Maintain the model store package

packages/llamadart_model_store is an independently versioned Flutter package, as decided in #160. The dependency is one-way: llamadart_model_store → llamadart. Never add it to core dependencies or align its version with core or the Apple companions.

Versioning and publication#

• It starts at 0.1.0 and moves on its own semantic versions. Its llamadart constraint names the core minor it needs, today ^0.17.0.
• It is not published and has no release routing: no prep branch pattern, tag prefix or publisher workflow. Publication needs maintainer approval and its own routing, modeled on the Genkit package: a package-only prep PR, a llamadart_model_store-vX.Y.Z tag that neither the core nor the companion publishers match, and a standalone staged archive.
• The core archive excludes the package (.pubignore, tool/release/check_core_archive.py).

Local checks and CI#

Root preparation, analysis and tests skip the package. It resolves with Flutter against checkout core through its committed pubspec_overrides.yaml. From packages/llamadart_model_store:

flutter pub get
dart format --output=none --set-exit-if-changed .
flutter analyze --fatal-infos
TMPDIR="$(mktemp -d)" flutter test
dart test -p chrome test/model_store_web_test.dart

The model-store CI job runs these and a publish dry-run against checkout core. The selector runs it for package and guide changes, and for every core or shared change, which selects the full graph. Package-only changes select no core lane. A lower-bound lane against published core is added once llamadart 0.17.0 is on pub.dev.

The Linux Chrome step runs once through tool/ci/supervise_chrome_test.py, with a three-minute command deadline and five seconds each for natural shutdown and forced cleanup. It records the command's real exit code, separate stdout/stderr EOF events, and process ancestry/wait-state snapshots in model-store-chrome-diagnostics. The supervisor records a printed test summary only as an observation; timeout, forced cleanup, surviving children or incomplete output capture fails the step. The unchanged-package and publish checks still require a passing test.

Command output is kept in full in the artifact and echoed to the job log on a best-effort, non-blocking basis, dropping output a stalled pipe cannot take, so an unread downstream pipe cannot block the watchdog. The artifact also contains allowlisted process fields, without command arguments or environment variables. A CLI exit before output EOF indicates an inherited pipe may still be open; live children after EOF identify a separate cleanup wait.

The browser test uses package:test and dart test, not flutter_test and flutter test --platform chrome, because it needs no Flutter APIs. Flutter 3.47.1 closes Chrome by awaiting a DevTools Browser.close reply with no timeout; when Chrome exits before sending it, flutter test hangs after reporting its results (#1702). dart test stops Chrome with a signal and does not wait on DevTools.

Open design questions#

These need a maintainer decision before the platform executors land. The user-facing behavior and limits are in Share models between apps.

1. Stale references. Whether a user-facing app may drop other apps' references, for example after confirming with the user, or references expire after a period without use.
2. Android file access. Whether loading from a file descriptor is a llamadart-native prerequisite, so a Storage Access Framework grant can be shared without a file path.
3. Background transfer handoff. Core gains DefaultModelDownloadManager.importDownloadedFile to verify a file a platform executor downloaded and move it into place atomically.
4. Desktop interop. Whether the desktop store adopts content-addressed blobs compatible with the Hugging Face hub cache.
5. Multi-file sets. Whether shard sets, such as the Safetensors sets of #1219, become multi-file entries the same way.
6. Abandoned partial downloads. Whether prune deletes partial downloads no app references. Deleting one safely needs core's entry lock, which core does not export, or a core prune option for partial files.