Public model intake sample
A point-in-time assessment of the exact repository revision, weight format, executable code, native build paths, and license conditions a team should review before production use.
Executive summary
All eight model-weight shards use SafeTensors, and no current Pickle-format weight files appear in the pinned tree. That is a meaningful positive signal.
The repository also supplies Python modules loaded through trust_remote_code=True. One optional path can compile local C++/CUDA code, although it is disabled by the default pinned configuration. The custom Tongyi Qianwen license adds conditions that need business or legal review.
REVIEW does not mean the model is malicious. It means the available evidence is not sufficient for automatic production admission under a conservative model-intake policy.
Control results
Public, not gated, and not disabled.
Eight SafeTensors shards; no current Pickle-format weights.
High · README examples load a mutable model reference.
High · Model loading requires trust_remote_code=True.
Medium · Optional C++/CUDA compilation path exists.
High · Custom Tongyi Qianwen agreement requires use-case review.
Medium · No machine-readable security_repo_status was returned.
Findings
The configuration maps model and tokenizer classes to repository-supplied Python. The model card instructs users to enable trust_remote_code=True, so loading the model also loads executable code from the repository.
Pin the revision, review or vendor the referenced code, and perform the first load without production secrets or unrestricted network access.
Repository code can invoke the local CUDA compiler and compile C++/CUDA sources through PyTorch when two optional cache-kernel flags are enabled. Those flags are off in the pinned default configuration.
Keep the flags disabled unless the native extension has been reviewed and built in a restricted, reproducible environment.
The license includes redistribution, attribution, scale, model-training, export-control, and jurisdiction conditions. It is not a standard OSI license.
Document the intended commercial use, distribution model, user scale, and whether outputs will be used for model training; obtain legal review where appropriate.
All eight weight shards use SafeTensors. No current .pkl, .pickle, .pt, .pth, or .bin weight file appears in the pinned tree.
Verify downloaded shards against the recorded LFS SHA-256 values. SafeTensors reduces Pickle risk but does not make accompanying code safe.
The README examples reference Qwen/Qwen-7B without a fixed revision. A later repository update could silently change weights, configuration, tokenizer, or executable code.
Pin the full commit ef3c5c9c57b252f3149c1408daf4d649ec8b6c85 in every model and tokenizer load path.
Approval conditions
Weight manifest
| File | Bytes | LFS SHA-256 |
|---|---|---|
model-00001-of-00008.safetensors | 1,964,066,488 | 9dfd6266bcf80de9c3e5cd4e60300d839d03e459e48975b08d3e3b286044a306 |
model-00002-of-00008.safetensors | 2,023,960,808 | 3dedac66034371aa3b284a7886e9ce0fde9245ebac60f507f089b33ef82a2912 |
model-00003-of-00008.safetensors | 2,023,960,816 | 81b25b14a58b62300d11b16c66933a8b631400bf846b27a2a5c5344629cd26e8 |
model-00004-of-00008.safetensors | 2,023,960,848 | 59a22cb822f9e6d0a6a8415a7bab7b8448ce9672fc71f09266db264afc26ce48 |
model-00005-of-00008.safetensors | 2,023,960,848 | e61126f7ad8c520112c49808a73d59bee18c6da7693d9a963a4867f389c91e4a |
model-00006-of-00008.safetensors | 2,023,960,848 | 0ced56cc3265fe03ee73658f845dc23c713389b5d68087e918d24d0e2dea624f |
model-00007-of-00008.safetensors | 2,023,960,848 | b0999d47ea087bf79a075ed10889aa3497caff2356200204b032fba208109517 |
model-00008-of-00008.safetensors | 1,334,845,784 | 7bc05473a78ade06d526cc206e4a01722563abe99099367cdcbb9b3bf670a5de |
Scope & limitations