EricWesthoff/phi-1_5-finetuned-SQL warn

Convert the weights to safetensors before loading them anywhere that matters.

1. Do not load the pickle files in-process — pickle deserialization executes arbitrary code from the file.
2. Convert locally in a sandbox: `pip install safetensors` and use `safetensors.torch.save_file` on a state dict loaded with `torch.load(..., weights_only=True)` (refuses most code-execution payloads), or use Hugging Face's `convert.py` space/script.
3. Pin the exact revision hash you converted from, and load only your converted safetensors artifact from then on.

Review and pin the custom code; never float on `main` with trust_remote_code=True.

1. Read every `.py` file in the repo before first load — this code runs in your process.
2. Pin the revision: `from_pretrained(model_id, revision="<commit sha>", trust_remote_code=True)` so a later push can't swap the code under you.
3. Prefer a version of the architecture already in `transformers` if one exists, which removes the remote-code requirement entirely.

Verify the re-license is actually permitted before relying on it.

1. Read the parent's license for derivative-work and re-licensing terms — many open-weight licenses (e.g. Llama-family) do not permit arbitrary re-licensing.
2. If the re-license is not permitted, the parent's terms govern your use regardless of what this repo declares.

Fix or verify the `base_model` declaration so lineage checks can run.

1. If you own the repo: correct the `base_model` field in the model card metadata to the real, public parent.
2. If you don't: identify the true parent (config architecture + weight shapes narrow it fast) and re-scan with that lineage in mind.