Update XoRL submodule branches and SGLang pin

[kiddyboots216]

Summary

• Declare main as the tracked branch for xorl-client and xorl-sglang.
• Retain the xorl-client pin at 2a3a60a783c98e2a8ff722bad06dab18caee350c.
• Pin xorl-sglang to the final exact-serving PR Drop internal-only cross-references from the public tree #15 head at 1fc3396aa122e0f8eb7b1ea4fe0051250cf1bc3c.
• Replace the earlier nonexistent xorl-sglang gitlink with an object fetchable from the live sampler remote.

The parent repository continues to pin immutable commits; branch metadata only makes future submodule updates explicit.

Stack and validation

• Base: main
• Next: Add exact dense Qwen programs and shared operator improvements #43
• Head: 762205400ad0b136817c3a3f6658f39500d2ded1
• Recursive submodule checkout is clean: xorl-client resolves to 2a3a60a783c98e2a8ff722bad06dab18caee350c, and xorl-sglang resolves to 1fc3396aa122e0f8eb7b1ea4fe0051250cf1bc3c.
• Commit hooks and git diff --check passed.

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.

 

[qywu]

LGTM. Both gitlinks resolve to objects that exist on the live remotes (xorl-client 2a3a60a7, xorl-sglang 1fc3396a — "Reject invalid exact GLM LoRA scaling"), and declaring branch = main in .gitmodules only affects submodule update --remote, so the immutable pins still govern checkout.

Worth noting this is the only PR in the current stack that lint CI has actually run on: .github/workflows/lint.yml triggers on pull_request: branches: [main], and #42–#52 all target intermediate branches. Widening that to branches: ['**'] would be a one-line change and would have caught real ruff-format failures on #50, #51, and #52.

[kiddyboots216]

Superseded by #57, which consolidates the complete exact trainer-serving stack directly onto main.