Remove pickle checkpoint; load only safetensors
#1
by f-trycua - opened
Removes cua-s1-forms.pt (trycua/cua#3977). Unpickling a public checkpoint can run arbitrary code, and cua_s1.model.load_checkpoint refuses .pt files by design. No documented loader in trycua/cua uses the pickle: the docs already say to download with --exclude "*.pt". The safetensors and JSON pair encodes the same weights and loads with cua_s1.model.load_checkpoint. That load was verified locally: 706,048 parameters, signature check passed.
The card now:
- states that only the safetensors pair should be loaded, and warns against unpickling copies from older revisions;
- describes the checkpoint the way the trycua/cua docs do: a tinyx form checkpoint related to, but not formally mapped to, the cua-s1-form-v0 profile (trycua/cua#4186);
- replaces the broken docs/RESULTS.md link with a note that the author reported the results, which libs/cua-s1 does not reproduce;
- fixes source links and adds intended and out-of-scope use;
- drops the empty base_model and adds library_name: cua-s1.
The weights (the safetensors and JSON pair) are unchanged.
Merged on the maintainer's approval (trycua/cua GA work, 2026-09-26).
f-trycua changed pull request status to merged