Panel Models

The Models pages cover router residency, file inspection and selection, checked downloads, access tokens, publication previews, verified admission, offline import and network-share caching. An artifact being present on disk is not proof that it was verified or that inference is running. Actions operate through the Panel's authenticated native routes.

Get started

Open Models at /rust/models. Select Guided model workflows (/rust/models/guides) for three interactive, administrator-only walkthroughs. Each step uses the same registered owner, checks the returned result, and keeps a copy of your entered inputs for the next step; the import walkthrough carries the returned job ID into its status step. The verified-only walkthrough offers Undo preceding setting immediately after its reversible policy step. A queued download or running import does not count as a verified artifact. The acquisition section links to Router status, Model file actions, Downloads and publishing, Verification, Offline import, Library and Cache transfers. The other existing pages are Downloads (/rust/downloads), Library (/rust/library) and Model cache (/rust/storage/cache). Controls for changing model bytes, settings or job state are only offered to administrators.

Inspect and choose an on-disk model

Open Model file actions (/rust/models/catalog) from the Models home page. Read Model inventory state before acting; a loading, stale or failed inventory deliberately withholds file actions. Reload inventory progress is read-only. The disk bar shows available space.
In Available models, use Check to run the structure doctor on an exact file, Where to preview placement needs, or Edit to open metadata editing. A plan changes nothing. Projector pairing information is shown beside each file; a mismatched projector is not interchangeable with the selected model.
For metadata changes, adjust the fields, choose Preview, review the proposed new-file changes, then check I authorize writing a new model file and choose Write new file. Follow Refresh job status until done or choose Cancel with the confirmation. The original file remains unchanged.
To choose a target model or matching projector, check Restart the selected instance to apply this choice and choose Use. This saves the selection and requests a restart; check the instance and router state after the request because accepted is not the same as loaded.
To delete a file, choose Delete, recheck that no profiles or other references hold it, type the exact filename, and check I understand deletion is permanent before choosing Delete again. This removes an unreferenced file irreversibly. Prefer Archive unused model in the Library when retention is needed.

See live router residency

Open View selected-router status (/rust/models/router-live). Select a valid instance in Panel navigation first. This is the live router, not the on-disk inventory.
Choose Refresh router list to get the current statuses. If a compatible selected model set is present, the page checks its live admission and resident limit before offering load actions.
Choose Connect live status for streaming changes, or disconnect to stop the feed. A delayed or interrupted feed is resynchronized from an authoritative router snapshot.
Administrators may choose Load or Unload on an exact eligible model only after confirmation. The page checks the current model identity and state again before posting to the registered owner; completion must be verified by refreshed router status. Viewers can inspect but do not receive mutation buttons.

Manage access and publish inspected files

Open Download, access token and publishing (/rust/models/publishing). A read credential for gated repository downloads is stored by the existing credential owner; its secret is not displayed. Use Save after entering the token or Remove with confirmation.
In Publish measured model, enter Destination owner/repository, Model file paths (comma-separated), and Sealed qualification IDs (comma-separated). The new destination defaults to private. Choose Preview card and files.
Review the generated card, each exact file size and SHA-256, and the preview binding. Type the exact repository name and check Upload these verified files and card before choosing Publish preview. The owner checks qualifications and the preview binding before any upload. An unavailable preview blocks publication.
The same page has Transfers, Request cancellation and Cancel transfer controls, with explicit acknowledgement that stopping retains the partial file. Reload the page to follow progress and verification state.

Download a model from Hugging Face

Open Download, access token and publishing (/rust/models/publishing), Downloads (/rust/downloads), or use Start artifact download on Models.
Enter a direct HTTPS artifact URL (the file's resolve link rather than its repository web page). When using an independently supplied SHA-256, also enter Expected size in bytes. The transfer owner can validate an appropriate verified repository listing, but a direct artifact outside that listing needs both exact values.
Choose Start download. This queues a background transfer; it does not select or start an instance. For a gated repository, first obtain permission and separately acknowledge its terms on the form.
Reload Transfers or Download progress until the exact transfer is done and its Integrity field reports SHA-256 verification. A running, verifying or failed transfer is not verified. Cancel download requests a cooperative stop and can retain a safe partial for verified retry.
Open Model library, refresh the inventory and inspect the model. Its verification status and known SHA-256 are separate from the serving state.

Upload a local model and admit exact verified bytes

Open Upload a local model using /rust/files and place the GGUF inside the configured models directory. If the file is on a second disk, prefer the offline import form below. Uploading or placing a file does not set verified provenance.
Open Verification (/rust/models/verification). Choose Only verified models under Change verified-only mode, check the confirmation and choose Save model verification policy. Files without trusted provenance will be hidden from model listings.
Under Verify and admit a model, enter its Relative GGUF path, independently obtained Expected SHA-256 (64 hex) and Exact file size (bytes), then confirm and choose Verify full file and admit.
The admission owner validates the regular GGUF, exact size and entire SHA-256. A mismatch fails without registering it. Inspect the returned registered: true and the Library entry before using it.
To allow unverified listings again, select All models and save. This changes visibility, not provenance.

Import from a separately mounted disk, without internet

Mount the second disk using system storage controls. Confirm a trusted regular .gguf file is present. Use an absolute normalized Absolute source disk file path. Do not type a device path.
Open Offline import (/rust/models/offline-import). Enter the New library filename (.gguf) (not one already in the library), Expected SHA-256 (64 hex), and Expected file size (bytes).
Check the confirmation and choose Start verified offline import. This starts an asynchronous copy; the source is left untouched.
Copy the id in the response. In Import progress, paste it into Import job ID and choose Refresh import job until status is done with verified: true. A digest mismatch refuses publication and the staging bytes may be quarantined for inspection.
Inspect the published file and provenance in Model library. Verified-only mode refuses an import that omits the expected digest and size.

Model cache on network shares

Open Model cache (/rust/storage/cache). The status page explains whether the Models storage role uses a supported network share and lists current cache entries, byte use, and the configured cap.
Set Cache cap (GiB) with Save cache cap if needed, confirming that local least-recently-used entries may be evicted.
Enter Model on configured share and choose Prepare model cache. A miss stages model shards, checks source and local SHA-256 values, and completes before the verified local copy is used for launch.
Monitor Current copy and separately open Cache transfers (/rust/models/cache-transfers) to see /api/storage/cache/transfer-status. The transfer queue is distinct from the local model-cache inventory. The shared source is never deleted by cache eviction.

Full integrity check before load

Under Verification, enter Relative GGUF path and choose Start full integrity check. Follow Monitor hash jobs in the library to see when the throttled re-hash finishes. This explicit action reads the whole file and compares recorded integrity; it is not an automatic hash-on-every-load switch. The current native model owner does not expose a per-launch full-hash switch, so do not assume one is enabled. Keep the normal fast launch path unless you deliberately run the check.

Model control reference

Every control's ? help marker uses these exact tooltip sentences. File actions and download forms are rendered within the native page shell, with the registry providing their tooltips and backend route mappings.

Control	Feature ID	Tooltip
Live router models	`models.router`	Read selected-router model states rather than assuming a file on disk is loaded.
Refresh router models	`models.router-refresh`	Fetch a new selected-instance router snapshot before offering model actions.
Connect live router events	`models.router-live`	Stream live router model state changes; disconnect to stop the event feed.
Load router model	`models.router-load`	Ask the selected router to load this exact model; refresh to confirm it has loaded.
Unload router model	`models.router-unload`	Unload this exact model from the selected router; requests using it may be affected.
Model inventory controls	`models.catalog`	See inspected model files, selected instances, disk space and the current scan state.
Check model structure	`models.inspect`	Run the file doctor against an exact model path; this does not select or start it.
Plan model placement	`models.placement`	Show a hardware placement plan for this model without changing the running instance.
Preview model metadata edit	`models.edit`	Plan edits against a model and write any approved changes to a new file; the original remains unchanged.
Check or cancel metadata job	`models.edit-jobs`	Refresh an exact edit job or request its cancellation without deleting the original file.
Select model or projector	`models.select`	Save the selected model or matching projector, then request an instance restart; active requests may be interrupted.
Permanently delete unreferenced file	`models.delete`	Permanently delete one unreferenced file only after typing its exact filename and acknowledging the loss.
Save or remove repository access token	`models.hub-token`	Store or remove the repository credential securely; its secret is never shown on the page.
Preview model publication	`models.publish-preview`	Preview the proposed card and exact file hashes before any remote upload occurs.
Publish inspected model	`models.publish-commit`	Publish the reviewed files only after re-entering the exact repository and confirming their preview binding.
Guided model workflows	`models.guides`	Work through checked download, offline import and verified-admission steps with explicit authorization and results.
Start artifact download	`models.download`	Download a model artifact; it enters the library only after the transfer owner verifies its source or exact SHA-256.
Download progress	`models.download-progress`	Show transfer progress and the reported verification result; a completed transfer is not proof of a running model.
Cancel download	`models.download-cancel`	Ask the transfer worker to stop; a retained verified partial can be resumed using the same download identity.
Upload model	`models.upload`	Use the authenticated file manager to stage a local file; uploading alone never marks it as verified.
Model library	`models.inventory`	Inspect models, current hashes, duplicates, references and archive eligibility without activating a model.
Populate model hashes	`models.hash`	Calculate missing SHA-256 values in a throttled job; a cached hash alone is not verified provenance.
Re-hash before loading	`models.integrity`	Request an explicit full integrity re-hash before loading; this does not enable automatic hashing on every launch.
Verified-only mode	`models.verified-only`	Hide models without valid verified provenance; disabling this setting makes unverified files visible again.
Admit verified model	`models.admit`	Verify the exact GGUF size and SHA-256 on disk before recording a trusted local admission.
Import from second disk	`models.import`	Copy an ordinary GGUF from a separately mounted disk; an expected digest makes the copied model verified.
Import job status	`models.import-status`	Read the exact import job's copied bytes, final state and digest; starting a job is not completion.
Model cache	`models.cache`	Inspect network-share cache status and prepare a verified local copy before loading a shared model.
Cache capacity	`models.cache-capacity`	Set the local cache size cap; lowering it may evict local copies but never deletes share sources.
Cache transfer status	`models.cache-progress`	Inspect the storage transfer owner's current status; this is separate from the model-cache inventory.
Archive unused model	`models.archive`	Move an eligible unreferenced model into the archive after an exact-name confirmation; do not delete its bytes.

Troubleshooting

If a file is absent under verified-only mode, verify both its bytes and provenance; computing an untrusted local hash is insufficient. An import can refuse a symlink, a hard-linked file, a source changed during copying, an existing destination or an out-of-space target. A done response from a transfer without a SHA-256 verification result is not sufficient to claim verified admission. A hash job is asynchronous and may still be in progress when you reload. For permission errors, use an authenticated administrator account; viewers can read status without getting mutation controls.

Guided tasks available under Guided model workflows are Download and verify a model, Import verified model from another disk, and Use verified-only mode and admit a model. Each step requires an explicit confirmation. A failed check stops advancement until the condition is satisfied; no guide deletes imported bytes automatically.