rules, directed an AI coding assistant to build it, and reviewed the output.

Runs on: Cloudflare Workers
Data: Two databases with account-scoped data, 28 tables in the accounts database
Layers: Budgeted job collectors and a bounded language-model layer

Explore details

Cloudflare Workers · D1 · invite-only sign-in

JobHub

A private job-search tool with account-scoped data, a two-database design, budgeted job collectors and a bounded language-model layer.

Product direction and code review are mine. An AI coding assistant wrote much of the code.

The system map

Screens are scripted previews with sample data.

JobHub does not submit applications for you.

Scrolling moves the camera. Select a box to inspect it. Up and Down step between boxes.Tap a box to inspect it.

Inspector

jobhub / Collect / Eight providers

Provider APIs

Eight providers

The collector reads job boards through eight configured providers.

Details

greenhouse, lever, ashby, smartrecruiters, recruitee, workable, adzuna and usajobs.
Collector rule 1: use only official public job APIs, and never use AI to discover or choose jobs.
Eight rules are written in code as COLLECTOR_RULES.

Connections

to Collectorofficial public APIs

Source

API providers configured in the collectorlib/job-providers.js:70
Collector rules written in codelib/collector.js:44

Worker, scheduled

Collector

A scheduled Worker pulls postings from the providers, stays inside a per-run budget and writes the result to the job-data database.

Details

Per run: 20 external requests, 25 D1 statements, 20 work items and 10 pages. Each response stops at 1,800,000 bytes.
budgetedFetch counts every external request. statementBudget counts every D1 statement and refuses a batch larger than what is left.
A page checkpoint and its postings go in one batch, so a cursor never moves past rows that were not stored.
A failing source backs off alone: 30 seconds, doubled per failure, capped at 6 hours.
A posting closes after 2 complete cycles of absence. Closed postings are deleted after 30 days.

Connections

from Eight providersofficial public APIs
to Job-data databasewrites postings

Source

Collector budget per runlib/collector.js:9
Budget clamp per runlib/collector.js:9,124-137,367-375migrations-job-data/0004_collector_state.sql:3-14
How the budgets are enforcedlib/collector.js:64-122
Page checkpoint and postings in one batchlib/collector.js:330-364
A failing source backs off alonelib/collector.js:62,420-427
Complete cycles of absence before a posting closeslib/collector.js:340-358
Closed postings are deleted after 30 dayslib/collector.js:11,466-472
Scheduled Worker triggersworker/wrangler.toml:10

D1 database, JOBDATA

Job-data database

Holds the collected postings and the collector’s own state. Any account can be matched against it, and none of its tables belongs to one person.

Details

19 tables across 9 migrations. No migration has a user_id column.
Written by the collector and the owner-only operations routes. The finder and the catalogue only read it.
A posting is identified by provider ID plus canonical HTTPS URL. A URL change is kept as an alias and a changed source text as a revision.

Connections

from Collectorwrites postings
to Finderreads open postings

Source

D1 tables, job-data databasemigrations-job-data/
Migrations, job-data databasemigrations-job-data/
Two D1 databases with different ownerswrangler.tomlmigrations-job-data/schema.sql
Posting identitylib/collector.js:44-52migrations-job-data/0004_collector_state.sql:54-70

Boundary

The wall

DB and JOBDATA are separate D1 bindings. Job-data carries no user_id, so nothing in it points at a person.

Details

wrangler.toml binds DB for accounts and JOBDATA for collected postings.
A search for user_id across the nine job-data migration files finds nothing.
The finder reads postings on one side and writes that account’s own rows on the other.

Source

Two D1 databases with different ownerswrangler.tomlmigrations-job-data/schema.sql
Direction of data flow between the databaseslib/finder.js:190,228

Worker, daily

Finder

The finder reads open postings from JOBDATA and writes the account’s own rows (jobs, seen, job_extras) into DB.

Details

A Worker timer runs it daily at 10:40 UTC.
It shortlists candidates, assembles evidence, asks the model bounded questions and scores the answers in code.
At most 10 assessments per run.

Connections

from Job-data databasereads open postings
to Accounts databasewrites the account’s own rows
to Shortlistcandidate pool

Source

Direction of data flow between the databaseslib/finder.js:190,228
What each timer doesworker/index.jsworker/wrangler.toml
Requirements and evidence per assessmentlib/match-evidence.js:29,58lib/finder.js:18,120

D1 database, DB

Accounts database

Holds account data. Per-person tables carry user_id, and several use a composite primary key that starts with it.

Details

28 tables across 8 migrations.
meta, seen, job_extras, plan_tasks and calendar_accounts use a composite key that starts with user_id.
Passwords are hashed with PBKDF2-SHA-256, 100,000 iterations.

Connections

from Finderwrites the account’s own rows
to Own rowsrows live here

Source

D1 tables, accounts databaseschema.sql
Migrations, accounts databasemigrations/
Per-account keysschema.sql
Password hashinglib/auth.js:6,31

Retrieval step

Shortlist

Before any model call, the finder narrows the open postings to a candidate pool.

Details

Keyword search through an FTS5 MATCH, up to 1000 rows.
Up to 100 semantic neighbours from Vectorize, as the methodology document states.
The candidate pool is cached for 8 hours.

Connections

from Findercandidate pool
to Evidencetop candidates

Source

Candidate shortlistlib/finder.js:143,190lib/finder-pool.js:1lib/collector.js:10migrations-job-data/0009_posting_keyword_search.sql

Prompt input

Evidence

Each assessment samples requirements from the posting and excerpts from the résumé.

Details

Up to 8 requirements and 4 evidence excerpts per assessment.
Up to 10 assessments per run and 50 per click.

Connections

from Shortlisttop candidates
to Fenced inputrequirements and excerpts

Source

Requirements and evidence per assessmentlib/match-evidence.js:29,58lib/finder.js:18,120

Input control

Fenced input

Posting and résumé text is untrusted. It is marked that way and wrapped in delimiters before it reaches the model.

Details

UNTRUSTED_RULE, fence() and stripMarkers() are defined in jev-api.js.
UNTRUSTED_RULE appears on 9 lines across lib/.

Connections

from Evidencerequirements and excerpts
to Injection checkwrapped

Source

Supplied text is marked as untrusted and wrapped in delimiterslib/jev-api.js:48

Input check

Injection check

Postings and résumés pass through looksLikeInstructions() before they go to Jev.

Details

It matches 8 fixed phrase patterns.
A reworded attack can get past a fixed list. The fence and the closed answer types still apply.
It is called in finder.js and resume-review.js.

Connections

from Fenced inputwrapped
to Jevchecked

Source

Postings and résumés are checked with looksLikeInstructions() before being sent to Jevlib/jev-api.js:70
Phrase patterns in the injection checklib/jev-api.js:60-70

Language model

Jev

The documented design limits Jev to structured answers: yes or no, a pick from a fixed list, or a score from 0 to 4. The interface supplies every word the user reads.

Details

Rules live in docs/JEV-RULES.md, with fixed replies in lib/note-sort.js.
The assessment cache holds allowlisted choices, scores and source IDs, and no résumé or posting prose.

Connections

from Injection checkchecked
to Fixed answersraw answer

Source

How the AI is boundeddocs/JEV-RULES.md
Question types sent to the modeldocs/JEV-RULES.md
What the assessment cache storesdocs/JEV-RULES.md

Output contract

Fixed answers

Whatever the model returns is reduced to one of three shapes before code uses it.

Details

A yes counts at a threshold between 0.6 and 0.8, depending on the call.
Scores are clamped to 0 to 4.
An unknown choice falls back to a safe default.

Connections

from Jevraw answer
to AI ruleswhat the model may do
to Coverage in codeclassifications

Source

Question types sent to the modeldocs/JEV-RULES.md

Permission board

AI rules

Two permissions can be switched off. Two are locked off in the design. No model runs on this page.

Details

Classify and score are the only things Jev is asked to do.
Collectors never use AI to discover or choose jobs.
The interface supplies the text the user reads.

Connections

from Fixed answerswhat the model may do

Source

How the AI is boundeddocs/JEV-RULES.md
Collector rules written in codelib/collector.js:44
Question types sent to the modeldocs/JEV-RULES.md

Code

Coverage in code

Coverage is recomputed from the per-requirement classifications. It overrides the model’s global answer.

Details

A positive classification without a cited source is downgraded to unknown.
capability_gap needs negation wording in the cited excerpt.

Connections

from Fixed answersclassifications
to Fit scorecoverage, relevance

Source

Fit score is computed in codelib/match-evidence.js:68-105

Scoring ladder, deterministic

Fit score

matchDetail() maps relevance, eligibility and coverage to a level from 0 to 4.

Details

Unrelated role: 0. Eligibility conflict: 1.
Strong coverage: 4. Partial: 3. Anything else: 2.
Unknown relevance caps the score at 2.

Connections

from Coverage in codecoverage, relevance
to Own rowswrites fit and gaps

Source

Fit score is computed in codelib/match-evidence.js:68-105

Middleware

Session gate

Protected /api/ requests without a session get 401 and the message “Sign in first.” Four POST routes are public.

Details

PUBLIC_POSTS lists the four public exceptions.
A request whose Origin does not match gets 403.

Connections

to Account scopeuser_id

Source

Protected API requests without a session getfunctions/_middleware.js:13,101
Tenant isolation tests and responsesfunctions/_middleware.js:62,101

Query scope

Account scope

Handlers take user_id from the session and scope each account query to it.

Details

AGENTS.md requires every D1 query to be scoped.
The pattern user_id = ? appears 88 times in functions/ and lib/. That counts the pattern and does not prove full coverage.

Connections

from Session gateuser_id
to Own rowsown id
to Foreign idother id

Source

Occurrences of `user_id = ?` in functions/ and lib/AGENTS.md
Per-account keysschema.sql

Account view

Own rows

A signed-in request reads its own jobs, notes, meta, extras and résumés, and nothing else.

Details

The finder writes its results into these rows.
The interface reads them through the API handlers.

Connections

from Fit scorewrites fit and gaps
from Account scopeown id
from Accounts databaserows live here

Source

Tenant isolation tests and responsesfunctions/_middleware.js:62,101
Direction of data flow between the databaseslib/finder.js:190,228

Refusal

Foreign id

Asking for another account’s record id returns 404 and leaves that record unchanged.

Details

Checked with two seeded accounts that each see only their own rows.

Connections

from Account scopeother id

Source

Tenant isolation tests and responsesfunctions/_middleware.js:62,101

Screen

Opportunities

Roles grouped by company, with filters and source details. Picking a role opens its detail and the button that starts a preparation plan.

Details

Reads through the API handlers: 25 handler files and 26 exported request handlers. That counts handlers and not URLs.

Source

API handler filesfunctions/api/
Exported request handlers under functions/functions/

Screen

Preparation

A requirement marked as a gap gets a concrete next step. Saving it puts the gap in the plan.

Details

The fit gaps come from the scoring ladder, so the model never writes this text.

Source

Fit score is computed in codelib/match-evidence.js:68-105
How the AI is boundeddocs/JEV-RULES.md

Screen

Plan and calendar

Change a session’s end time in the calendar and My plan shows the new time.

Details

plan_tasks and calendar_accounts are per-account tables keyed by user_id.

Source

Per-account keysschema.sql

Shared postings
Account data
Language model
Code

Source notes

Reviewed source snapshot: feat/landing-feature-demos @ c65956d. Where a fact lists what was not audited, the line says so.

D1 tables, accounts database: grep -ic '^create table' schema.sqlschema.sql
D1 tables, job-data database: Unique CREATE TABLE / CREATE VIRTUAL TABLE names across migrations-job-data/*.sqlmigrations-job-data/
Migrations, accounts database: ls migrations | wc -l (0001 to 0008)migrations/
Migrations, job-data database: ls migrations-job-data | wc -l (0001 to 0009)migrations-job-data/
API handler files: find functions/api -name '*.js' | wc -l. Several are [action].js dispatchers, so the URL count is higher than this.functions/api/
Exported request handlers under functions/: grep for `export function/const onRequest*`: 3 onRequest, 10 onRequestGet, 9 onRequestPost, 3 onRequestDelete, 1 onRequestPut. Counts handlers, not URLs.functions/
Library modules: ls lib/*.js | wc -llib/
API providers configured in the collector: Top-level keys of PROVIDERS: greenhouse, lever, ashby, smartrecruiters, recruitee, workable, adzuna, usajobs. Collector rule: official public APIs only.lib/job-providers.js:70
Collector rules written in code: String entries in COLLECTOR_RULES; the first is 'Use only official public job APIs; never use AI to discover or choose jobs.'lib/collector.js:44
Collector budget per run: Constants FREE_REQUESTS, FREE_DB_QUERIES, FREE_WORK, FREE_PAGES.lib/collector.js:9
Scheduled Worker triggers: crons array: '0 */8 * * *' and '40 10 * * *'worker/wrangler.toml:10
How the AI is bounded: Documented rules: docs/JEV-RULES.md and REPLIES in lib/note-sort.js. Call sites were not fully audited.docs/JEV-RULES.md
Supplied text is marked as untrusted and wrapped in delimiters: UNTRUSTED_RULE, fence() and stripMarkers() are defined in jev-api.js; grep finds UNTRUSTED_RULE on 9 lines across lib/.lib/jev-api.js:48
Postings and résumés are checked with looksLikeInstructions() before being sent to Jev: looksLikeInstructions() is called in finder.js (lines 260, 292) and resume-review.js (152).lib/jev-api.js:70
Protected API requests without a session get: The middleware has four public POST exceptions (PUBLIC_POSTS); other /api/ requests without a session get 401 'Sign in first.'functions/_middleware.js:13,101
Password hashing: ITERATIONS constant and deriveBits calllib/auth.js:6,31
Occurrences of `user_id = ?` in functions/ and lib/: grep -rn 'user_id = ?' functions lib | wc -l. AGENTS.md requires every D1 query to be scoped. This counts the pattern and does not prove full coverage.AGENTS.md
Application submission: Sources: public/index.html:44 and lib/note-sort.js:11,16,25. These contain the policy and fixed reply; enforcement was not fully audited.lib/note-sort.js:11,16,25
Two D1 databases with different owners: wrangler.toml binds DB and JOBDATA. grep -c user_id migrations-job-data/*.sql returns 0 for all 9 files. Accounts schema.sql has user_id on the per-person tables. Only lib/collector.js and the owner-only operations routes write JOBDATA; finder.js and catalogue.js read it.wrangler.toml; migrations-job-data/; schema.sql
Direction of data flow between the databases: lib/finder.js: JOBDATA.prepare(SELECT ... FROM postings WHERE open=1 ...) for candidates; db.prepare(...) on jobs, seen and meta keyed by user_id for known rows and results.lib/finder.js:190,228
Budget clamp per run: effectiveConfig() takes the minimum of the constants and the global, provider and host rows of collector_budget_config; table CHECK constraints in migration 0004 bound each column. The code comment ties the 25 to the 50-subrequest Free limit. 4 statements are reserved for the keyword reindex batch.lib/collector.js:9,124-137,367-375; migrations-job-data/0004_collector_state.sql:3-14
How the budgets are enforced: budgetedFetch() throws code BUDGET at the limit and boundedBody() aborts the reader past the byte limit. statementBudget().batch() returns false when sqlArgs.length > left.lib/collector.js:64-122
Page checkpoint and postings in one batch: The same D1 batch writes the stored postings, the observations and the source_schedule checkpoint, so a cursor never advances past rows that were not stored.lib/collector.js:330-364
A failing source backs off alone: runCollector wraps each sourcePage() in try/catch; on error it writes failure_count, backoff_until and last_result for that source only and continues the loop. Backoff is 30 seconds doubled per failure, capped at 6 hours, or the provider Retry-After.lib/collector.js:62,420-427
Complete cycles of absence before a posting closes: posting_observations.missing_complete_cycles increments only when a board cycle ends terminal, complete and non-empty; closure needs >= 2. A reappearance resets it to 0.lib/collector.js:340-358
No description-less stub is stored: For providers that fetch one request per description (Greenhouse, SmartRecruiters) the loop cuts the page before the first job it has no request budget for.lib/collector.js:205-212
Closed postings are deleted after 30 days: PRUNE_DAYS = 30; DELETE ... WHERE open=0 AND embedded=0 and last observation older than the cutoff, LIMIT 100 per run. Child rows cascade; the FTS table has a delete trigger.lib/collector.js:11,466-472
Posting identity: lib/collector.js:44-52; migrations-job-data/0004_collector_state.sql:54-70
Candidate shortlist: KEYWORD_ROWS = 1000 behind an FTS5 MATCH (tokenizer keeps underscores); up to 100 Vectorize neighbours; finder-pool.js TTL = 8 hours; collector VECTOR_CAP = 12000. Documented in docs/MATCHING-METHODOLOGY.md; the 100 semantic rows are from that document and were not re-derived from code.lib/finder.js:143,190; lib/finder-pool.js:1; lib/collector.js:10; migrations-job-data/0009_posting_keyword_search.sql
Requirements and evidence per assessment: postingRequirements(text, max=8) and prepareMatchEvidence(hits.slice(0,4)) in lib/match-evidence.js; MAX_JEV = 10 in lib/finder.js:18; per-click 50 is stated in SEARCH_RULES rule 10 (lib/finder.js:120).lib/match-evidence.js:29,58; lib/finder.js:18,120
Fit score is computed in code: matchDetail() in lib/match-evidence.js. Coverage is recomputed from the per-requirement classifications and overrides the model's global answer. A positive classification without a cited source is downgraded to unknown; capability_gap requires negation wording in the cited excerpt. GPA is compared numerically in code.lib/match-evidence.js:68-105
Question types sent to the model: Thresholds read from the docs table, not re-derived from every call site.docs/JEV-RULES.md
Phrase patterns in the injection check: INSTRUCTION_PATTERNS array length. The file comment and JEV-RULES.md say it is a fixed phrase list that a reworded attack can get past; the fence and the closed answer types still apply.lib/jev-api.js:60-70
What the assessment cache stores: docs/JEV-RULES.md Known limits; docs/MATCHING-METHODOLOGY.md. Not re-derived from the cache code.docs/JEV-RULES.md
Tenant isolation tests and responses: _middleware.js returns 403 on an Origin mismatch and 401 without a session.functions/_middleware.js:62,101
Per-account keys: schema.sql lines 13, 16, 27, 35 and 44.schema.sql
Daily D1 allowance gate: READ_LIMIT, WRITE_LIMIT, READ_RESERVATION and WRITE_RESERVATION in lib/d1-budget.js. A Durable Object holds the counter; the raw D1 bindings live only in the gate Worker. Each call reserves first, persists the reservation, runs the SQL, then replaces the reservation with the measured rows. Missing or unmeasured results lock the day. docs/D1-BUDGET-GUARD.md says this is an application circuit breaker, not an account-wide cap.lib/d1-budget.js:1-3; lib/d1-client.js; guard/index.js; docs/D1-BUDGET-GUARD.md
What each timer does: worker/index.js:10-19 and worker/wrangler.toml crons. docs/JOB-DATA-BOTS.md still says a 5-minute heartbeat and README.md says a 4-hour timer; both disagree with wrangler.toml, which is used here.worker/index.js; worker/wrangler.toml
Migrations: migrations-job-data/0004 header comment; KEYWORD_VERSION = 2 and the bot_rules cursor in lib/collector.js:432-450; 0009 header comment. Migration files 0007 and 0008 are data seeds without IF NOT EXISTS.migrations-job-data/; lib/collector.js

JobHub

The system map

Optional analytics