Qwen3-0.6B (q4f16_1, WebLLM)

Add to the body of POST /v1/apps/{slug}/releases (or a release session). An unknown or withdrawn model is refused with a 400 naming it; the app page then shows "downloads 325 MB · runs on your device" and /models.txt carries the attribution.

{
  "models": [
    {
      "id": "qwen3-0.6b-q4f16",
      "revision": "8c14ce481d4c"
    }
  ]
}

Streams with progress, verifies the SHA-256 against the catalogue, keeps a durable copy in the app's Cache API and reports whether the bytes came from cache or the network.

<script src="/sdk.js"></script>  <!-- vendored from https://skillsafe.ai/apps-sdk/v1.js -->

const ss = SkillSafe.init({ slug: "your-app" });
const caps = await ss.models.capabilities();        // { webgpu, wasm, wasmSimd, storage }
const files = await ss.models.loadAll("qwen3-0.6b-q4f16@8c14ce481d4c", {
  onProgress: (p) => (bar.style.width = Math.round(p.ratio * 100) + "%"),
});                                                   // { path: ArrayBuffer } — SHA-256 verified, cached
const params_shard_0 = files["params_shard_0.bin"];
const params_shard_1 = files["params_shard_1.bin"];
const params_shard_2 = files["params_shard_2.bin"];
const params_shard_3 = files["params_shard_3.bin"];
const params_shard_4 = files["params_shard_4.bin"];
const params_shard_5 = files["params_shard_5.bin"];
const params_shard_6 = files["params_shard_6.bin"];
const params_shard_7 = files["params_shard_7.bin"];
const params_shard_8 = files["params_shard_8.bin"];
const Qwen3_0_6B_q4f16_1_ctx4k_cs1k_webgpu = files["lib/Qwen3-0.6B-q4f16_1-ctx4k_cs1k-webgpu.wasm"];

// Later visits: await ss.models.status("qwen3-0.6b-q4f16@8c14ce481d4c")  → { cached: [...], missing: [] }
// Background prefetch on a landing page: ss.models.warm("qwen3-0.6b-q4f16@8c14ce481d4c")

The runtime itself ships in your bundle as a vetted {path, sha256} reference — only the weights come from the registry. Pass the bytes in; do not re-fetch by URL.

// web-llm fetches shards by URL and resumes by range; point its model record at the registry.
const appConfig = { model_list: [{
  model: "https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/",              // params_shard_*.bin + the wasm kernel come from here
  model_id: "qwen3-0.6b-q4f16",
  model_lib: "https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/lib/Qwen3-0.6B-q4f16_1-ctx4k_cs1k-webgpu.wasm",
}] };
const engine = await webllm.CreateMLCEngine("qwen3-0.6b-q4f16", { appConfig, initProgressCallback: onProgress });

Immutable, credential-free, Access-Control-Allow-Origin: *, range requests honoured. The host refuses requests carrying a foreign Origin; a plain curl is fine.

https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_0.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_1.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_2.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_3.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_4.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_5.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_6.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_7.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_8.bin
https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/lib/Qwen3-0.6B-q4f16_1-ctx4k_cs1k-webgpu.wasm

curl -sSL -o params_shard_0.bin "https://models.skillsafe.ai/qwen3-0.6b-q4f16@8c14ce481d4c/params_shard_0.bin"
shasum -a 256 params_shard_0.bin   # 61062e64b475309e648516c853c7bd949344f1ce5c0921e9b121f905953ce9e3

SkillSafe's copy on Hugging Face — the same bytes (the SHA-256 on each file page matches the hash above), plus manifest.json with the upstream commit, recipe and toolchain, the parity reference tensors and a model card. Use it directly for your own site or notebook. A SkillSafe app must load from the registry: its CSP allows models.skillsafe.ai only, and that copy is what the SDK verifies, the browser shares across apps and the app page discloses. SkillSafe keeps hosting its own copies and the API either way.

// Outside SkillSafe apps only: app hosts allow connect-src models.skillsafe.ai, not huggingface.co.
const appConfig = { model_list: [{
  model: "https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16",                         // shards, mlc-chat-config.json and tokenizer come from the repo
  model_id: "qwen3-0.6b-q4f16",
  model_lib: "https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/lib/Qwen3-0.6B-q4f16_1-ctx4k_cs1k-webgpu.wasm",
}] };
const engine = await webllm.CreateMLCEngine("qwen3-0.6b-q4f16", { appConfig, initProgressCallback: onProgress });

https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_0.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_1.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_2.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_3.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_4.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_5.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_6.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_7.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/params_shard_8.bin
https://huggingface.co/skillsafe-ai/qwen3-0.6b-q4f16/resolve/3b5b38b14aa293558a7f2403124a7d15a38218f3/lib/Qwen3-0.6B-q4f16_1-ctx4k_cs1k-webgpu.wasm