feat: stabilize HF deploy, locale routing, and bucket caching

- Pin pnpm 11.9.0 through Corepack in GitLab CI and Docker builds
- Add workspace pnpm safeguards for engine strictness and dependency verification warnings
- Validate required Hugging Face deploy CI variables before pushing to the Space repository
- Enable Paraglide URL/baseLocale strategy for generated runtime and Vite integration
- Localize main navigation, logo, error page, and fallback links so language-prefixed routes are preserved
- Cache Hugging Face bucket ranking, details, and visualization data by snapshot_id
- Reuse cached adapted datasets when the bucket manifest still points to the same snapshot
- Share the ranking snapshot across details and visualization fetches to avoid duplicate manifest/data requests
- Rewrite README in English with setup, environment, development, and validation instructions
- Split docs into explicit Russian and English versions with _ru and _en suffixes
- Add English translations for backend data contract and Hugging Face Space deployment docs

.gitlab-ci.yml

@@ -16,6 +16,8 @@ validate:
       - .pnpm-store/
   before_script:
     - corepack enable
+    - corepack prepare pnpm@11.9.0 --activate
+    - pnpm --version
     - pnpm config set store-dir .pnpm-store
     - pnpm install --frozen-lockfile
   script:
@@ -32,6 +34,9 @@ deploy:huggingface:
     - when: never
   before_script:
     - apk add --no-cache ca-certificates git
+    - test -n "$HF_USERNAME" || (echo "HF_USERNAME CI variable is not set" && exit 1)
+    - test -n "$HF_SPACE_TOKEN" || (echo "HF_SPACE_TOKEN CI variable is not set" && exit 1)
+    - test -n "$HF_SPACE_REPO" || (echo "HF_SPACE_REPO CI variable is not set" && exit 1)
     - git config --global user.email "${GITLAB_USER_EMAIL:-ci@hivetrace.local}"
     - git config --global user.name "${GITLAB_USER_NAME:-GitLab CI}"
   script:

Dockerfile

@@ -3,8 +3,10 @@ FROM node:24-alpine AS builder
 
 WORKDIR /app
 
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN corepack enable
+RUN corepack enable && corepack prepare pnpm@11.9.0 --activate && pnpm --version
 RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
     pnpm install --frozen-lockfile
 

README.md

@@ -15,79 +15,83 @@ tags:
 
 # HiveTrace Leaderboard frontend
 
-- #### Запуск
+## Overview
 
-  _Необходима версия **Node.js** не ниже `20.19.5`._
+HiveTrace Leaderboard is a SvelteKit frontend for browsing guardrail benchmark results from
+a private Hugging Face bucket.
 
-  _В качестве менеджера зависимостей используется **pnpm** версии `11.9.0`._
+The app uses:
 
-  _Интерфейс написан на [**SvelteKit**](https://svelte.dev/)._
+- [SvelteKit](https://svelte.dev/)
+- [pnpm](https://pnpm.io/) `11.9.0`
+- [shadcn-svelte](https://www.shadcn-svelte.com/) and
+  [shadcn-svelte-extras](https://www.shadcn-svelte-extras.com/)
+- [Tailwind CSS](https://tailwindcss.com/)
+- [Paraglide JS](https://inlang.com/m/gerre34r/library-inlang-paraglideJs) for localization
 
-  _В качестве библиотеки компонентов используется [**shadcn-svelte**](https://www.shadcn-svelte.com/) + [**shadcn-svelte-extras**](https://www.shadcn-svelte-extras.com/) (знание [**Tailwind**](https://tailwindcss.com/) обязательно!)._
+## Requirements
 
-  _Для локализации используется библиотека [**Paraglide JS**](https://inlang.com/m/gerre34r/library-inlang-paraglideJs)._
-  - Переходим в корень проекта (директория `leaderboard_frontend`)
+- Node.js `20.19.5` or newer
+- pnpm `11.9.0`
 
-  - Устанавливаем зависимости:
+## Setup
 
-  ```bash
-  pnpm install
-  ```
+From the project root:
 
-  - Создаем локальный `.env` из примера и указываем read-токен с доступом к приватному
-    Hugging Face bucket:
+```bash
+pnpm install
+```
 
-  ```bash
-  cp .env.example .env
-  ```
+Create a local `.env` file from the example:
 
-  Обязательные server-only переменные:
+```bash
+cp .env.example .env
+```
 
-  ```env
-  HF_TOKEN=hf_...
-  HF_BUCKET_ID=hivetrace/leaderboard_frontend_v2
-  HF_BUCKET_PREFIX=latest
-  ```
+Then configure a read token with access to the private Hugging Face bucket.
 
-  `HF_TOKEN` нельзя переименовывать в `PUBLIC_HF_TOKEN`: секрет используется только сервером
-  SvelteKit. В production токен необходимо передавать как runtime secret, а не как Docker build
-  argument.
+Required server-only environment variables:
 
-  - Запуск в `dev`:
+```env
+HF_TOKEN=hf_...
+HF_BUCKET_ID=hivetrace/leaderboard_frontend_v2
+HF_BUCKET_PREFIX=latest
+```
 
-  ```bash
-  pnpm dev
-  ```
+Do not rename `HF_TOKEN` to `PUBLIC_HF_TOKEN`. The token is used only on the SvelteKit server.
+In production, pass it as a runtime secret, not as a Docker build argument.
 
-  **ВАЖНО! Перед пушем в удаленный репозиторий ОБЯЗАТЕЛЬНО необходимо выполнить форматирование кода, прогнать линтер, проверить уязвимости и сборку**
-  - Выполняем автоматическое форматирование:
+## Development
 
-  ```bash
-  pnpm format
-  ```
+```bash
+pnpm dev
+```
 
-  - Прогоняем линтер:
+## Validation
 
-    _Если есть ошибки - исправляем. Варнинги можно не трогать, желательно просмотреть и задуматься!_
+Before pushing, format the code, run linting, run Svelte/TypeScript checks, and verify the
+production build.
 
-  ```bash
-  pnpm lint
-  ```
+Format:
 
-  - Проверяем SvelteKit, типы и Svelte-компоненты:
+```bash
+pnpm format
+```
 
-    _Если есть ошибки - исправляем до запуска сборки._
+Lint:
 
-  ```bash
-  pnpm check
-  ```
+```bash
+pnpm lint
+```
 
-  - Продакшн сборка:
+Check SvelteKit, TypeScript, and Svelte components:
 
-    _Здесь смотрим, чтобы все собралось и не упало в процессе. (Упадет здесь - упадет и там!)_
+```bash
+pnpm check
+```
 
-  ```bash
-  pnpm build
-  ```
+Build:
 
-  - Если все хорошо, можно собрать все коммиты в один и пушить в репозиторий.
+```bash
+pnpm build
+```

docs/backend-data-contract_en.md

@@ -0,0 +1,737 @@
+# Backend bucket data contract
+
+This document defines the current data format in the private HF bucket that the frontend can
+integrate with. It is a contract for JSON shapes, relationships between entities, and nullable
+fields. Formula correctness, ranking logic, and business calculations remain the backend's
+responsibility.
+
+Verified snapshot:
+
+```json
+{
+	"schema_version": "1.0.0",
+	"snapshot_id": "snapshot_2026-07-10",
+	"snapshot_date": "2026-07-10",
+	"generated_at": "2026-07-10T19:17:38+00:00",
+	"model_count": 48,
+	"group_count": 19,
+	"dataset_count": 44
+}
+```
+
+## General rules
+
+- All files use `schema_version: "1.0.0"`.
+- All missing numeric metrics are represented as `null`; they are not omitted.
+- `model_id`, `group_id`, and `dataset_id` are string identifiers.
+- In the current bucket, `model_id` includes the run suffix, for example
+  `qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1`.
+- Display order comes from the `rows`, `model_ids`, `group_ids`, `row_ids`, and `column_ids`
+  arrays.
+- `title`, `subtitle`, `x_axis`, `y_axis`, `label`, `description`, and similar translated
+  fields have the shape `{ "en": "...", "ru": "..." }`.
+- `subtitle` may be present in visualization payloads; the frontend may use or ignore it.
+- `manifest.files` is the source of paths to payload files.
+- `manifest.hashes` contains SHA-256 hashes of payload files and must be updated whenever the
+  corresponding JSON changes.
+
+## File list
+
+```text
+manifest.json
+catalog.json
+leaderboard.json
+details_matrix.json
+drilldown/index.json
+visualizations/radar.json
+visualizations/scatter.json
+visualizations/heatmap.json
+visualizations/grouped_bars.json
+visualizations/pareto.json
+visualizations/performance.json
+visualizations/robustness.json
+```
+
+## Common types
+
+```ts
+type LocalizedString = {
+	en: string;
+	ru: string;
+};
+
+type NullableNumber = number | null;
+type MetricDirection = 'higher' | 'lower';
+type MetricKey =
+	'integral' | 'score' | 'f1' | 'recall' | 'precision' | 'accuracy' | 'fpr' | 'fnr' | 'latency_ms';
+
+type LatencyMs = {
+	p50: NullableNumber;
+	p95: NullableNumber;
+	p99: NullableNumber;
+};
+
+type GroupMetrics = {
+	score: NullableNumber;
+	f1: NullableNumber;
+	fpr: NullableNumber;
+	fnr: NullableNumber;
+};
+
+type FullMetrics = GroupMetrics & {
+	recall: NullableNumber;
+	precision: NullableNumber;
+	accuracy: NullableNumber;
+};
+```
+
+## manifest.json
+
+```ts
+type BucketFileKey =
+	| 'catalog'
+	| 'leaderboard'
+	| 'details_matrix'
+	| 'drilldown_index'
+	| 'radar'
+	| 'scatter'
+	| 'heatmap'
+	| 'grouped_bars'
+	| 'pareto'
+	| 'performance'
+	| 'robustness';
+
+type Manifest = {
+	schema_version: '1.0.0';
+	generated_at: string;
+	snapshot_id: string;
+	snapshot_date: string;
+	is_ok: boolean;
+	model_count: number;
+	group_count: number;
+	dataset_count: number;
+	files: Record<BucketFileKey, string>;
+	hashes: Record<BucketFileKey, string>;
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"generated_at": "2026-07-10T19:17:38+00:00",
+	"snapshot_id": "snapshot_2026-07-10",
+	"snapshot_date": "2026-07-10",
+	"is_ok": true,
+	"model_count": 48,
+	"group_count": 19,
+	"dataset_count": 44,
+	"files": {
+		"catalog": "catalog.json",
+		"leaderboard": "leaderboard.json",
+		"details_matrix": "details_matrix.json",
+		"drilldown_index": "drilldown/index.json",
+		"radar": "visualizations/radar.json",
+		"scatter": "visualizations/scatter.json",
+		"heatmap": "visualizations/heatmap.json",
+		"grouped_bars": "visualizations/grouped_bars.json",
+		"pareto": "visualizations/pareto.json",
+		"performance": "visualizations/performance.json",
+		"robustness": "visualizations/robustness.json"
+	},
+	"hashes": {
+		"catalog": "6cde39ef39563ec1db551620cdcbd6a8db4751b05a3d886c97453a382f0309fc",
+		"leaderboard": "3e1f957fd2e3d994b200b7d3b35f6606c3fc56fad6c1fe8facac72a513b88cc0",
+		"details_matrix": "ea9e89936cf59075e78c8f907b8a1b922f8ce1105a56669a829131e1ce56b4ba",
+		"drilldown_index": "5cc2ceca5eeb38514a872b91fe301b1481109404547bbcc9a30622eb19b1a4da",
+		"radar": "5ce3a62644f768feb3f52bd787993f6281eec935879d9fd04c10c3835028f249",
+		"scatter": "f8c5b6cc91a2f586fbfb9a69bcc9b1472363c4cdda61c6501aff9abcc14b0756",
+		"heatmap": "d2665f3f4df58ca2d05a138cee5186bf3a16d287d61c459e9b2ecc4e69914b1a",
+		"grouped_bars": "678a531e2b1593de9e8bdd45f17d116aa4f5051d4e246f2abdcf634d5d86d7f4",
+		"pareto": "0a1b2bad8addd2df35f86a90d4fce59a76f846d031b56278ef4fb029ff425535",
+		"performance": "5cecdcb010454e7918250c526eb69b20199ba8317017d9b30938104b97fb77bf",
+		"robustness": "362664c44b3acf2b5927de59fac7f8c3ed4492c6321351c21e68c139a250953f"
+	}
+}
+```
+
+## catalog.json
+
+```ts
+type BucketModel = {
+	model_id: string;
+	display_name: string;
+	short_name: string;
+	org: string;
+	family: string;
+	guardrail_type: 'llm-judge' | 'classifier' | 'unknown';
+	license: string | null;
+	params_b: NullableNumber;
+	size_label: LocalizedString | null;
+	languages: string[];
+	note: LocalizedString | null;
+	run_date: string;
+	hf_url: string | null;
+	eval_leak: boolean | null;
+};
+
+type BucketGroup = {
+	group_id: string;
+	label: LocalizedString;
+	description: LocalizedString | null;
+	what_it_tests: LocalizedString | null;
+	languages: string[];
+	dataset_ids: string[];
+};
+
+type BucketDataset = {
+	dataset_id: string;
+	group_id: string;
+	label: LocalizedString;
+	source_name: LocalizedString | null;
+	split: LocalizedString | null;
+	subset: LocalizedString | null;
+	language: string | null;
+	is_combined: boolean;
+};
+
+type Catalog = {
+	schema_version: '1.0.0';
+	models: BucketModel[];
+	groups: BucketGroup[];
+	datasets: BucketDataset[];
+	metric_directions: Record<MetricKey, MetricDirection>;
+	metric_labels: Partial<Record<MetricKey, LocalizedString>>;
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"models": [
+		{
+			"model_id": "qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1",
+			"display_name": "Qwen3Guard-Gen-0.6B",
+			"short_name": "Qwen3Guard-Gen-0.6B",
+			"org": "Qwen",
+			"family": "Qwen3",
+			"guardrail_type": "llm-judge",
+			"license": "Apache-2.0",
+			"params_b": 0.6,
+			"size_label": { "en": "0.6B", "ru": "0.6B" },
+			"languages": ["multilingual", "en", "ru", "zh"],
+			"note": {
+				"en": "Small Qwen3Guard for low-latency; model_size marked as 0.8B in the run, actual checkpoint ~0.6B.",
+				"ru": "Малый Qwen3Guard для low-latency; model_size в прогоне помечен 0.8B, фактический чекпойнт ~0.6B."
+			},
+			"run_date": "2026-06-06",
+			"hf_url": "https://huggingface.co/Qwen/Qwen3Guard-Gen-0.6B",
+			"eval_leak": null
+		}
+	],
+	"groups": [
+		{
+			"group_id": "s_eval",
+			"label": { "en": "S-Eval", "ru": "S-Eval" },
+			"description": {
+				"en": "S-Eval benchmark family.",
+				"ru": "Семейство бенчмарков S-Eval."
+			},
+			"what_it_tests": {
+				"en": "Recognition of unsafe intent and robustness to adversarial attacks.",
+				"ru": "Распознавание небезопасного намерения и устойчивость к adversarial-атакам."
+			},
+			"languages": ["en", "ru"],
+			"dataset_ids": ["s_eval_base_risk", "s_eval_attack_set"]
+		}
+	],
+	"datasets": [
+		{
+			"dataset_id": "s_eval_base_risk",
+			"group_id": "s_eval",
+			"label": { "en": "S-Eval (base risk)", "ru": "S-Eval (base risk)" },
+			"source_name": null,
+			"split": null,
+			"subset": null,
+			"language": "en",
+			"is_combined": false
+		}
+	],
+	"metric_directions": {
+		"integral": "higher",
+		"score": "higher",
+		"f1": "higher",
+		"recall": "higher",
+		"precision": "higher",
+		"accuracy": "higher",
+		"fpr": "lower",
+		"fnr": "lower",
+		"latency_ms": "lower"
+	},
+	"metric_labels": {
+		"score": { "en": "Score", "ru": "Скор" },
+		"f1": { "en": "F1", "ru": "F1" },
+		"fpr": { "en": "FPR", "ru": "FPR" },
+		"fnr": { "en": "FNR", "ru": "FNR" },
+		"integral": { "en": "Integral score", "ru": "Интегральный скор" },
+		"latency_ms": { "en": "Latency, ms", "ru": "Задержка, мс" }
+	}
+}
+```
+
+## leaderboard.json
+
+```ts
+type LeaderboardRow = {
+	model_id: string;
+	rank: number;
+	run_id: string;
+	run_date: string;
+	integral: NullableNumber;
+	min_group: NullableNumber;
+	overall_fpr: NullableNumber;
+	overall_fnr: NullableNumber;
+	overall_f1: NullableNumber;
+	latency_ms: LatencyMs;
+	groups: Record<string, GroupMetrics>;
+};
+
+type Leaderboard = {
+	schema_version: '1.0.0';
+	rows: LeaderboardRow[];
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"rows": [
+		{
+			"model_id": "alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f",
+			"rank": 1,
+			"run_id": "run_20260701_155019_4a9b279f",
+			"run_date": "2026-07-01",
+			"integral": 0.7605880393198141,
+			"min_group": 0.15654499428022556,
+			"overall_fpr": 0.21801750988077712,
+			"overall_fnr": 0.12210970263223303,
+			"overall_f1": 0.8224670573864103,
+			"latency_ms": { "p50": 71.79, "p95": 102.57, "p99": 144.35 },
+			"groups": {
+				"s_eval": {
+					"score": 0.8761476877122706,
+					"f1": null,
+					"fpr": null,
+					"fnr": 0.11835
+				}
+			}
+		}
+	]
+}
+```
+
+## details_matrix.json
+
+```ts
+type GroupCell = FullMetrics & {
+	model_id: string;
+	group_id: string;
+};
+
+type DatasetCell = GroupCell & {
+	dataset_id: string;
+	sample_count: number | null;
+};
+
+type DetailsMatrix = {
+	schema_version: '1.0.0';
+	group_cells: GroupCell[];
+	dataset_cells: DatasetCell[];
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"group_cells": [
+		{
+			"model_id": "qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1",
+			"group_id": "s_eval",
+			"score": 0.6505268251330913,
+			"f1": null,
+			"fpr": null,
+			"fnr": 0.34645000000000004,
+			"recall": null,
+			"precision": null,
+			"accuracy": null
+		}
+	],
+	"dataset_cells": [
+		{
+			"model_id": "qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1",
+			"group_id": "s_eval",
+			"dataset_id": "s_eval_base_risk",
+			"score": 0.698,
+			"f1": null,
+			"fpr": null,
+			"fnr": 0.302,
+			"recall": 0.698,
+			"precision": null,
+			"accuracy": null,
+			"sample_count": 1000
+		}
+	]
+}
+```
+
+## drilldown/index.json
+
+```ts
+type DrilldownMetric = 'score' | 'f1' | 'fpr' | 'fnr';
+
+type DrilldownHeatmapRow = {
+	model_id: string;
+	group_id: string;
+	dataset_ids: string[];
+	selected_metric: DrilldownMetric;
+	metrics: GroupMetrics;
+	description: LocalizedString | null;
+	prompt_viewer_available: boolean;
+	prompt_viewer_path: string | null;
+};
+
+type DrilldownIndex = {
+	schema_version: '1.0.0';
+	heatmap: DrilldownHeatmapRow[];
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"heatmap": [
+		{
+			"model_id": "qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1",
+			"group_id": "s_eval",
+			"dataset_ids": ["s_eval_base_risk", "s_eval_attack_set"],
+			"selected_metric": "fnr",
+			"metrics": {
+				"score": 0.6505268251330913,
+				"f1": null,
+				"fpr": null,
+				"fnr": 0.34645000000000004
+			},
+			"description": {
+				"en": "Small Qwen3Guard for low-latency; model_size marked as 0.8B in the run, actual checkpoint ~0.6B.",
+				"ru": "Малый Qwen3Guard для low-latency; model_size в прогоне помечен 0.8B, фактический чекпойнт ~0.6B."
+			},
+			"prompt_viewer_available": false,
+			"prompt_viewer_path": null
+		}
+	]
+}
+```
+
+## visualizations/radar.json
+
+```ts
+type Radar = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	subtitle?: LocalizedString;
+	model_ids: string[];
+	group_ids: string[];
+	default_model_ids: string[];
+	values: Record<string, Record<string, NullableNumber>>;
+	f1_values: Record<string, Record<string, NullableNumber>>;
+};
+```
+
+`values` and `f1_values` are indexed as `values[group_id][model_id]`.
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "Model Safety Profile", "ru": "Профиль безопасности модели" },
+	"subtitle": { "en": "Group scores", "ru": "Групповые скоры" },
+	"model_ids": ["qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1"],
+	"group_ids": ["s_eval"],
+	"default_model_ids": ["qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1"],
+	"values": {
+		"s_eval": {
+			"qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1": 0.6505268251330913
+		}
+	},
+	"f1_values": {
+		"s_eval": {
+			"qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1": null
+		}
+	}
+}
+```
+
+## visualizations/scatter.json
+
+```ts
+type ScatterRowId = 'fpr' | 'fnr' | 'overall';
+
+type ScatterPoint = {
+	model_id: string;
+	fpr: NullableNumber;
+	fnr: NullableNumber;
+	tooltip: string | null;
+};
+
+type Scatter = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	x_axis: LocalizedString;
+	y_axis: LocalizedString;
+	points: ScatterPoint[];
+	row_ids: ScatterRowId[];
+	values: Record<ScatterRowId, Record<string, NullableNumber>>;
+};
+```
+
+`values` is indexed as `values[row_id][model_id]`.
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "FPR vs FNR (overall)", "ru": "FPR vs FNR (overall)" },
+	"x_axis": { "en": "FPR", "ru": "FPR" },
+	"y_axis": { "en": "FNR", "ru": "FNR" },
+	"points": [
+		{
+			"model_id": "alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f",
+			"fpr": 0.21801750988077712,
+			"fnr": 0.12210970263223303,
+			"tooltip": null
+		}
+	],
+	"row_ids": ["fpr", "fnr", "overall"],
+	"values": {
+		"fpr": {
+			"alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f": 0.21801750988077712
+		},
+		"fnr": {
+			"alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f": 0.12210970263223303
+		},
+		"overall": {
+			"alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f": 0.7605880393198141
+		}
+	}
+}
+```
+
+## visualizations/heatmap.json
+
+```ts
+type Heatmap = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	subtitle?: LocalizedString;
+	metric: 'score' | 'f1' | 'fpr' | 'fnr';
+	row_ids: string[];
+	column_ids: string[];
+	values: Record<string, Record<string, NullableNumber>>;
+};
+```
+
+`values` is indexed as `values[row_id][model_id]`. In the current snapshot, `metric` is
+`"fnr"`.
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "Heatmap FNR", "ru": "Тепловая карта FNR" },
+	"subtitle": { "en": "Dataset x model", "ru": "Датасет x модель" },
+	"metric": "fnr",
+	"row_ids": ["aegis_2_0_prompt"],
+	"column_ids": ["qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1"],
+	"values": {
+		"aegis_2_0_prompt": {
+			"qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1": 0.05854579792256846
+		}
+	}
+}
+```
+
+## visualizations/grouped_bars.json
+
+```ts
+type GroupedBarsModel = {
+	model_id: string;
+	groups: Record<
+		string,
+		{
+			fnr: NullableNumber;
+			fpr: NullableNumber;
+			f1: NullableNumber;
+		}
+	>;
+};
+
+type GroupedBars = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	subtitle?: LocalizedString;
+	group_ids: string[];
+	models: GroupedBarsModel[];
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "Grouped bars", "ru": "Групповые столбцы" },
+	"subtitle": {
+		"en": "FNR / FPR / F1 by benchmark group",
+		"ru": "FNR / FPR / F1 по группам"
+	},
+	"group_ids": ["s_eval", "aegis_2_0"],
+	"models": [
+		{
+			"model_id": "qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1",
+			"groups": {
+				"s_eval": { "fnr": 0.34645000000000004, "fpr": null, "f1": null },
+				"aegis_2_0": {
+					"fnr": 0.08384142688006596,
+					"fpr": 0.2825050061521388,
+					"f1": 0.8346634240315878
+				}
+			}
+		}
+	]
+}
+```
+
+## visualizations/pareto.json
+
+```ts
+type ParetoModel = {
+	latency_ms: LatencyMs;
+	integral: NullableNumber;
+	fpr: NullableNumber;
+};
+
+type Pareto = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	subtitle?: LocalizedString;
+	x_axis: LocalizedString;
+	y_axis: LocalizedString;
+	by_model_id: Record<string, ParetoModel>;
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "Pareto: latency vs quality", "ru": "Парето: задержка vs качество" },
+	"subtitle": {
+		"en": "p95 latency vs integral score",
+		"ru": "p95 задержка vs интегральный скор"
+	},
+	"x_axis": { "en": "Latency p95, ms", "ru": "Задержка p95, мс" },
+	"y_axis": { "en": "Integral score", "ru": "Интегральный скор" },
+	"by_model_id": {
+		"alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f": {
+			"latency_ms": { "p50": 71.79, "p95": 102.57, "p99": 144.35 },
+			"integral": 0.7605880393198141,
+			"fpr": 0.21801750988077712
+		}
+	}
+}
+```
+
+## visualizations/performance.json
+
+```ts
+type PerformanceRow = {
+	model_id: string;
+	rank: number;
+	latency_ms: LatencyMs;
+	integral: NullableNumber;
+};
+
+type Performance = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	rows: PerformanceRow[];
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "Latency / performance", "ru": "Задержка / производительность" },
+	"rows": [
+		{
+			"model_id": "alibaba_aaig_yufeng_xguard_reason_8b__run_20260701_155019_4a9b279f",
+			"rank": 1,
+			"latency_ms": { "p50": 71.79, "p95": 102.57, "p99": 144.35 },
+			"integral": 0.7605880393198141
+		}
+	]
+}
+```
+
+## visualizations/robustness.json
+
+```ts
+type RobustnessRow = {
+	model_id: string;
+	score_real: NullableNumber;
+	score_robust: NullableNumber;
+	delta_score: NullableNumber;
+	fnr_real: NullableNumber;
+	fnr_robust: NullableNumber;
+	delta_fnr: NullableNumber;
+	category_label: LocalizedString;
+};
+
+type Robustness = {
+	schema_version: '1.0.0';
+	title: LocalizedString;
+	rows: RobustnessRow[];
+};
+```
+
+```json
+{
+	"schema_version": "1.0.0",
+	"title": { "en": "Robustness comparison", "ru": "Сравнение robustness" },
+	"rows": [
+		{
+			"model_id": "qwen_qwen3guard_gen_0_6b__run_20260606_005401_a4794dd1",
+			"score_real": 0.6313559322033898,
+			"score_robust": 0.8121144139091419,
+			"delta_score": 0.18075848170575204,
+			"fnr_real": 0.13623188405797101,
+			"fnr_robust": 0.21190130624092887,
+			"delta_fnr": 0.07566942218295786,
+			"category_label": {
+				"en": "Qwen3Guard-Gen-0.6B",
+				"ru": "Qwen3Guard-Gen-0.6B"
+			}
+		}
+	]
+}
+```
+
+## Validation invariants
+
+- `catalog.models.length === manifest.model_count`.
+- `catalog.groups.length === manifest.group_count`.
+- `catalog.datasets.length === manifest.dataset_count`.
+- `leaderboard.rows[].model_id` must reference `catalog.models[].model_id`.
+- `details_matrix.group_cells[].model_id` and `details_matrix.dataset_cells[].model_id` must
+  reference the catalog.
+- `details_matrix.group_cells[].group_id` must reference `catalog.groups[].group_id`.
+- `details_matrix.dataset_cells[].dataset_id` must reference `catalog.datasets[].dataset_id`.
+- The current snapshot is expected to contain 48 unique `model_id` values in `catalog` and
+  `leaderboard`.
+- The current snapshot is expected to contain 912 unique `model_id + group_id` pairs in
+  `details_matrix.group_cells`.
+- The current snapshot is expected to contain 2112 unique `model_id + group_id + dataset_id`
+  triples in `details_matrix.dataset_cells`.

docs/huggingface-space-deploy_en.md

@@ -0,0 +1,134 @@
+# Hugging Face Space deploy
+
+Target deployment flow:
+
+```text
+Corporate GitLab repository
+        ↓ GitLab CI
+Private Hugging Face Docker Space
+        ↓ CPU Basic / Free
+HiveTrace Leaderboard
+```
+
+## Hugging Face Space
+
+The Space is created manually once.
+
+Recommended settings:
+
+- Visibility: `Private`
+- SDK: `Docker`
+- Hardware: `CPU Basic` / free
+- App port: `5173`
+
+The project `README.md` already contains the Space frontmatter:
+
+```yaml
+---
+title: HiveTrace Leaderboard
+emoji: 🛡️
+colorFrom: green
+colorTo: indigo
+sdk: docker
+app_port: 5173
+pinned: true
+---
+```
+
+## Runtime secrets and variables in Hugging Face
+
+Add the runtime secret in Space Settings:
+
+```text
+HF_TOKEN=hf_...
+```
+
+This token is required by the app to read the private Hugging Face bucket. Do not expose it as
+a `PUBLIC_*` variable and do not commit it to the repository.
+
+Variables:
+
+```text
+HF_BUCKET_ID=hivetrace/leaderboard_frontend_v2
+HF_BUCKET_PREFIX=latest
+HF_BUCKET_CACHE_TTL_MS=300000
+HF_BUCKET_REQUEST_TIMEOUT_MS=10000
+```
+
+Optional:
+
+```text
+HF_BUCKET_ENDPOINT=https://huggingface.co
+```
+
+## GitLab CI variables
+
+Add the following CI/CD variables in the corporate GitLab project:
+
+```text
+HF_USERNAME=<huggingface-user-or-service-account-name>
+HF_SPACE_TOKEN=<huggingface-write-token-for-space-repo>
+HF_SPACE_REPO=<namespace>/<space-name>
+```
+
+Example:
+
+```text
+HF_SPACE_REPO=hivetrace/guard-leaderboard
+```
+
+`HF_SPACE_TOKEN` must have write access to the Space repository.
+
+Important: keep `HF_SPACE_TOKEN` and the runtime `HF_TOKEN` used for bucket reads as separate
+tokens.
+
+In GitLab, mark `HF_SPACE_TOKEN` as a masked/protected variable.
+
+## Deploy flow
+
+`.gitlab-ci.yml` runs two stages:
+
+1. `validate`
+   - `pnpm install --frozen-lockfile`
+   - `pnpm check` (generates Paraglide output internally)
+   - `pnpm build`
+
+2. `deploy:huggingface`
+   - runs only on the `prod` branch
+   - pushes the current commit to the private Hugging Face Space repository
+   - uses force push because the Hugging Face Space repository is a deploy repository
+   - the Space automatically rebuilds the Docker image after the push
+
+## Production branch
+
+Production deployment runs only from the `prod` branch.
+
+Typical flow:
+
+```bash
+git checkout prod
+git merge main
+git push origin prod
+```
+
+After the push to `prod`, GitLab CI runs validation and then sends this commit to the `main`
+branch of the Hugging Face Space repository.
+
+## Local Docker smoke test
+
+Before the first deployment, it is useful to test the Docker image locally:
+
+```bash
+docker build -t hivetrace-leaderboard .
+docker run --rm -p 5173:5173 \
+  -e HF_TOKEN=hf_... \
+  -e HF_BUCKET_ID=hivetrace/leaderboard_frontend_v2 \
+  -e HF_BUCKET_PREFIX=latest \
+  hivetrace-leaderboard
+```
+
+After startup, open:
+
+```text
+http://127.0.0.1:5173/
+```

package.json

@@ -8,7 +8,7 @@
 		"dev": "vite dev",
 		"build": "vite build",
 		"preview": "vite preview",
-		"paraglide": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
+		"paraglide": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide --strategy url baseLocale",
 		"prepare": "svelte-kit sync || echo ''",
 		"check": "pnpm run paraglide && svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
 		"check:watch": "pnpm run paraglide && svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",

pnpm-workspace.yaml

@@ -1,3 +1,6 @@
+engineStrict: true
+pmOnFail: warn
+verifyDepsBeforeRun: warn
 allowBuilds:
   '@tailwindcss/oxide': true
   esbuild: true

src/lib/components/BucketDataFallback.svelte

@@ -4,6 +4,7 @@
 	import Empty from '$lib/components/Empty.svelte';
 	import { Button } from '$lib/components/ui/button';
 	import { m } from '$lib/paraglide/messages';
+	import { localizeHref } from '$lib/paraglide/runtime';
 </script>
 
 <div
@@ -26,7 +27,7 @@
 							if (browser) location.reload();
 						}}>{m.reload_page()}</Button
 					>
-					<Button variant="secondary" href="/">{m.to_main_page()}</Button>
+					<Button variant="secondary" href={localizeHref('/')}>{m.to_main_page()}</Button>
 				</div>
 			</div>
 		{/snippet}

src/lib/components/Navigation.svelte

@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { resolve } from '$app/paths';
 	import { page } from '$app/state';
+	import type { PathnameWithSearchOrHash } from '$app/types';
 	import Logo from '$lib/components/logo/logo.svelte';
 	import * as NavigationMenu from '$lib/components/ui/navigation-menu/index.js';
 	import { navigationMenuTriggerStyle } from '$lib/components/ui/navigation-menu/navigation-menu-trigger.svelte';
 	import { m } from '$lib/paraglide/messages.js';
+	import { deLocalizeHref, localizeHref } from '$lib/paraglide/runtime';
 	import { cn } from '$lib/utils.js';
 
 	const navItems = [
@@ -19,15 +21,17 @@
 		'bg-[linear-gradient(135deg,#0019ff_0%,#3a55ff_45%,#6b4bf5_100%)] text-white shadow-sm shadow-[#0019ff]/20 hover:text-white hover:opacity-95 focus:text-white';
 	const inactiveNavLinkClass = 'text-muted-foreground hover:text-foreground focus:text-foreground';
 
+	const currentPath = $derived(deLocalizeHref(page.url.pathname));
+
 	const isActive = (href: string) => {
-		if (href === '/') return page.url.pathname === '/';
+		if (href === '/') return currentPath === '/';
 
-		return page.url.pathname.startsWith(href);
+		return currentPath.startsWith(href);
 	};
 </script>
 
 <a
-	href={resolve('/')}
+	href={resolve(localizeHref('/') as PathnameWithSearchOrHash)}
 	class="flex min-w-0 shrink-0 items-center gap-3 rounded-md focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background focus-visible:outline-none"
 	aria-label={m.brand_home_aria_label()}
 >
@@ -49,7 +53,7 @@
 				<NavigationMenu.Link active={isActive(item.href)}>
 					{#snippet child()}
 						<a
-							href={resolve(item.href)}
+							href={resolve(localizeHref(item.href) as PathnameWithSearchOrHash)}
 							aria-current={isActive(item.href) ? 'page' : undefined}
 							class={cn(
 								navigationMenuTriggerStyle(),

src/lib/components/errors/Error404.svelte

@@ -3,6 +3,7 @@
 	import Empty from '$lib/components/Empty.svelte';
 	import { Button } from '$lib/components/ui/button';
 	import { m } from '$lib/paraglide/messages';
+	import { localizeHref } from '$lib/paraglide/runtime';
 	import { FolderCodeIcon } from '@lucide/svelte';
 </script>
 
@@ -18,7 +19,7 @@
 				}}
 				>{m.go_back()}
 			</Button>
-			<Button variant="secondary" href="/">{m.to_main_page()}</Button>
+			<Button variant="secondary" href={localizeHref('/')}>{m.to_main_page()}</Button>
 		</div>
 	{/snippet}
 </Empty>

src/lib/components/errors/Error500.svelte

@@ -3,6 +3,7 @@
 	import { Button } from '$lib/components/ui/button';
 	import Empty from '$lib/components/Empty.svelte';
 	import { m } from '$lib/paraglide/messages';
+	import { localizeHref } from '$lib/paraglide/runtime';
 	import { ServerCrash } from '@lucide/svelte';
 </script>
 
@@ -21,7 +22,7 @@
 					if (browser) location.reload();
 				}}>{m.reload_page()}</Button
 			>
-			<Button variant="secondary" href="/">{m.to_main_page()}</Button>
+			<Button variant="secondary" href={localizeHref('/')}>{m.to_main_page()}</Button>
 		</div>
 	{/snippet}
 </Empty>

src/lib/server/hf-bucket/details-cache.ts

@@ -5,10 +5,11 @@ import { adaptBucketDetails } from './adapt-details';
 import { fetchBucketDetailsSnapshot } from './details-snapshot';
 import { emptyDetailsDataset } from './fallback-data';
 import { toPublicBucketError } from './public-error';
+import { fetchBucketRankingSnapshot } from './ranking-snapshot';
 
 const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
 
-let cached: { value: DetailsDataset; expiresAt: number } | undefined;
+let cached: { value: DetailsDataset; snapshotId: string; expiresAt: number } | undefined;
 let inFlight: Promise<DetailsDataset> | undefined;
 
 function cacheTtlMs() {
@@ -17,8 +18,18 @@ function cacheTtlMs() {
 }
 
 async function refreshDetails() {
-	const value = adaptBucketDetails(await fetchBucketDetailsSnapshot());
-	cached = { value, expiresAt: Date.now() + cacheTtlMs() };
+	const rankingSnapshot = await fetchBucketRankingSnapshot();
+	if (cached?.snapshotId === rankingSnapshot.manifest.snapshot_id) {
+		cached.expiresAt = Date.now() + cacheTtlMs();
+		return cached.value;
+	}
+
+	const value = adaptBucketDetails(await fetchBucketDetailsSnapshot(rankingSnapshot));
+	cached = {
+		value,
+		snapshotId: rankingSnapshot.manifest.snapshot_id,
+		expiresAt: Date.now() + cacheTtlMs()
+	};
 	return value;
 }
 

src/lib/server/hf-bucket/details-snapshot.ts

@@ -1,7 +1,7 @@
 import { fetchHfBucketText, HfBucketError } from './client';
 import { parseBucketDetailsMatrix } from './details-payload';
 import { fetchBucketRankingSnapshot, verifyBucketFileHash } from './ranking-snapshot';
-import type { BucketDetailsSnapshot } from './types';
+import type { BucketDetailsSnapshot, BucketRankingSnapshot } from './types';
 
 function parseJson(text: string, path: string) {
 	try {
@@ -68,8 +68,10 @@ function verifyDetailsSnapshot(snapshot: BucketDetailsSnapshot) {
 	}
 }
 
-export async function fetchBucketDetailsSnapshot(): Promise<BucketDetailsSnapshot> {
-	const rankingSnapshot = await fetchBucketRankingSnapshot();
+export async function fetchBucketDetailsSnapshot(
+	rankingSnapshot?: BucketRankingSnapshot
+): Promise<BucketDetailsSnapshot> {
+	rankingSnapshot ??= await fetchBucketRankingSnapshot();
 	const path = rankingSnapshot.manifest.files.details_matrix;
 	const text = await fetchHfBucketText(path);
 	verifyBucketFileHash(rankingSnapshot.manifest, 'details_matrix', text);

src/lib/server/hf-bucket/ranking-cache.ts

@@ -8,7 +8,7 @@ import { fetchBucketRankingSnapshot } from './ranking-snapshot';
 
 const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
 
-let cached: { value: RankingDataset; expiresAt: number } | undefined;
+let cached: { value: RankingDataset; snapshotId: string; expiresAt: number } | undefined;
 let inFlight: Promise<RankingDataset> | undefined;
 
 function cacheTtlMs() {
@@ -17,8 +17,18 @@ function cacheTtlMs() {
 }
 
 async function refreshRanking() {
-	const value = adaptBucketRanking(await fetchBucketRankingSnapshot());
-	cached = { value, expiresAt: Date.now() + cacheTtlMs() };
+	const snapshot = await fetchBucketRankingSnapshot();
+	if (cached?.snapshotId === snapshot.manifest.snapshot_id) {
+		cached.expiresAt = Date.now() + cacheTtlMs();
+		return cached.value;
+	}
+
+	const value = adaptBucketRanking(snapshot);
+	cached = {
+		value,
+		snapshotId: snapshot.manifest.snapshot_id,
+		expiresAt: Date.now() + cacheTtlMs()
+	};
 	return value;
 }
 

src/lib/server/hf-bucket/ranking-snapshot.ts

@@ -89,8 +89,12 @@ function verifySnapshot(snapshot: BucketRankingSnapshot) {
 	}
 }
 
-export async function fetchBucketRankingSnapshot(): Promise<BucketRankingSnapshot> {
-	const { manifest } = await getHfBucketManifest({ forceRefresh: true });
+let cachedSnapshot: BucketRankingSnapshot | undefined;
+let inFlight: Promise<BucketRankingSnapshot> | undefined;
+
+async function fetchRemoteRankingSnapshot(
+	manifest: HfBucketManifest
+): Promise<BucketRankingSnapshot> {
 	const catalogPath = manifest.files.catalog;
 	const leaderboardPath = manifest.files.leaderboard;
 	const [catalogText, leaderboardText] = await Promise.all([
@@ -116,3 +120,26 @@ export async function fetchBucketRankingSnapshot(): Promise<BucketRankingSnapsho
 	verifySnapshot(snapshot);
 	return snapshot;
 }
+
+export async function fetchBucketRankingSnapshot(options?: {
+	forceRefresh?: boolean;
+}): Promise<BucketRankingSnapshot> {
+	const { manifest } = await getHfBucketManifest({ forceRefresh: options?.forceRefresh });
+
+	if (!options?.forceRefresh && cachedSnapshot?.manifest.snapshot_id === manifest.snapshot_id) {
+		return cachedSnapshot;
+	}
+
+	if (!inFlight) {
+		inFlight = fetchRemoteRankingSnapshot(manifest)
+			.then((snapshot) => {
+				cachedSnapshot = snapshot;
+				return snapshot;
+			})
+			.finally(() => {
+				inFlight = undefined;
+			});
+	}
+
+	return inFlight;
+}

src/lib/server/hf-bucket/tools-cache.ts

@@ -4,12 +4,15 @@ import type { ToolsDataset } from '$lib/types/tools-data';
 import { adaptBucketTools } from './adapt-tools';
 import { emptyToolsDataset } from './fallback-data';
 import { toPublicBucketError } from './public-error';
+import { fetchBucketRankingSnapshot } from './ranking-snapshot';
 import { fetchBucketVisualizationSnapshot } from './tools-snapshot';
 import type { BucketVisualizationSnapshot } from './types';
 
 const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
 
-let cached: { value: BucketVisualizationSnapshot; expiresAt: number } | undefined;
+let cached:
+	{ value: BucketVisualizationSnapshot; snapshotId: string; expiresAt: number } | undefined;
+let adaptedCached: { value: ToolsDataset; snapshotId: string } | undefined;
 let inFlight: Promise<BucketVisualizationSnapshot> | undefined;
 
 function cacheTtlMs() {
@@ -18,8 +21,18 @@ function cacheTtlMs() {
 }
 
 async function refreshToolsSnapshot() {
-	const value = await fetchBucketVisualizationSnapshot();
-	cached = { value, expiresAt: Date.now() + cacheTtlMs() };
+	const rankingSnapshot = await fetchBucketRankingSnapshot();
+	if (cached?.snapshotId === rankingSnapshot.manifest.snapshot_id) {
+		cached.expiresAt = Date.now() + cacheTtlMs();
+		return cached.value;
+	}
+
+	const value = await fetchBucketVisualizationSnapshot(rankingSnapshot);
+	cached = {
+		value,
+		snapshotId: rankingSnapshot.manifest.snapshot_id,
+		expiresAt: Date.now() + cacheTtlMs()
+	};
 	return value;
 }
 
@@ -110,7 +123,13 @@ export async function getHfBucketToolsState(): Promise<BucketDataState<ToolsData
 	}
 
 	try {
-		const data = adaptBucketTools(snapshotState.data);
+		const snapshotId = snapshotState.data.manifest.snapshot_id;
+		const data =
+			adaptedCached?.snapshotId === snapshotId
+				? adaptedCached.value
+				: adaptBucketTools(snapshotState.data);
+		adaptedCached = { value: data, snapshotId };
+
 		if (snapshotState.status === 'stale') {
 			return {
 				status: 'stale',

src/lib/server/hf-bucket/tools-snapshot.ts

@@ -13,6 +13,7 @@ import {
 import type {
 	BucketMetricMap,
 	BucketVisualizationPayloadByKey,
+	BucketRankingSnapshot,
 	BucketVisualizationSnapshot
 } from './types';
 
@@ -121,8 +122,10 @@ async function fetchVisualizationText(
 	return { path, text };
 }
 
-export async function fetchBucketVisualizationSnapshot(): Promise<BucketVisualizationSnapshot> {
-	const rankingSnapshot = await fetchBucketRankingSnapshot();
+export async function fetchBucketVisualizationSnapshot(
+	rankingSnapshot?: BucketRankingSnapshot
+): Promise<BucketVisualizationSnapshot> {
+	rankingSnapshot ??= await fetchBucketRankingSnapshot();
 	const [
 		drilldownIndexText,
 		radarText,

vite.config.ts

@@ -15,6 +15,10 @@ export default defineConfig({
 			},
 			adapter: adapter()
 		}),
-		paraglideVitePlugin({ project: './project.inlang', outdir: './src/lib/paraglide' })
+		paraglideVitePlugin({
+			project: './project.inlang',
+			outdir: './src/lib/paraglide',
+			strategy: ['url', 'baseLocale']
+		})
 	]
 });