Principles
Five commitments we can be held to
Not values on a wall. Each of these is checkable against the platform, and each one costs us something — which is how you can tell we mean it.
The short version: if we host your bytes and your edge, we accept responsibility for the whole path from merge to visitor — and we would rather refuse a request than pretend a boundary exists where it does not.
1. If we host it, we can see how it is built
The canonical repository lives in our organization, one per hostname, with a workflow we maintain and an identity we issued. The cost: we turn away sites whose pipeline we cannot see, even when the content would be trivial to serve.
2. The origin path holds still
A deploy replaces visitor files under a fixed public/ origin while deployment and purge state stay in sibling state/. It does not move routes to a per-commit path, so a failure does not leave the edge pointing at nothing. The cost: authors cannot restructure the origin layout on a whim.
3. Invalidation is a service, not a permission
Purge scope in Azure is granted per endpoint while the affected domains are a request field, so no access-control rule can stop an identity from naming a neighbor. Tenants therefore call a platform job that proves caller and FQDN from Front Door route inventory, then consumes a durable path queue. The cost: an extra job, an extra identity, and explicit recovery state.
4. Done means the visitor sees it
Entry pages must revalidate every time, fingerprinted assets may be cached for thirty days, and the run sweeps durable public URLs until each current 200 body matches the staged SHA-1 and each dropped durable path returns 404. A green check proves one or more endpoints returned the intended result; the full global rollout may still be proceeding. The cost: slower runs, and occasionally a failure that a simpler pipeline would have hidden.
5. We publish the awkward parts
The blog documents a claim format that broke a working credential, a nested-workflow limitation that forced tag pinning instead of commit pinning, an origin endpoint reachable without the edge, and the difference between a browser cache lifetime and a deletion window. The cost: our marketing pages cannot pretend any of that away.
The mechanisms behind all five are one post each in the blog, with the diagrams collected on how it works.