Content Delivery Network

Use edge caches with explicit representation keys, an origin shield for refill isolation and a versioned asset publication policy. Treat private delivery and distributed purge as separate enforced contracts.

1. Normalize allowed hosts, paths and query parameters. Define response cacheability and the exact Vary/access dimensions; bypass shared caching for personalized responses unless isolation is explicitly designed.
2. On a miss, coalesce fills per key and fetch through an origin shield under finite concurrency/deadline budgets. Cache only complete validated responses, with bounded object size and a documented negative-cache policy.
3. Publish public assets under content/version identities with long immutable lifetimes. For mutable keys, use validators and explicit TTLs; purge events carry generation IDs and report propagation status.
4. Authorize private manifest/object requests at the edge or another trusted serving boundary. During origin failure, serve stale content only where its policy permits, never as an authorization bypass.

• Different hosts, locales and authorized scopes cannot share an unsafe entry.
• Concurrent hot misses cause bounded origin refills.
• A stale purge cannot invalidate a newer generation incorrectly.
• Origin failure cannot cause private or policy-expired content to be served without authorization.

Trade-offs to explain

• Caching improves latency but makes mutable-content freshness a distributed contract.
• Purge tags simplify invalidation but need indexes and propagation tracking.
• The generic capacity estimator does not model CDN bandwidth, object sizes or regional hit ratios.