The First Checkpoint: From Semantic Drift to Real Cost
This checkpoint connects the request contract, the CDN edge-to-origin path, and H3Act's black-box measurement method. Its focus is how to read a conversion difference as a chain from client intent to downstream consequence, so readers can classify the cases that follow without confusing an anomaly with an exploit or a production outage.
The useful unit of analysis is not an unusual header or an alarming response. It is a relationship: what the client meant, what the edge changed or reused, what the origin received, and what consequence the change could produce. Once those links are kept together, four recurring forms of drift become visible—changes in size, timing, identity, and framing. They are different failure paths, but they can be examined with the same disciplined question.
From intent to consequence
Start with the request's intended meaning rather than with the edge's output. The client names a resource, supplies fields that constrain the operation, and sends a body whose boundaries the protocol defines. The CDN receives that request in HTTP/3, then decides whether to answer from cache, forward it, or transform it for the origin. The origin sees only the result of those decisions. H3Act's method makes the gap between those views the object of measurement.
The first comparison is between intent and representation. For example, a request may express a bounded retrieval or a condition on whether content is needed. The relevant question is whether that constraint survives the edge's decision to contact the origin. The second comparison is between representation and effect. Even if a forwarded request looks different, the difference may be harmless normalization; the origin-side response and byte count reveal whether the change altered work or output. The third comparison is between effect and claim. A larger origin response may establish extra upstream work, but it does not by itself establish that a CDN edge became unavailable or that an attacker can affect unrelated tenants.
This chain also clarifies why a client-visible response is weak evidence on its own. A cache hit can bypass the origin. A revalidation can produce a small response after an upstream exchange. An edge can return a normal status while the origin processed a different request. Conversely, a strange response may come from a controlled test origin rather than from a defect in the CDN. The observation becomes meaningful only when the two ends of the path are aligned with the intended request.
H3Act's design reflects this requirement. Its Generator creates protocol-valid HTTP/3 cases, while its Analyzer compares the generated case and the logs from the client and origin.