{"verdict_text":"Do not move the platform to Akamai. The candidate that best fits this estate is the one that moves the 97 % and leaves the 3 %: keep compute, data plane, identity and CI on AWS EKS, and move only the video CDN and its origin — to Cloudflare Enterprise (variant B), with Akamai AMD (variant A) carried into the same RFP as the alternative.","weights":[{"dimension":"Data-plane fit (R7 volumes, R8 IOPS/throughput, R15 object store, R16 Postgres)","weight_pct":20,"why":"[inv §1.3 #7] names chi-analytics as *the* storage + network red flag: p95 3,000 IOPS, 566 MiB/s peak, 3.0 Gbps bursts to the object store. R15 is a 77-bucket feature matrix with 95.8 M objects [inv R15]. This is where candidates actually fail."},{"dimension":"CDN fit (video, 3.1 PB/mo, India-heavy)","weight_pct":20,"why":"The entire business case [inv §1.3 #1]. 80.5 % India, Kolkata alone 32.8 % of bytes."},{"dimension":"Portability of our k8s platform (R1, R2, R5, R6, R9, R13, R24, R25, R29)","weight_pct":15,"why":"The platform is already \"self-hosted on k8s\" [inv §1.3 #2]; helmfile/kustomize port near-unchanged. What does not port is Karpenter, spot and the burst pool."},{"dimension":"Identity / secrets / CI fit (R17, R18, C6, C8)","weight_pct":15,"why":"13 measured workload roles, 359 wired ESO keys, 40 pull-through-cache mirrors [inv R18], [inv R17], [inv D6]. A provider with none of these adds three stateful services on day one."},{"dimension":"Agentic-ops ergonomics (R20, C12)","weight_pct":15,"why":"[inv C12] rates this **hard for agentic ops**, with 6 profiles in daily agent use [inv §12.6]. The whole cost-regression practice ([inv L5], [inv L9], [inv L19]) is built on `ce get-cost-and-usage` by usage type, daily."},{"dimension":"Operational risk (C14, C16, C18, C22, L-register)","weight_pct":15,"why":"No restore drill has ever been run [inv C18]; the migration is the first restore. Candidates that remove safety nets rather than adding them are penalised here."},{"dimension":"Blockers count","weight_pct":null,"why":"not weighted — reported as a raw count to avoid double-counting; every blocker already depresses one of the six weighted dimensions."}],"candidates":[{"rank":1,"key":"aws-stay-cdn-out","title":"Stay on AWS, move only the video CDN + origin — CDN = Cloudflare Enterprise (variant B)","scores":{"k8s_portability":5,"data_plane":5,"cdn":3,"identity_secrets_ci":5,"agentic_ops":5,"operational_risk":4},"weighted":4.45,"blockers":3,"summary":"104 of 129 coupling rows UNCHANGED (4 DIRECT/5 EQUIV/5 REDESIGN/3 NO-EQ/8 RETIRE). Variant B (Cloudflare Enterprise, R2 origin, Worker token) is the recommended start; variant A (Akamai AMD) stays in the RFP. Karpenter, ESO, ECR, 13 roles, 44 PVCs, all data stores stay. Hardest row: a non-AWS CDN pulling 241,370 GiB/mo is ≈ $20,019/mo egress. Forces none of the accumulated risk fixes.","mapping_file":"mappings/aws-stay-cdn-out.md"},{"rank":2,"key":"gcp","title":"GCP (GKE + GCS + Media CDN)","scores":{"k8s_portability":4,"data_plane":4,"cdn":3,"identity_secrets_ci":4,"agentic_ops":4,"operational_risk":4},"weighted":3.8,"blockers":5,"summary":"Lowest NO-EQ count of any full-platform candidate (29 DIRECT/48 EQUIV/16 REDESIGN/5 NO-EQ/31 RETIRE); only the CleverTap bucket is forced to stay on AWS. Arm64 in Mumbai, Dataplane V2, ESO via WIF, real Artifact Registry remote repos. Hurts: no Kolkata cache location, sales-gated Media CDN, Preview spot notice, no GCS tagging, 7-day soft delete, ≈ $2,430/mo Cloud NAT, $0.01/GiB inter-zone.","mapping_file":"mappings/gcp.md"},{"rank":3,"key":"oci","title":"OCI (OKE + Object Storage + Cloudflare CDN)","scores":{"k8s_portability":4,"data_plane":4,"cdn":2,"identity_secrets_ci":4,"agentic_ops":4,"operational_risk":3},"weighted":3.45,"blockers":6,"summary":"Strongest surprise: first-party Karpenter provider, Native Ingress Controller add-on, native ESO provider for OCI Vault, free inbound, unmetered intra-region, 300k-IOPS block, managed PG 15–17, good Usage API. Hurts: A1 capacity short in Mumbai vs the 1,472-OCPU burst; unusable PAYG quotas force an annual commit against [inv D9]; no CDN product; 120 s preemption, zero margin; 403 to agents.","mapping_file":"mappings/oci.md"},{"rank":4,"key":"azure","title":"Azure (AKS + Blob + Front Door)","scores":{"k8s_portability":4,"data_plane":2,"cdn":2,"identity_secrets_ci":4,"agentic_ops":5,"operational_risk":3},"weighted":3.2,"blockers":8,"summary":"Best tooling of the ten providers (34/40), best identity after AWS (Entra Workload ID per ServiceAccount), AKS Node Auto Provisioning is managed Karpenter so 7 NodePools port near-1:1, arm64 in Central India. Defining objection: Blob has no S3 API — PostHog and all first-party S3 code have no Azure client, and s3proxy drops tagging/CORS/lifecycle/versioning. Plus 30 s spot, no Kolkata PoP.","mapping_file":"mappings/azure.md"},{"rank":5,"key":"cheap-compute-cf-cdn","title":"Cheap India compute (DigitalOcean/Vultr/OVH) + Cloudflare CDN","scores":{"k8s_portability":3,"data_plane":1,"cdn":3,"identity_secrets_ci":1,"agentic_ops":3,"operational_risk":2},"weighted":2.15,"blockers":14,"summary":"DO is the easiest provider here for an agent to operate and the hardest to observe: --output json everywhere, real scopes, llms.txt, DOKS 1.35 + Cilium, VPC-native networking kills the 100.64/12 collision, free intra-VPC, Spaces has every S3 feature. Then the data plane: 750 GET/s vs an 800 ops/s bucket cap with no metric, 52 M versioned objects vs a 50 M cap, 450 MB/s volumes. Three vendors.","mapping_file":"mappings/cheap-compute-cf-cdn.md"},{"rank":6,"key":"akamai-compute-cloudflare-cdn","title":"Akamai compute + Cloudflare CDN (R2 origin)","scores":{"k8s_portability":2,"data_plane":2,"cdn":3,"identity_secrets_ci":1,"agentic_ops":1,"operational_risk":2},"weighted":1.9,"blockers":13,"summary":"Better than pure Akamai on the edge, identical on everything that makes Akamai hard (23/35/24/13 NO-EQ/34). Cloudflare owns video CDN, R2 origin, edge compute, logs; Linode owns k8s, block, Postgres, registry, secret store and every bucket the cluster writes — forced, since R2 has no versioning or tagging. Cloudflare adds: video banned off Enterprise, no India R2, no Kolkata IX port.","mapping_file":"mappings/akamai-compute-cloudflare-cdn.md"},{"rank":7,"key":"akamai","title":"Akamai Cloud + Akamai CDN (the proposal)","scores":{"k8s_portability":2,"data_plane":2,"cdn":2,"identity_secrets_ci":1,"agentic_ops":1,"operational_risk":2},"weighted":1.7,"blockers":13,"summary":"17 DIRECT/44 EQUIV/19 REDESIGN/13 NO-EQ/36 RETIRE. Ranks below its Cloudflare-hybrid sibling on three edge-side counts: neither native Akamai token product reproduces the token format, so a mandatory EdgeWorker runs 4.7 B executions/mo; India PoP density is unpublished against 32.8 % Kolkata; and it drops Cloudflare's Image Resizing path. One genuine edge: native SigV4 private origin for S3.","mapping_file":"mappings/akamai.md"}],"provider_scorecard":[{"provider":"AWS (today)","dimensions":{"CLI JSON output":null,"Read-only token scopes":null,"Billing API granularity":null,"Per-bucket metrics":3,"Terraform coverage":null,"API rate limits":null,"Docs quality":null,"Context7 / LLM-friendliness":null},"total":null},{"provider":"GCP","dimensions":{"CLI JSON output":5,"Read-only token scopes":4,"Billing API granularity":3,"Per-bucket metrics":4,"Terraform coverage":5,"API rate limits":4,"Docs quality":3,"Context7 / LLM-friendliness":4},"total":"32/40"},{"provider":"OCI","dimensions":{"CLI JSON output":5,"Read-only token scopes":4,"Billing API granularity":4,"Per-bucket metrics":5,"Terraform coverage":4,"API rate limits":2,"Docs quality":3,"Context7 / LLM-friendliness":3},"total":"30/40"},{"provider":"Azure","dimensions":{"CLI JSON output":5,"Read-only token scopes":4,"Billing API granularity":4,"Per-bucket metrics":3,"Terraform coverage":5,"API rate limits":4,"Docs quality":4,"Context7 / LLM-friendliness":5},"total":"34/40"},{"provider":"Akamai (Linode)","dimensions":{"CLI JSON output":4,"Read-only token scopes":4,"Billing API granularity":1,"Per-bucket metrics":3,"Terraform coverage":4,"API rate limits":3,"Docs quality":4,"Context7 / LLM-friendliness":5},"total":"28/40"},{"provider":"Cloudflare","dimensions":{"CLI JSON output":2,"Read-only token scopes":5,"Billing API granularity":1,"Per-bucket metrics":3,"Terraform coverage":4,"API rate limits":3,"Docs quality":4,"Context7 / LLM-friendliness":5},"total":"27/40"},{"provider":"DigitalOcean","dimensions":{"CLI JSON output":5,"Read-only token scopes":5,"Billing API granularity":2,"Per-bucket metrics":1,"Terraform coverage":5,"API rate limits":3,"Docs quality":5,"Context7 / LLM-friendliness":5},"total":"31/40"},{"provider":"Hetzner","dimensions":{"CLI JSON output":5,"Read-only token scopes":3,"Billing API granularity":0,"Per-bucket metrics":0,"Terraform coverage":4,"API rate limits":4,"Docs quality":4,"Context7 / LLM-friendliness":4},"total":"24/40"},{"provider":"Vultr","dimensions":{"CLI JSON output":4,"Read-only token scopes":1,"Billing API granularity":1,"Per-bucket metrics":1,"Terraform coverage":4,"API rate limits":1,"Docs quality":2,"Context7 / LLM-friendliness":2},"total":"16/40"},{"provider":"OVHcloud","dimensions":{"CLI JSON output":4,"Read-only token scopes":4,"Billing API granularity":5,"Per-bucket metrics":2,"Terraform coverage":5,"API rate limits":4,"Docs quality":5,"Context7 / LLM-friendliness":5},"total":"34/40"}],"score_convention":"Scores are 0–5, 5 best. Note the sign convention: operational risk is scored as \"risk handled well\", so 5 = lowest risk."}