Reference
This section collects the precise contracts that application developers, client implementers, and operators need after learning the system model. It keeps API-like details separate from the explanatory path without making them independent of that model.
Reference map
Server composition covers implementation families, exact role dependencies, node configuration, lifecycle failure behavior, readiness, and host ownership.
Identity and tenancy defines canonical users and tenants, logical clients and runtime instances, authenticated boundaries, shared-tenancy composition, and the exact isolation limits of that mode.
Client packages and runtimes defines the shared core and the browser, console, web, mobile/native, and UI packages.
Client runtime reference documents how the core, browser, console, cooperative-web, and mobile/native compositions are constructed, started, reconnected, extended, and stopped.
Application API covers identity scoping, admission and dispatch, SendOptions, terminal and delivery evidence, response waiting, history, presence, and payload references.
Derived views documents the optional incremental projection engine, custom and supplied reducers, state-and-cursor checkpoints, error policies, snapshot stores, atomic rebuilds, and the frozen v1 operating boundary.
Worker pools documents application-side acquisition, guarded context handles, selection strategies, browser placement and protection, assignment cleanup, and the limits of horizontal auto-provisioning.
Site relays documents application-governed access to one bounded local HTTP site, compatibility rewriting, optional cooperative-page behavior, and connector ownership.
Protocol 1.0 gives the cross-language JSON contract for connection and negotiation, command delivery and acknowledgement, HTTP return, state reports, validation, and conformance.
Capture and payloads defines post-command evidence, trusted parser definitions, signed payload references, encrypted envelopes, Redis history spill, and the optional browser-capture service.
Diagnostics and observability defines the administrator-facing inspector API, live and retained evidence, delivery and worker topology, DevConsole boundaries, server tracing, and client telemetry.
UI integration documents the private source-consumed component layers, diagnostic composites, themes and payload renderers, dashboards, serving shapes, and the separate observation and control boundaries.
Actions and capabilities separates universal core actions from browser, page, console, native, and product actions and explains capability discovery.
Action catalog gives the executable contracts for core and custom actions, browser control, page interaction, and console or machine work.
Maturity and limits states which surfaces have the strongest implementation evidence and which limits affect architecture or production claims.
Sources of authority
The live contract is implemented across paired Python and TypeScript models, validators, transport adapters, role services, runtime factories, handlers, and focused tests. This reference explains that contract. An old standalone specification does not override the executable cross-language boundary.
Product actions remain documented with their products. Optional feature protocols remain beside the feature implementation when they extend the core message model. A handler present in one demonstration does not become a built-in action merely because it travels through Cheetah.
Reading conventions
client_id means the stable logical installation within an authenticated principal. instance_id means one running client lifetime. command_id identifies server-issued work. message_id identifies one returned HTTP delivery. These identities are not interchangeable.
Examples use debug_insecure only when they explicitly describe controlled localhost development. Strict transport, secure external endpoints, independent HTTP authentication, and real identity integration are the normal deployment expectation.