Drop-in proxy
A mirror nobody adopts is worth nothing, and the thing that stops adoption is having to change how every build works. So the bar here was that your existing tools must talk to LibWorld unmodified: every backend implements its ecosystem's real wire protocol, and the change on your side is a URL.
The real protocol, not a lookalike
There is no generic file cache with a prefix behind this. Each backend is a real implementation of what its clients already expect: the PEP 503 simple index for pip, packuments for npm, the sparse HTTP index for cargo, GOPROXY for go, the compact index for rubygems, a V3 service index for NuGet, the Docker Registry V2 API for docker.
Where a protocol embeds absolute URLs — an npm packument's dist.tarball, a NuGet registration, a pip index page — those are rewritten to point back at LibWorld. Otherwise a client would discover the mirror and then resolve straight past it.
Docker is the clearest case: it is served at /v2/, not under a /docker/ prefix, because that is where the Registry V2 API lives. Serving it anywhere else would look tidier and would mean no real dockerd could ever use it.
What is cached forever and what is re-asked
Artifacts that are immutable by construction — a wheel, a crate, a module zip, a .nupkg, a layer blob addressed by digest — are stored once and served from cache with no upstream round trip.
Anything that legitimately changes is revalidated: index pages, packuments, maven-metadata.xml, docker tags. The split is per-backend and is stated on each backend's own page.
What it costs
Stated plainly, because a claim with no stated cost is the one nobody re-checks.
pip refuses a plain-http index unless the host is also in --trusted-host, and it does not error when you forget — it drops the index and reports "no matching distribution found". The message names the package, never the configuration.