Trained adapters published, private to their owners like the knowledge bases they come from

An adapter now has an owner (org, team, project, user or key): only callers
there see it, and to anyone else it is a model that does not exist, absent
from /v1/models too. A training job's owner defaults to the one collection
its pairs come from, must be able to read every collection they come from,
and pairs from a knowledge base are never made public. ctl train publish
keeps the GGUF or PEFT files on the mirror, which accepts uploads now, and
sets the owned adapter after the usual architecture check.

The knowledge bases' cache_salt follows the collections searched rather
than the organization, so two teams of one organization no longer share
cached passages.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/admin-api.openapi.json

@@ -3940,6 +3940,48 @@
         }
       }
     },
+    "/api/v1/train/jobs/{id}/publish": {
+      "post": {
+        "operationId": "postTrainJobsIdPublish",
+        "summary": "Make what a finished job made the model's adapter",
+        "description": "Kept on the mirror — the GGUF for a model llama.cpp serves, the PEFT files for one vLLM serves — and added to the model's adapters after the same check as POST /api/v1/models/{name}/adapters.",
+        "tags": [
+          "train"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The job's ID, as starting it answered.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/Actor"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TrainPublishView"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "default": {
+            "$ref": "#/components/responses/Error"
+          }
+        }
+      }
+    },
     "/api/v1/updates": {
       "get": {
         "operationId": "getUpdates",
@@ -5378,6 +5420,10 @@
           "ord": {
             "type": "integer"
           },
+          "collection": {
+            "type": "string",
+            "description": "Collection is where the pair came from: an adapter trained on it belongs to a part of the tree that may read it."
+          },
           "error": {
             "type": "string"
           }
@@ -7089,6 +7135,9 @@
           "node": {
             "type": "string"
           },
+          "owner": {
+            "type": "string"
+          },
           "gpu_memory_mib": {
             "type": "integer"
           },
@@ -7143,6 +7192,28 @@
           }
         }
       },
+      "TrainPublishView": {
+        "type": "object",
+        "description": "TrainPublishView is an adapter published: where the nodes fetch it from, and what to do for replicas to load it.",
+        "properties": {
+          "adapter": {
+            "type": "string"
+          },
+          "model": {
+            "type": "string"
+          },
+          "source": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string",
+            "description": "Owner is who sees it; empty is every caller of the model."
+          },
+          "note": {
+            "type": "string"
+          }
+        }
+      },
       "TrainRequest": {
         "type": "object",
         "description": "TrainRequest queues a job.",
@@ -7169,6 +7240,14 @@
           "gpu_memory_mib": {
             "type": "integer"
           },
+          "owner": {
+            "type": "string",
+            "description": "Owner is who the adapter will belong to: org:, team:, project: (by path or ID), user: or key:. Only callers there see it. When the pairs come from one knowledge base, it defaults to that collection's owner; it must be able to read every collection they come from."
+          },
+          "public": {
+            "type": "boolean",
+            "description": "Public makes the adapter every caller's its model allows. Refused for pairs from a knowledge base."
+          },
           "data": {
             "type": "string",
             "description": "Data is the pairs, NDJSON of {\"q\", \"a\"} (llmgw ctl kb dataset)."
@@ -7334,6 +7413,10 @@
           "scale": {
             "type": "number",
             "description": "Scale is how strongly it is applied; zero takes 1."
+          },
+          "owner": {
+            "type": "string",
+            "description": "Owner is the part of the tenancy tree the adapter belongs to — org:ID, team:ID, project:ID, user:ID or key:ID — and only callers in it see it: to anyone else it is a model that does not exist. An adapter trained on an organisation's documents carries some of what they say in its weights. Empty is every caller the model allows."
           }
         }
       },