Maintain the model store package

packages/llamadart_model_store is an independently versioned Flutter package, as decided in #160. The dependency is one-way: llamadart_model_store → llamadart. Never add it to core dependencies or align its version with core or the Apple companions.

Versioning and publication#

• It starts at 0.1.0 and moves on its own semantic versions. Its llamadart constraint names the core minor it needs, today ^0.17.0.
• It is not published and has no release routing: no prep branch pattern, tag prefix or publisher workflow. Publication needs maintainer approval and its own routing, modeled on the Genkit package: a package-only prep PR, a llamadart_model_store-vX.Y.Z tag that neither the core nor the companion publishers match, and a standalone staged archive.
• The core archive excludes the package (.pubignore, tool/release/check_core_archive.py).

Local checks and CI#

Root preparation, analysis and tests skip the package. It resolves with Flutter against checkout core through its committed pubspec_overrides.yaml. From packages/llamadart_model_store:

flutter pub get
dart format --output=none --set-exit-if-changed .
flutter analyze --fatal-infos
TMPDIR="$(mktemp -d)" flutter test
flutter test --platform chrome test/model_store_web_test.dart

The model-store CI job runs these and a publish dry-run against checkout core. The selector runs it for package and guide changes, and for every core or shared change, which selects the full graph. Package-only changes select no core lane. A lower-bound lane against published core is added once llamadart 0.17.0 is on pub.dev.

The Linux Chrome step runs once through tool/ci/supervise_chrome_test.py, with a three-minute command deadline and five seconds each for natural shutdown and forced cleanup. It records the command's real exit code, separate stdout/stderr EOF events, and process ancestry/wait-state snapshots in model-store-chrome-diagnostics. The supervisor records a printed test summary only as an observation; timeout, forced cleanup, surviving children or incomplete output capture fails the step. The unchanged-package and publish checks still require a passing test.

Command output is retained in the artifact instead of forwarded to CI output pipes, so an unread downstream pipe cannot block the watchdog. The artifact also contains allowlisted process fields, without command arguments or environment variables. A CLI exit before output EOF indicates an inherited pipe may still be open; live children after EOF identify a separate cleanup wait. These diagnostics investigate #1702; they do not establish the cause of the hosted hang. Cold and warm Linux Chrome runs with the pinned SDK remain required to qualify any repair or tooling workaround.

Open design questions#

These need a maintainer decision before the platform executors land. The user-facing behavior and limits are in Share models between apps.

1. Stale references. Whether a user-facing app may drop other apps' references, for example after confirming with the user, or references expire after a period without use.
2. Android file access. Whether loading from a file descriptor is a llamadart-native prerequisite, so a Storage Access Framework grant can be shared without a file path.
3. Background transfer handoff. Core gains DefaultModelDownloadManager.importDownloadedFile to verify a file a platform executor downloaded and move it into place atomically.
4. Desktop interop. Whether the desktop store adopts content-addressed blobs compatible with the Hugging Face hub cache.
5. Multi-file sets. Whether shard sets, such as the Safetensors sets of #1219, become multi-file entries the same way.
6. Abandoned partial downloads. Whether prune deletes partial downloads no app references. Deleting one safely needs core's entry lock, which core does not export, or a core prune option for partial files.