- Create a provenance record for models and datasets.
- Avoid uncontrolled weights, scripts, and dependencies.
- Treat license, security, and quality as separate decisions.
Provenance record
modelo: nombre: "qwen3-8b" fuente: "repositorio oficial" version_o_commit: "..." licencia: "revisada" formato: "gguf | safetensors | onnx" hash: "sha256:..." requiere_trust_remote_code: false datos_entrenamiento_conocidos: parcial uso_permitido: "educativo | comercial | revisar" fecha_revision: "2026-07-03"
Simple rules
- Prefer formats that do not execute code when loading weights.
- Avoid trust_remote_code unless you review exactly what it executes.
- Store hashes of weights used in production.
- Do not mix private and public datasets without logging.
- Review model, dataset, and adapter licenses separately.
sha256sum modelo.gguf > checksums.txt pip freeze > requirements.lock.txt npm ls --depth=0 > npm-deps.txt docker image inspect qdrant/qdrant:latest > docker-qdrant.json