Runtime and application dependencies
The browser inference runtime wllama is available under the MIT License. Android uses SQLCipher under the BSD 3-Clause License and AndroidX components under Apache License 2.0. The release SBOM and generated dependency inventories are the complete source of truth.
Models
Qwen, SmolVLM, Gemma, and the selected retrieval export use their recorded upstream licenses, including Apache License 2.0 where shown in the model manager. LFM artifacts use the LFM Open License 1.0. Its commercial grant is conditional on the relevant entity remaining below US$10 million annual revenue. A free application does not remove that condition.
Distribution safeguards
A model is not promoted merely because its file is public. The catalog records exact repository commit, filename, byte count, SHA-256, runtime binding, prompt template, modalities, test limits, license, notices, release blockers, and replacement information. Connected Labs candidates can be downloaded for on-device evaluation while their release evidence remains pending. They are not promoted to general availability until the common Android/iOS gate passes; hard runtime, integrity, device, and license failures still block installation.