v0.14.1: changelog and README

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -18,7 +18,7 @@ is only released once its **exit criterion** is met, not when its code lands.
 | v0.11.0 | — | High availability from setup, the setup and console screens, usage sums and per-tenant alerts | released |
 | v0.12.0 | — | The cluster's settings in the store, in force when changed; the firewall switch; wipe | released |
 | v0.13.0 | — | The whole system stopped and started from one command; Qwen3Guard judges, on a GPU and CPUs together | released |
-| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released |
+| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released (v0.14.1: adapters, the tree over the API, the firewall on every machine) |
 | v1.0.0 | 5 | Tenancy, prefix affinity, benchmarking | planned |
 
 Until v1.0.0 the minor version is the breaking one: configuration formats and Go
@@ -26,6 +26,31 @@ APIs change between minors without a deprecation period.
 
 ## Unreleased
 
+## v0.14.1 — 2026-10-09
+
+Adapters trained on the nodes from a knowledge base and kept private to
+their owners; the cluster's and the agents' settings edited in one place;
+the tenancy tree and keys over the admin API and in Terraform; knowledge
+bases that hold up with many documents; the firewall setting on every
+machine.
+
+**Upgrading.**
+- **Nodes** need this release to follow `agents.*` in the cluster's
+  settings; until a node is upgraded its agent.yaml is what it runs on.
+- **A separate mirror machine and store members that run nothing else**
+  follow the firewall setting once what reads it is installed: run `sudo
+  llmgw mirror init` on the mirror again with the flags it was set up with,
+  and `llmgw server init --patroni` again for the store's members. A control
+  plane set up before v0.12.0 needs `sudo llmgw firewall sync --install`.
+- **The store's PostgreSQL memory** applies after each member is restarted,
+  one at a time, the leader last; until then it runs as before.
+- The store gains tables and columns; nothing to do. Existing knowledge-base
+  collections get their full-text index when a control plane starts, and
+  keep `vector` storage; only new collections use `halfvec`, and only on
+  pgvector 0.7 or later.
+- Cached knowledge-base passages in vLLM are made again once, under the new
+  `cache_salt`.
+
 ### Added
 
 - **The cluster's settings on the portal** (BACKLOG E4): `/admin/settings`
@@ -55,7 +80,6 @@ APIs change between minors without a deprecation period.
 - The knowledge bases' vLLM `cache_salt` follows the collections searched,
   not the organization, so two teams of one organization no longer share
   cached passages.
-
 - **Organizations, teams, projects, API keys and memberships in the admin
   API**: `/api/v1/orgs` (the tree), `POST /api/v1/teams` and `projects`,
   `PATCH` to rename or move, `DELETE` for what is empty; `/api/v1/keys` to
@@ -64,7 +88,6 @@ APIs change between minors without a deprecation period.
   and `users` on a control plane before. The Terraform provider manages them
   as `llmgw_org`, `llmgw_team`, `llmgw_project`, `llmgw_key` (the key in a
   sensitive `secret`) and `llmgw_membership`.
-
 - **The firewall setting reaches every machine.** A separate mirror and the
   store's members follow `firewall.enabled` and `firewall_networks` as nodes
   and control planes did: the leading control plane tells the mirror over
@@ -95,7 +118,6 @@ APIs change between minors without a deprecation period.
   (`X-Llmgw-Knowledge-K`) got at most 40 candidates per collection from the
   vector index, whatever it asked for: pgvector's `hnsw.ef_search` is now
   raised to the number wanted, up to 1000.
-
 - `llmgw server backup` and `restore` against a replicated store over TLS
   failed looking for `~/.postgresql/root.crt`: pg_dump was given
   `sslmode=verify-full` without the cluster's authority.

README.md

@@ -40,7 +40,7 @@ Releases track the roadmap phases; see [CHANGELOG.md](CHANGELOG.md).
 | v0.11.0 | — | High availability from setup, the setup and console screens, usage sums and per-tenant alerts | released |
 | v0.12.0 | — | The cluster's settings in the store, in force when changed; the firewall switch; wipe | released |
 | v0.13.0 | — | The whole system stopped and started from one command; Qwen3Guard judges, on a GPU and CPUs together | released |
-| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released |
+| v0.14.0 | — | Knowledge bases: documents from people's own machines, kept apart per tenant, answered from | released (v0.14.1: adapters, the tree over the API, the firewall on every machine) |
 | v1.0.0 | 5 | Tenancy, prefix affinity, benchmarking | planned |
 
 As of v0.6.0 a cluster runs unattended: agents report their hardware, the
@@ -50,6 +50,13 @@ budgets and rate limits decide who may use any of it.
 
 Since v0.11.0 (each release's detail is in [CHANGELOG.md](CHANGELOG.md)):
 
+- **Adapters, and the tenancy tree over the API** (v0.14.1). `llmgw ctl
+  kb dataset` and `llmgw ctl train` make a LoRA adapter from a collection
+  on a node's spare GPU memory, kept on the mirror and seen only by its
+  owner. Organizations, teams, projects, keys and memberships are in the
+  admin API and the Terraform provider. The agents' settings are edited
+  with the cluster's, on the portal too, and the firewall setting reaches
+  every machine.
 - **Knowledge bases** (v0.14.0). People put a company's documents in from
   their own machines with `llmgw-kb`, a separate download for Windows,
   macOS and Linux that reads PDF, Office, OpenDocument, mail and many more