The tour
Four pictures of one platform
Start here if you would rather see the shape of the thing than read the contract. Each picture links to the blog post that spells out the details, including the parts that are awkward.
1. What it is made of
A repository in our organization, a federated identity, a folder on shared static website storage, and Azure Front Door in front with a managed certificate. Five links in a chain, and the one that publishes cannot clear the one that caches.
2. What a deploy does
Merge, and the pipeline fingerprints your assets, durably queues pending, current, and dropped paths before public mutation, uploads long-lived objects before the pages that reference them, invalidates the queued paths, and sweeps the durable public URLs in parallel. A 200 passes only when the fetched body and staged file have the same SHA-1; a dropped durable path must return 404. Success means the tested visitor view is correct and the unchanged queue is clear, while other global endpoints may still be rolling out.
3. How many sites share one stack
Every public name is its own repository, its own storage prefix, and its own upload identity — while the storage account and the edge profile are shared. Environment hosts live under the same prefix as their production site, which is exactly why a site may refresh its own preview but never a neighbor.
4. When the edge is stale
The signal is usually a 200 with the wrong body checksum, an expected path that is not yet 404, and a queue left in state/ rather than a complaint. Diagnosis separates “wrong hostname” from “wrong origin path.” Recovery uses the queued FQDN-relative paths, while the platform proves caller and hostname against Front Door route inventory before purging.
Then read the awkward parts
The blog does not stop at the happy path: access control that cannot express what we need, a subject claim format that broke a working credential, a zone we are not allowed to write, and the difference between a cache lifetime and a deletion window.