CDN Cache and Compression Delivery Contract Gate

Proves that a deploy serves the cache, compression and host-canonicalization behavior that you agreed. Give the Actor a list of URLs. The Actor sends header-only requests, reads the answer headers, and gives one PASS, WARN or FAIL verdict for each URL, plus one machine-readable exit verdict for your CI job.

The Actor does not crawl. It checks only the URLs that you give. It never reads a response body, it uses no browser, no proxy and no paid API.

What the Actor checks

For each URL the Actor sends these transactions:

• one request for each algorithm of your policy, for example Accept-Encoding: br and then Accept-Encoding: gzip;
• one probe on the http scheme, for the HTTP-to-HTTPS rule;
• one request to the other trailing-slash form.

The default policy names two algorithms, so one URL costs four transactions. A policy of three algorithms costs five, and so on.

The Actor then grades these rules:

Rule	What it reports
reachable	The URL answered.
final_status	The status code at the end of the redirect chain.
https_redirect	http gives a permanent redirect to https.
host_canonical	The final URL is on the canonical host.
compression_<algorithm>	One rule for each algorithm of the policy. Each algorithm is graded against its own request.
vary_accept_encoding	A compressed answer names Accept-Encoding in Vary.
cache_control	A Cache-Control header is present and is usable.
immutable_max_age	A fingerprinted asset carries a long max-age and the immutable directive.
validator	The answer carries an ETag or a Last-Modified header.
trailing_slash	The other trailing-slash form redirects, and does not serve the same page twice.

A URL takes the most severe verdict of its rules.

Safety

The Actor refuses every loopback, private, link-local and reserved address. It follows each redirect hop by hand, and each hop must pass the same control before the Actor sends the next request. A public host therefore cannot redirect the Actor to an internal address, and no header of an internal service reaches the dataset. A refused target is a dataset record with a reason. It never fails the run, and it is never charged.

Input

Every field has a default, so a run with empty input succeeds.

Field	Type	Default	Meaning
urls	array of strings	three public python.org URLs	1 to 300 absolute URLs.
requiredEncodings	array of strings	["br", "gzip"]	The algorithms that the CDN must offer. Known values: br, gzip, zstd, deflate. The Actor sends one request for each algorithm, and grades each algorithm against its own answer. 1 to 5 algorithms.
minImmutableMaxAgeSeconds	integer	31536000	The smallest max-age of a fingerprinted asset. 0 to 31536000.
canonicalHost	string	""	The one host that every URL must end on. An empty value takes the host of the first URL.
trailingSlashForm	string	as-given	as-given, slash or no-slash.
checkHttpToHttps	boolean	true	Send the http-scheme probe.
hashedAssetPattern	string	a build-asset pattern	A regular expression that names a fingerprinted asset.
trackBaseline	boolean	true	Keep the verdict of each URL in the key-value store, and report the delta in the next run.
baselineKey	string	""	An empty value derives the record key from the canonical host.
timeoutSeconds	integer	15	3 to 60.
maxConcurrency	integer	5	1 to 10 URLs at the same time.
maxRequests	integer	1300	A hard bound on the run. 10 to 2000.
maxRedirects	integer	3	0 to 5 hops. Each hop is checked.

Output

The dataset holds three record types. The recordType field names each one.

url — one record for each URL:

Field	Meaning
url, finalUrl, finalStatus	The URL that you gave, the URL at the end of the chain, and its status.
verdict	PASS, WARN or FAIL.
reached, skipped, error	Whether the URL answered, whether the Actor skipped it, and the reason.
httpProbeStatus, httpProbeLocation	The answer of the http-scheme probe.
encodings	One entry for each requested algorithm, with the algorithm that the server answered with.
brotliEncoding, gzipEncoding	The Brotli and gzip answers, for a quick read.
varyAcceptEncoding, vary	Whether Vary names Accept-Encoding.
cacheControl, cacheDirectives, maxAge, sMaxAge, immutable, noStore	The parsed Cache-Control header.
validator	etag, last-modified or nothing.
contentType, compressible, hashedAsset	The media type, and how the Actor classified it.
slashVariantUrl, slashVariantStatus, slashVariantLocation	The answer of the other trailing-slash form.
findings, failedRules, warnedRules	Every rule result, and the rules that did not pass.
changeSinceBaseline	regressed, improved, new or removed, against the last run. A URL that is in the baseline, but that does not answer this run, gets removed.
checkedAt	The time of the check.

change — one record for each URL whose verdict moved since the baseline.

summary — one record for each run: passCount, warnCount, failCount, urlCount, urlsChecked, urlsSkipped, failuresByRule, changeCount, firstRun, requestsSent, status, note, policy, and the two fields that a CI job reads:

• exitVerdict — PASS, WARN or FAIL;
• gatePass — true when exitVerdict is not FAIL.

A run that checked nothing reports exitVerdict: "FAIL", so a CI job never reads a passed gate after a run that verified nothing.

The run always ends with SUCCEEDED

A failed gate is a business result, not a malfunction. A failed gate, a refused private target, an unreachable host, a URL above the request bound and a transport fault are all dataset records plus a status message. The run ends with SUCCEEDED. Read gatePass in the summary record to decide whether your deploy passes. Only an input that cannot be parsed fails the run.

Billing

The Actor uses the pay-per-event model.

Event	Unit	Price	When it is charged
run-started	one run	$0.02	Once for each run, after the input is read and accepted.
url-checked	one URL that the Actor checks	$0.004	Once for each URL that the Actor really probed.

The billing unit is one URL that the Actor checks. A URL that the Actor refused as a private or reserved target, and a URL that fell above maxRequests, are reported in the dataset but are not charged.

The default maximum total charge for a run is $5.00. That pays for about 1245 URLs. Raise or lower this cap in the run options.

Use in CI

1. Run the Actor after each deploy with the URL list of the deploy.
2. Read the summary record of the dataset.
3. Stop the pipeline when gatePass is false.

The baseline in the key-value store lets a nightly run report only what moved since the last accepted run.