fix(helm): bundle swiss 0.7.0 for catalog schema v2 and writable catalogs

CHANGELOG.md

@@ -7,6 +7,12 @@ chart's `appVersion`; the image and chart are released together under it.
 
 ## [Unreleased]
 
+### Added
+- The chart can install a writable catalog — the swiss chart's catalog-server, swiss 0.7.0+; named in the site profile, it lets the Model Library add models even when the site's own catalog is a read-only static index (#90).
+
+### Changed
+- The swiss subchart is 0.7.0 (was 0.6.3). 0.6.3 predates catalog schema v2 and the site profile's `schemaVersion`/`writable`, so with a bundled swiss the Model Library could not read a v2 catalog or save one (#90).
+
 ### Fixed
 - Overlay panels keep their edge. The site-wide "no focus ring" rule zeroed the `ring-1` that draws the border of menus, popovers, selects, comboboxes and dialogs, so an open white panel on the white page showed only a faint shadow — the top-bar avatar menu read as a line of text floating under the header.
 - The top-bar avatar menu names the signed-in user — avatar, name, role and, when console has one to read, the email — instead of a single `name · role` line. With `server.auth.disabled` the user button itself turns amber and the avatar carries a dot, so the state shows without opening anything and the bar gains no element; the menu carries 登录已关闭，当前为管理员身份 (*Sign-in off — acting as the administrator*) in place of change-password and sign-out, which that mode cannot honour.

docs/console-design.md

@@ -496,6 +496,8 @@ Console adds nothing to the path.
 | New model | **New model** in the library toolbar, with fields for its name and first variant id that write into both files: `metadata.yaml` and a first variant copied from one the catalog has, in one commit (catalog-server's `POST models`); the page then opens the new model |
 | Freshness | swissd drops its cached index on a write, so the page refetches and shows the commit |
 
+Console owns no catalog storage and publishes no index of its own. A writable catalog is a catalog-server the site profile names; an install whose own catalog is a static index gets one from the swiss chart, which vendors catalog-server since 0.7.0 (`swiss.catalogServer`; the chart README covers enabling it, its token, and the profile entry). A console-hosted catalog was rejected: it would duplicate catalog-server's repository and write API, and its publication would be deprecated schema v1, which the LLMSvc backend cannot deploy.
+
 ## Playground
 
 The Playground is chat against the inference gateway, for the question a

helm/console/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: swiss
   repository: oci://ghcr.io/modelsphere/charts
-  version: 0.6.3
-digest: sha256:d7d5f29c782c8b3106d2717e989ef799e48cb5a874fdef689cf392ca531db3e7
-generated: "2026-10-08T13:00:31.898408+08:00"
+  version: 0.7.0
+digest: sha256:6d03b121a65a1a38f0422d09b50679a7d671b1b32a14885309da7b8531180c1c
+generated: "2026-10-22T03:37:03.797449782-07:00"

helm/console/Chart.yaml

@@ -12,6 +12,6 @@ keywords: [console, llm, inference, portal]
 # render this chart until it has run, even with swiss.enabled off.
 dependencies:
   - name: swiss
-    version: 0.6.3  # always use a stable version
+    version: 0.7.0  # always use a stable version
     repository: oci://ghcr.io/modelsphere/charts
     condition: swiss.enabled

helm/console/README.md

@@ -56,7 +56,7 @@ Builds from `main` need the full version. **Do not use `--devel` to get the "lat
 | Helm runs with cluster-admin rights | all | the chart creates IAM CRDs and a ClusterRole/ClusterRoleBinding (the platform-admin role has `*`, and Kubernetes only lets a user who already holds those rights create it); with Swiss it also creates Roles in other namespaces | `kubectl auth can-i '*' '*' --all-namespaces` prints `yes` |
 | linux/amd64 nodes | all | the image is amd64 only | `kubectl get nodes -L kubernetes.io/arch` |
 | nodes can reach `ghcr.io` | all | the Console image is on GHCR | — |
-| Swiss chart 0.6.0 or later with `auth.proxyKey` on, or Swiss running with `auth.disabled=true` | existing Swiss | Console calls Swiss on behalf of the signed-in user with the proxyKey | see [Find Swiss and the gateway](#1-find-swiss-and-the-gateway) |
+| Swiss chart 0.7.0 or later with `auth.proxyKey` on, or Swiss running with `auth.disabled=true` | existing Swiss | Console calls Swiss on behalf of the signed-in user with the proxyKey; 0.7.0 is also the first chart with catalog schema v2 and the site profile's `schemaVersion`/`writable` | see [Find Swiss and the gateway](#1-find-swiss-and-the-gateway) |
 | a Swiss site profile exists and `cluster.profile.key` is `profile.yaml` (the default) | existing Swiss | Console reads the gateway entrypoint from the profile, and only from the `profile.yaml` key; Swiss creates the profile the first time settings are saved in its UI | same as above |
 
 ## Connecting to an existing Swiss
@@ -92,7 +92,7 @@ kubectl -n modelsphere create secret generic swiss-proxy-key --from-file=proxyKe
 rm proxyKey
 ```
 
-If the second command prints nothing, this Swiss has no proxyKey: upgrade the Swiss chart to 0.6.0 or later, or run it with `auth.disabled=true`.
+If the second command prints nothing, this Swiss has no proxyKey: upgrade the Swiss chart to 0.7.0 or later, or run it with `auth.disabled=true`.
 
 ### 3. Write the values
 
@@ -131,6 +131,47 @@ helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \
   --wait --timeout 10m
 ```
 
+## Adding models from the Model Library
+
+Read-only catalogs are enough to deploy. **New model**, **Edit model**, **Add variant** and **Catalog settings** need a **writable** catalog: a catalog-server serving schema v2. A static `index.json` catalog stays read-only.
+
+| Your install | Where the writable catalog comes from |
+|---|---|
+| Swiss bundled (`swiss.enabled=true`) | the swiss chart's `catalogServer` (0.7.0+), enabled below |
+| Existing Swiss (`externalSwiss`) | upgrade Swiss to chart 0.7.0, enable its `catalogServer`, or point swissd at any catalog-server it can reach |
+
+```bash
+# The write token: catalog-server reads it from a Secret, and you enter the same
+# value in the site profile below. Keep it out of values files.
+TOKEN=$(openssl rand -hex 24)
+printf -- '- name: console\n  email: console@example.com\n  token: %s\n' "$TOKEN" > tokens.yaml
+kubectl -n modelsphere create secret generic console-catalog-tokens --from-file=tokens.yaml
+rm tokens.yaml
+printf 'Write token: %s\n' "$TOKEN"
+
+helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \
+  --namespace modelsphere \
+  --set swiss.enabled=true --set 'swiss.rbac.namespaces={models}' \
+  --set swiss.catalogServer.enabled=true \
+  --set swiss.catalogServer.tokens.existingSecret=console-catalog-tokens
+```
+
+That runs catalog-server in the release's namespace and serves the catalog at `http://<release>-catalog-server.<namespace>.svc`. Its repository is a PVC, kept across `helm upgrade` and `helm uninstall`; storage, tokens and an optional ingress are the swiss chart's values (`helm show values oci://ghcr.io/modelsphere/charts/swiss --version 0.7.0`).
+
+Then, in Console:
+
+1. **Model Serving → Site Profile**: add a catalog with `schemaVersion: v2`, **Writable** ticked, and the write token printed above. For the release above:
+
+   ```yaml
+   catalogs:
+     - name: local
+       url: http://console-catalog-server.modelsphere.svc
+       schemaVersion: v2
+       writable: true
+   ```
+
+2. **Model Library**: **Set up this catalog** while the catalog is empty, then **New model**. Each change is one commit to the catalog's git repository; see [Deploying models](https://github.com/modelsphere/console/blob/main/web/src/modules/docs/content/en-US/deploy.md#edit-a-catalogs-variants) for editing models and variants.
+
 ## Check and sign in
 
 ```bash

helm/console/README.zh-CN.md

@@ -56,7 +56,7 @@ kubectl -n modelsphere port-forward svc/console-console 8080:8080
 | Helm 使用 cluster-admin 级权限 | 全部 | Chart 创建 IAM CRD、ClusterRole/ClusterRoleBinding（platform-admin 角色含 `*` 权限，Kubernetes 只允许已持有这些权限的用户创建），接入 Swiss 时还要在其他 namespace 创建 Role | `kubectl auth can-i '*' '*' --all-namespaces` 输出 `yes` |
 | linux/amd64 节点 | 全部 | 镜像只有 amd64 | `kubectl get nodes -L kubernetes.io/arch` |
 | 节点能访问 `ghcr.io` | 全部 | Console 镜像在 GHCR | — |
-| Swiss Chart 0.6.0 及以上且开启 `auth.proxyKey`，或 Swiss 以 `auth.disabled=true` 运行 | 接入 Swiss | Console 用 proxyKey 代表登录用户访问 Swiss | 见[找到 Swiss 和网关](#1-找到-swiss-和网关) |
+| Swiss Chart 0.7.0 及以上且开启 `auth.proxyKey`，或 Swiss 以 `auth.disabled=true` 运行 | 接入 Swiss | Console 用 proxyKey 代表登录用户访问 Swiss；目录 schema v2 和 site profile 的 `schemaVersion`/`writable` 也从 0.7.0 开始支持 | 见[找到 Swiss 和网关](#1-找到-swiss-和网关) |
 | Swiss site profile 已存在，且 `cluster.profile.key` 为 `profile.yaml`（默认值） | 接入 Swiss | Console 从 profile 读取网关入口，且只读 `profile.yaml` 这个 key；profile 在 Swiss 网页首次保存设置时才创建 | 同上 |
 
 ## 接入已有 Swiss
@@ -92,7 +92,7 @@ kubectl -n modelsphere create secret generic swiss-proxy-key --from-file=proxyKe
 rm proxyKey
 ```
 
-第二条没有输出时，说明这个 Swiss 没有 proxyKey：升级 Swiss Chart 到 0.6.0 及以上，或让它以 `auth.disabled=true` 运行。
+第二条没有输出时，说明这个 Swiss 没有 proxyKey：升级 Swiss Chart 到 0.7.0 及以上，或让它以 `auth.disabled=true` 运行。
 
 ### 3. 写 values
 
@@ -131,6 +131,46 @@ helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \
   --wait --timeout 10m
 ```
 
+## 新增模型（可写目录）
+
+只读目录足以部署。**新增模型**、**编辑模型**、**新增变体**和**目录设置**则需要**可写**目录，即提供 schema v2 的 catalog-server；静态 `index.json` 目录保持只读。
+
+| 你的安装 | 可写目录从哪来 |
+|---|---|
+| 自带 Swiss（`swiss.enabled=true`） | 打开 swiss chart 的 `catalogServer`（0.7.0+），见下 |
+| 接入已有 Swiss（`externalSwiss`） | 把 Swiss 升到 Chart 0.7.0 并打开它的 `catalogServer`，或让 swissd 指向任意可达的 catalog-server |
+
+```bash
+# 写 token：catalog-server 从 Secret 读取，同一个值稍后填进 site profile。不要写进 values 文件。
+TOKEN=$(openssl rand -hex 24)
+printf -- '- name: console\n  email: console@example.com\n  token: %s\n' "$TOKEN" > tokens.yaml
+kubectl -n modelsphere create secret generic console-catalog-tokens --from-file=tokens.yaml
+rm tokens.yaml
+printf 'Write token: %s\n' "$TOKEN"
+
+helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \
+  --namespace modelsphere \
+  --set swiss.enabled=true --set 'swiss.rbac.namespaces={models}' \
+  --set swiss.catalogServer.enabled=true \
+  --set swiss.catalogServer.tokens.existingSecret=console-catalog-tokens
+```
+
+这会在 release 所在 namespace 运行 catalog-server，目录地址为 `http://<release>-catalog-server.<namespace>.svc`。目录仓库放在 PVC 上，`helm upgrade` 和 `helm uninstall` 都会保留；存储、token、可选 ingress 都是 swiss chart 的 values（`helm show values oci://ghcr.io/modelsphere/charts/swiss --version 0.7.0`）。
+
+然后在 Console 里：
+
+1. **模型服务 → Site Profile**：新增目录，`schemaVersion: v2`、勾选 **Writable**、填入上面的写 token。对应上面的 release：
+
+   ```yaml
+   catalogs:
+     - name: local
+       url: http://console-catalog-server.modelsphere.svc
+       schemaVersion: v2
+       writable: true
+   ```
+
+2. **模型库**：目录为空时点 **Set up this catalog**，之后点 **New model**。每次改动都是目录 git 仓库的一次提交；模型和变体的编辑见[部署模型](https://github.com/modelsphere/console/blob/main/web/src/modules/docs/content/zh-CN/deploy.md#编辑目录中的变体)。
+
 ## 检查和登录
 
 ```bash

helm/console/values.yaml

@@ -89,6 +89,13 @@ backends: []
 # differently is here. The chart refuses to render without rbac.namespaces, the
 # namespaces holding model releases:
 #   --set swiss.enabled=true --set 'swiss.rbac.namespaces={models}'
+#
+# A writable catalog, so the model library can add and edit models (swiss
+# 0.7.0+): the swiss chart vendors catalog-server; enable it and give it a write
+# token, then name it in the site profile. See "Adding models from the Model
+# Library" in the chart README.
+#   --set swiss.catalogServer.enabled=true \
+#   --set swiss.catalogServer.tokens.existingSecret=console-catalog-tokens
 swiss:
   enabled: false
   auth: