Library · Category pillar
CDN vs. Incident Response

CDN Optimization Isn’t Incident Response.
Different layers. Same signal bus.

Mux, Cloudflare, Fastly, and Akamai optimize the happy path — caching, edge routing, multi-CDN weights, origin shield bypass. They keep a clean stream clean. Streamwake owns the Detect → Classify → Fix loop when that happy path breaks.

Both layers run together in production. Same signal bus, different obligation. This page names what each layer is responsible for — and the incident types CDN tuning alone cannot prevent.

Where each layer sits

CDN tuning owns the knobs. Streamwake owns the loop.

Honest framing of the two surfaces. The CDN owns what a healthy edge looks like; the Streamwake agent owns what happens when that edge breaks for some viewers and not others.

CDN tuning owns
  • cache TTL + freshness
  • edge POP health
  • multi-CDN weights
  • geo-routing
  • origin shield bypass rules

The happy path

Cache TTL + freshness, edge POP health, multi-CDN weights, geo-routing, and origin shield bypass rules — every knob that keeps a clean stream clean while traffic flows.

Aggregate green dashboards

Hot-path metrics: hit rate, edge latency, 5xx ratio, POP load. They look correct until something underneath them quietly breaks for a subset of viewers.

Routing and failover policy

DNS weighting, multi-CDN convergence, geo-IP rules, origin shield escalation thresholds. Tuned at deploy time, expected to hold steady until the next config push.
Streamwake owns

Anomaly → incident classification

Every viewer-impact anomaly is prioritized by class — encoding regression, manifest drift, edge brownout, DRM handshake — so the noise is structured before it reaches a human.

Ranked root cause

The agent joins the signal across encode, edge, and DRM into a single incident with a typed hypothesis and confidence — not a chart, not a partial log line.

Typed next-action

A specific, executable action the agent proposes — reroute egress, roll a flag, re-package a title, quarantine a node — instead of "anomaly detected, please investigate".

Smallest safe remediation

The agent picks the smallest action it can verify, runs it, and watches the recovery path before closing. If it cannot verify, it surfaces the decision to a human with the same typed payload.

Verified recovery

Re-probes the affected probe envelope until the timeline reads clean across at least one full window. A closed incident is a verified recovery, not a quiet dashboard.

Structured postmortem

A full writeup — what happened, what was tried, what changed — lands in Slack, Linear, or PagerDuty the moment the incident closes. Written before the chart finishes rendering.
The two paths

Chart emailed ≠ Incident closed.

Same anomaly, two very different ends. The CDN-only path produces a chart and a runbook; the Streamwake path produces a closed incident with a typed postmortem before the chart renders.

The CDN-only path
  1. 01anomaly detected
  2. 02chart emailed to on-call
  3. 03on-call pages an engineer
  4. 04engineer investigates the chart
  5. 05engineer runs the runbook
  6. 06engineer writes the postmortem
  7. 07— days later.
The Streamwake path
  1. 01incident detected
  2. 02classified in seconds
  3. 03fix proposed from a typed next-action
  4. 04agent runs the smallest safe remediation
  5. 05recovery verified by re-probe
  6. 06structured postmortem lands in Slack
  7. 07— before the chart finishes rendering.
Where CDN tuning falls short

Five incident types CDN tuning cannot prevent.

Each row is an incident class that surfaces cleanly to Streamwake but reads as a green dashboard on a CDN-only stack: a named signal, the symptom, why the CDN does not catch it, and the typed next-action the Streamwake agent runs.

01

Encoding regressions

incident type
Signalencode.bitrate_overshoot_pct · encode.gop_drift_ms · abr.ladder_collapse
Symptom

Encoder ABR ladder collapses mid-event: bitrate overshoots declared ceiling, GOP drift spikes, the player falls below the lowest rung of the ladder and rebuffers across the cohort.

Why the CDN doesn’t catch it

The CDN sees correctly-signed segments, clean 200s on every fetch, and a green X-Cache hit rate. Encoding regressions are invisible to anything reading the edge alone.

What Streamwake does

The agent tags the encode family, names the ladder-collapse hypothesis, and proposes the smallest encoder flag roll. Recovery verified by re-probing the ladder against the live window.

02

Manifest drift

incident type
Signalmanifest.media_sequence_age_seconds · manifest.unresolved_variant_count
Symptom

The HLS master or DASH MPD references variants and segments the origin has stopped serving. The player sees a manifest with a dead media sequence and stops advancing.

Why the CDN doesn’t catch it

The CDN returns the cached manifest with 200 OK and a HIT — every header contract looks healthy. The dead MEDIASEQUENCE inside the body is invisible until a player reads it.

What Streamwake does

The agent reads the manifest body, compares declared variants against origin reality, and tags unresolved references. Surfaces the typed next-action: re-package the title or pin to a known-good variant.

03

Edge brownouts

incident type
Signaledge.pop_health_score · edge.region_drift
Symptom

A single POP or region degrades while aggregate cache health stays green. Viewers in that region buffer; metrics for the global cache-aggregate never cross a threshold.

Why the CDN doesn’t catch it

Multi-region aggregate dashboards smooth across POPs. A POP stuck at 0.62 health looks like a single noisy data point in a sea of healthy regions.

What Streamwake does

The agent runs synthetics from at least three geo probes, flags POP health below threshold, and proposes a routing pin for the affected region. Verified by re-probing after the reroute.

04

DRM handshake spikes

incident type
Signaldrm.license_latency_p95_ms · drm.handshake_2xx_with_slow_body
Symptom

Widevine / FairPlay / PlayReady license latency spikes during a primetime window. License servers respond 200 OK with the body taking seconds to deliver — the player times out mid-handshake.

Why the CDN doesn’t catch it

The CDN edge logs license fetches as 200 OK. Slow bodies, late Widevine handshakes, and stalled PlayReady renewals are all invisible to edge-only monitoring.

What Streamwake does

The agent tracks handshake body time vs accepted 2xx, names the license-server family, and proposes the typed remediation: pre-warm a license region, route around a drifted provider, or trigger a planned renewal.

05

Cross-CDN failover misses

incident type
Signalmulticdn.health_score_drift_seconds · multicdn.dns_weight_convergence_ms
Symptom

A healthy provider goes degraded mid-event. The multi-CDN DNS controller is slow to converge; both providers serve traffic while the unhealthy one drags aggregate health down.

Why the CDN doesn’t catch it

Each provider reports its own metrics in its own dashboard. A drift between providers surfaces nowhere unless someone is reading both at the same time.

What Streamwake does

The agent joins both providers onto a single health score, feeds DNS weights directly, and requires unhealthy providers drop to weight 0 until three consecutive intervals report health > 0.95.

Close the loop on your stack

Three places to start next to the CDN you already run.

Streamwake doesn’t replace the CDN. It joins its signals into a Detect → Classify → Fix loop. Pick the surface that matches where you are today.

Run the loop against your own stack — sign up, register a probe, and the next anomaly that hits the agent loop produces a typed next-action before the chart renders.

Sign up