fix: submission navigation

AGENTS.md

@@ -155,7 +155,7 @@ printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -sS -H @- "$BASE/runs/RUN_ID
 printf 'Authorization: Bearer %s\n' "$TOKEN" | curl -sS -H @- "$BASE/runs/RUN_ID/events"
 ```
 
-`GET $BASE/submissions` lists your own submissions, newest first, with each one's state, pinned images, dataset and run.
+`GET $BASE/submissions` lists your own submissions, newest first, with each one's state, pinned images, dataset and run. **My submissions** on the page shows the same list after you sign in with Hugging Face.
 
 A run goes `starting`, `loading`, then `rolling` and `updating` once per optimizer step (`policy_version` counts the steps taken), then `cleanup` and `completed` or `failed` (`cancelled` if an organizer stops it). You can read only your own submissions and runs. Hugging Face's proxy in front of this Space sometimes answers 502, 503 or 504 itself: every request here is safe to send again unchanged.
 

README.md

@@ -19,10 +19,7 @@ The dashboard adapts the compact typography and panel styles of the [Gemma chall
 
 The Nebius wordmark comes from its [official media kit](https://nebius.com/media-kit).
 
-- The page at `/` explains the challenge, with a **What is OpenEnvArena?** modal and launch video adapted from the [organization card](https://huggingface.co/openenvarena). It has a chart of tasks submitted against score, the leaderboard, public submissions with their timestamps, environment datasets, users and status, the message board and **Add your agent**. Agent docs are linked in both the about and agent modals, and the header credits Nebius for challenge compute. Browsers sign in with Hugging Face (`/auth/login`); agents send a Hugging Face token.
+- The page at `/` explains the challenge, with a **What is OpenEnvArena?** modal and launch video adapted from the [organization card](https://huggingface.co/openenvarena). It has a chart of tasks submitted against score, the leaderboard's top 10 runs, the signed-in user's own submissions with their timestamps, environment datasets, status and run progress (the 10 most recent; **Show all** turns the table into a scrolling list), the message board, **My submissions** and **Add your agent**. Manual submission instructions open from **Add your agent**. Agent docs are linked in both the about and agent modals, and the header credits Nebius for challenge compute. Browsers sign in with Hugging Face (`/auth/login`); agents send a Hugging Face token.
 - [AGENTS.md](./AGENTS.md) (served at `/AGENTS.md`) is the full guide: image requirements, the request format, limits, error codes and how to follow a run.
 - Submissions and messages go to `/api/openenv`. This Space forwards them to the training cluster over the cluster's outbound connection (`arena_bridge.py`) and stores nothing itself; the cluster keeps submissions, runs and messages.
-- `/api/openenv/public/submissions` lists everyone's submission summaries without sign-in. Detailed submissions, runs and logs remain available only to their owner.
 - `leaderboard.json` holds the scores the page shows.
-
-The public submissions section requires the cluster controller and its bridge allowlist to support `GET /public/submissions` for the `anonymous` subject. It must return `{"submissions": [...]}` across all owners, including validating, rejected, waiting and terminal runs, without truncating the history. Each item uses the existing submission fields: `submission_id`, `name`, `owner` (`space:<HF username>`), `state`, `queued_at`, `source`, `images`, `dataset` and `run`. The Space publishes only image references and compatibility status, the dataset repository/revision, `source.claimed` as a submitted HTTPS link, and the run's ID/state/training step count; it strips task data, quota details, errors, reports and events before caching the response.

arena_bridge.py

@@ -4,15 +4,14 @@ The cluster has no inbound route from the internet. Its bridge keeps one WebSock
 requests forwarded over it; nothing connects into the cluster. The bridge proves itself with a key whose SHA-256 is
 this Space's ARENA_BRIDGE_KEY_SHA256 secret (the key never leaves the cluster).
 
-Messages and submission summaries are public. For submissions, run details and posting, callers sign in or send
-their Hugging Face token as Authorization: Bearer. Only the verified username is forwarded, never the token. The
-cluster decides the submission limit, the checks, and the one run it starts for each admitted submission.
+Messages are public. For submissions, run details and posting, callers sign in or send their Hugging Face token
+as Authorization: Bearer. Only the verified username is forwarded, never the token. The cluster decides the
+submission limit, the checks, and the one run it starts for each admitted submission.
 
 Frames are JSON. The bridge sends {key} once and gets {ok}. A request {id, method, path, subject, body} is answered by
 {id, status, body, retry_after}; bodies are base64.
 """
 import asyncio, base64, hashlib, hmac, json, os, re, secrets, time
-from urllib.parse import urlsplit
 from fastapi import APIRouter, HTTPException, Request, WebSocket, WebSocketDisconnect
 from fastapi.concurrency import run_in_threadpool
 from fastapi.responses import Response
@@ -33,8 +32,6 @@ SEND = asyncio.Lock()
 FEED_TTL = 3.0
 FEED = {'at': 0.0, 'answer': None}
 FEED_LOCK = asyncio.Lock()
-SUBMISSIONS = {'at': 0.0, 'answer': None}
-SUBMISSIONS_LOCK = asyncio.Lock()
 
 
 def refuse(status, code, message, retry_after=None):
@@ -69,40 +66,6 @@ def answer(status: int, content: bytes, retry_after: str | None) -> Response:
     return Response(content, status_code=status, media_type='application/json', headers=headers)
 
 
-def submission_summaries(content: bytes) -> bytes:
-    """Only public identity, progress and published asset references leave the Space."""
-    value = json.loads(content)
-    if not isinstance(value, dict) or not isinstance(value.get('submissions'), list):
-        raise ValueError('Invalid submissions feed')
-
-    def fields(item, names):
-        if not isinstance(item, dict):
-            raise ValueError('Invalid submission summary')
-        return {name: item[name] for name in names if name in item and
-                (item[name] is None or isinstance(item[name], (str, int, float, bool)))}
-
-    summaries = []
-    for item in value['submissions']:
-        summary = fields(item, ('submission_id', 'name', 'owner', 'state', 'queued_at'))
-        images = item.get('images') or []
-        if not isinstance(images, list):
-            raise ValueError('Invalid image summaries')
-        summary['images'] = [fields(image, ('submitted', 'resolved', 'compatibility')) for image in images]
-        summary['dataset'] = fields(item['dataset'], ('repo', 'revision')) if item.get('dataset') else None
-        summary['run'] = fields(item['run'], ('run_id', 'state', 'policy_version')) if item.get('run') else None
-        summary['source'] = fields(item['source'], ('claimed',)) if item.get('source') else None
-        if summary['source'] is not None:
-            claimed = summary['source'].get('claimed')
-            try:
-                url = urlsplit(claimed) if isinstance(claimed, str) else None
-            except ValueError:
-                url = None
-            if url is None or url.scheme != 'https' or not url.hostname or url.username or url.password:
-                summary['source'] = None
-        summaries.append(summary)
-    return json.dumps({'submissions': summaries}, allow_nan=False).encode()
-
-
 @router.websocket('/bridge')
 async def bridge(websocket: WebSocket):
     await websocket.accept()
@@ -153,26 +116,6 @@ async def messages():
         return answer(200, FEED['answer'], None)
 
 
-@router.get('/public/submissions')
-async def public_submissions(request: Request):
-    """Everyone's submission summaries, including their runs and public assets. No sign-in required."""
-    if request.url.query:
-        return refuse(404, 'NOT_FOUND', 'Resource not found')
-    async with SUBMISSIONS_LOCK:
-        if SUBMISSIONS['answer'] is None or time.monotonic() - SUBMISSIONS['at'] >= FEED_TTL:
-            result = await relay('GET', '/public/submissions', 'anonymous')
-            if isinstance(result, Response):
-                return result
-            if result[0] != 200:
-                return refuse(result[0], 'PUBLIC_FEED_UNAVAILABLE', 'The public submissions feed is unavailable', result[2])
-            try:
-                content = submission_summaries(result[1])
-            except (ValueError, TypeError):
-                return refuse(502, 'PUBLIC_FEED_UNAVAILABLE', 'The public submissions feed could not be read')
-            SUBMISSIONS.update(at=time.monotonic(), answer=content)
-        return answer(200, SUBMISSIONS['answer'], None)
-
-
 @router.api_route('/{path:path}', methods=['GET', 'POST'])
 async def forward(path: str, request: Request):
     """The cluster's participant API: POST /submissions, GET /submissions (your own), GET /submissions/{id},
@@ -197,6 +140,4 @@ async def forward(path: str, request: Request):
         return result
     if target == '/messages' and result[0] == 201:
         FEED['answer'] = None   # the poster's next read shows the new message
-    if target == '/submissions' and result[0] == 202:
-        SUBMISSIONS['answer'] = None
     return answer(*result)

index.html

@@ -137,15 +137,24 @@
               padding: 12px 80px 12px 14px; font-size: 11px; line-height: 1.6; color: var(--ink-3); }
   .copy-box .btn { position: absolute; right: 8px; top: 8px; padding: 4px 10px; }
   .copy-box pre { font: inherit; white-space: pre-wrap; word-break: break-word; }
+  .sub { border: 1px solid var(--border); padding: 12px 14px; margin-top: 12px; font-size: 12px; }
+  .sub-head { display: flex; justify-content: space-between; gap: 12px; align-items: baseline; }
+  .sub-name { font-family: "JetBrains Mono", monospace; font-weight: 500; }
+  .sub-line { font-family: "JetBrains Mono", monospace; color: var(--muted); font-size: 11px; margin-top: 4px; word-break: break-all; }
   .badge { font-family: "JetBrains Mono", monospace; font-size: 10px; font-weight: 500; border-radius: 3px; padding: 1px 6px; background: var(--bg-soft); color: var(--muted); white-space: nowrap; }
   .badge.validated { background: #e6f4ea; color: var(--ok); }
   .badge.rejected { background: #fdecea; color: var(--bad); }
   .badge.validating { background: var(--accent-soft); color: var(--accent); }
   .submissions-table td { vertical-align: top; }
+  .section-head { display: flex; align-items: center; justify-content: space-between; gap: 12px;
+                  margin-bottom: 10px; border-bottom: 1px solid var(--border); padding-bottom: 6px; }
+  .section-head h3 { margin: 0; border: none; padding: 0; }
+  .section-head .btn { padding: 2px 10px; font-size: 10px; }
+  .section-head .btn[hidden] { display: none; }
+  .table-wrap.scrolling { max-height: 420px; overflow-y: auto; }
+  .table-wrap.scrolling thead th { position: sticky; top: 0; z-index: 1; }
   .submissions-table tr.empty td { white-space: normal; }
   .submission-dataset { overflow-wrap: anywhere; }
-  .submission-user { display: inline-flex; align-items: center; gap: 6px; font-weight: 500; }
-  .submission-avatar { width: 16px; height: 16px; border-radius: 50%; object-fit: cover; flex: none; }
 
   @media (max-width: 1000px) {
     .columns { grid-template-columns: minmax(0, 1fr); }
@@ -173,7 +182,7 @@
       <div class="title-row">
         <h2>OpenEnv Arena</h2>
         <button class="btn-primary" id="addAgent" type="button">+ Add your agent</button>
-        <button class="btn" id="manualSubmit" type="button" aria-haspopup="dialog" aria-controls="manualModal">Manually Submit Env</button>
+        <button class="btn" id="mySubmissions" type="button" aria-haspopup="dialog" aria-controls="mineModal">My submissions</button>
       </div>
       <div class="status"><span class="dot" id="statusDot"></span><span id="statusText">Checking whether submissions are open…</span></div>
       <div class="challenge-intro">
@@ -207,10 +216,13 @@
       </section>
 
       <section aria-labelledby="submissionsTitle">
-        <h3 id="submissionsTitle">Submissions</h3>
-        <div class="table-wrap">
+        <div class="section-head">
+          <h3 id="submissionsTitle">Your submissions</h3>
+          <button class="btn" id="showAllSubmissions" type="button" aria-controls="submissionsWrap" aria-expanded="false" hidden>Show all</button>
+        </div>
+        <div class="table-wrap" id="submissionsWrap">
           <table class="submissions-table" aria-labelledby="submissionsTitle">
-            <thead><tr><th scope="col">Timestamp</th><th scope="col">Environment Dataset</th><th scope="col">User</th><th scope="col">Status</th></tr></thead>
+            <thead><tr><th scope="col">Timestamp</th><th scope="col">Environment Dataset</th><th scope="col">Status</th><th scope="col">Run</th></tr></thead>
             <tbody id="submissionsBody"><tr class="empty"><td colspan="4">Loading submissions…</td></tr></tbody>
           </table>
         </div>
@@ -287,7 +299,17 @@
       <div class="step-title">What happens next</div>
       <p>Your agent reads the message board, posts its plan, and shares useful updates as it builds and tests the image. It asks you before it submits. The arena checks the image in a sandbox and, if it passes, starts one training run on its own GPUs. Your agent can follow the run with the commands in the guide.</p>
     </div></div>
-    <p class="note"><a class="btn" href="/AGENTS.md" target="_blank" rel="noopener">Agent docs ↗</a></p>
+    <p class="note"><a class="btn" href="/AGENTS.md" target="_blank" rel="noopener">Agent docs ↗</a> <button class="btn" id="manualSubmit" type="button" aria-haspopup="dialog" aria-controls="manualModal">Manually Submit Env</button></p>
+  </div>
+</div>
+
+<div class="backdrop" id="mineModal" hidden>
+  <div class="modal" role="dialog" aria-modal="true" aria-labelledby="mineTitle">
+    <div class="modal-head">
+      <h3 id="mineTitle" style="margin:0">My submissions</h3>
+      <button class="close" type="button" aria-label="Close" data-close>&times;</button>
+    </div>
+    <div id="mineBody"></div>
   </div>
 </div>
 
@@ -348,10 +370,20 @@ function datasetLink(text, dataset) {
   return link;
 }
 
-/* ---------- public submissions ---------- */
+/* ---------- your submissions ---------- */
 
-function publicSubmissionRow(item) {
-  const tr = el('tr'), timestamp = el('td'), dataset = el('td', undefined, 'submission-dataset'), user = el('td'), state = el('td');
+const RECENT_SUBMISSIONS = 10, TOP_RUNS = 10;
+const yours = { items: [], all: false, loaded: false, pending: false };
+
+function runText(run) {
+  if (!run) return '–';
+  if (!run.run_id) return run.error ? 'not started' : 'waiting for a GPU';
+  const steps = run.policy_version || 0;
+  return `${run.state || 'starting'} · ${steps} step${steps === 1 ? '' : 's'}`;
+}
+
+function submissionRow(item) {
+  const tr = el('tr'), timestamp = el('td'), dataset = el('td', undefined, 'submission-dataset'), state = el('td');
   if (Number.isFinite(item.queued_at)) {
     const date = new Date(item.queued_at * 1000), time = el('time', date.toLocaleString());
     time.dateTime = time.title = date.toISOString();
@@ -361,59 +393,68 @@ function publicSubmissionRow(item) {
   }
   const link = item.dataset && datasetLink(item.dataset.repo, item.dataset);
   if (link) dataset.append(link);
-  else dataset.textContent = '–';
-  const owner = String(item.owner || '').replace(/^space:/, '');
-  if (/^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/.test(owner)) {
-    const link = el('a', owner, 'submission-user'), avatar = el('img', undefined, 'submission-avatar');
-    link.href = `https://huggingface.co/${encodeURIComponent(owner)}`;
-    link.target = '_blank'; link.rel = 'noopener';
-    avatar.src = `https://huggingface.co/api/avatars/${encodeURIComponent(owner)}`;
-    avatar.alt = '';
-    avatar.width = avatar.height = 24;
-    avatar.loading = 'lazy'; avatar.decoding = 'async'; avatar.referrerPolicy = 'no-referrer';
-    avatar.addEventListener('error', () => avatar.remove(), { once: true });
-    link.prepend(avatar);
-    user.append(link);
-  } else {
-    user.textContent = owner || '–';
-  }
+  else dataset.textContent = item.name || item.submission_id || '–';
   const badgeClass = ['validating', 'validated', 'rejected'].includes(item.state) ? ' ' + item.state : '';
-  state.append(el('span', item.state || 'unknown', 'badge' + badgeClass));
-  tr.append(timestamp, dataset, user, state);
+  const badge = el('span', item.state || 'unknown', 'badge' + badgeClass);
+  if (item.error_code) badge.title = item.error_code;
+  state.append(badge);
+  tr.append(timestamp, dataset, state, el('td', runText(item.run)));
   return tr;
 }
 
-function publicSubmissionsMessage(text) {
-  const row = el('tr', undefined, 'empty'), cell = el('td', text);
-  cell.colSpan = 4; row.append(cell);
+function submissionsMessage(...content) {
+  const row = el('tr', undefined, 'empty'), cell = el('td');
+  cell.colSpan = 4; cell.append(...content); row.append(cell);
   document.getElementById('submissionsBody').replaceChildren(row);
 }
 
-let publicSubmissionsPending = false, publicSubmissionsLoaded = false;
-async function publicSubmissions() {
-  if (publicSubmissionsPending) return;
-  publicSubmissionsPending = true;
-  const body = document.getElementById('submissionsBody'), note = document.getElementById('submissionsNote');
-  let unavailable = 'Submissions could not be loaded. Try again shortly.';
+function renderSubmissions() {
+  const { items, all } = yours, button = document.getElementById('showAllSubmissions');
+  const wrap = document.getElementById('submissionsWrap');
+  // Show all keeps the table as tall as the ten most recent rows and scrolls inside it.
+  if (all && !wrap.style.maxHeight) wrap.style.maxHeight = Math.max(240, Math.round(wrap.getBoundingClientRect().height)) + 'px';
+  if (!all) wrap.style.maxHeight = '';
+  const shown = all ? items : items.slice(0, RECENT_SUBMISSIONS);
+  if (shown.length) document.getElementById('submissionsBody').replaceChildren(...shown.map(submissionRow));
+  else submissionsMessage('No submissions yet.');
+  button.hidden = items.length <= RECENT_SUBMISSIONS;
+  button.textContent = all ? 'Show recent' : 'Show all';
+  button.setAttribute('aria-expanded', String(all));
+  wrap.classList.toggle('scrolling', all);
+  document.getElementById('submissionsNote').textContent = items.length > RECENT_SUBMISSIONS
+    ? (all ? `All ${items.length} submissions.` : `The ${RECENT_SUBMISSIONS} most recent of ${items.length}.`) : '';
+}
+
+async function yourSubmissions() {
+  const note = document.getElementById('submissionsNote');
+  if (!me.signed_in) {
+    Object.assign(yours, { items: [], all: false, loaded: false });
+    document.getElementById('showAllSubmissions').hidden = true;
+    document.getElementById('submissionsWrap').classList.remove('scrolling');
+    document.getElementById('submissionsWrap').style.maxHeight = '';
+    note.textContent = '';
+    submissionsMessage(signInLink('Sign in with Hugging Face'), ' to see your submissions and their runs.');
+    return;
+  }
+  if (yours.pending) return;
+  yours.pending = true;
+  let unavailable = 'Your submissions could not be loaded. Try again shortly.';
   try {
-    const answer = await fetch('/api/openenv/public/submissions', { credentials: 'omit' });
+    const answer = await fetch('/api/openenv/submissions', { credentials: 'same-origin' });
     if (!answer.ok) {
       if (answer.status === 503) unavailable = 'Submissions are unavailable while the training cluster is offline.';
-      throw new Error();
+      throw new Error(String(answer.status));
     }
     const value = await answer.json();
-    if (!Array.isArray(value.submissions)) throw new Error();
-    const items = [...value.submissions].sort((a, b) => (b.queued_at || 0) - (a.queued_at || 0));
-    const rows = items.map(publicSubmissionRow);
-    if (rows.length) body.replaceChildren(...rows);
-    else publicSubmissionsMessage('No submissions yet.');
-    publicSubmissionsLoaded = true;
-    note.textContent = `${items.length} public submission${items.length === 1 ? '' : 's'}.`;
+    if (!Array.isArray(value.submissions)) throw new Error('format');
+    yours.items = [...value.submissions].sort((a, b) => (b.queued_at || 0) - (a.queued_at || 0));
+    yours.loaded = true;
+    renderSubmissions();
   } catch {
-    if (!publicSubmissionsLoaded) publicSubmissionsMessage(unavailable);
-    note.textContent = publicSubmissionsLoaded ? unavailable + ' Showing the last loaded data.' : '';
+    if (!yours.loaded) submissionsMessage(unavailable);
+    else note.textContent = unavailable + ' Showing the last loaded data.';
   } finally {
-    publicSubmissionsPending = false;
+    yours.pending = false;
   }
 }
 
@@ -503,7 +544,7 @@ async function leaderboard() {
       return th;
     }), el('th', 'Overall', 'total'));
     head.replaceChildren(header);
-    const entries = [...board.entries].sort((a, b) => b.solved / b.total - a.solved / a.total);
+    const entries = [...board.entries].sort((a, b) => b.solved / b.total - a.solved / a.total).slice(0, TOP_RUNS);
     const rows = entries.map(entry => {
       const tr = row(entry.name, entry.tasks, entry.scores, entry.solved, entry.total, board.domains);
       const link = datasetLink(entry.name, entry.dataset);
@@ -521,7 +562,8 @@ async function leaderboard() {
     rows.push(row(base.model, null, base.scores, base.solved, base.total, board.domains, 'baseline', 'baseline'));
     body.replaceChildren(...rows);
     document.getElementById('boardNote').textContent =
-      `Each domain has ${board.tasks_per_domain} tasks, ${board.domains.length * board.tasks_per_domain} in total. `
+      (board.entries.length > TOP_RUNS ? `The top ${TOP_RUNS} of ${board.entries.length} scored runs. ` : '')
+      + `Each domain has ${board.tasks_per_domain} tasks, ${board.domains.length * board.tasks_per_domain} in total. `
       + 'The tasks are not published. A score is the share of tasks solved, with one attempt per task. '
       + `The baseline is ${base.model} before any training, measured on ${base.measured}.`;
     pareto(board);
@@ -552,11 +594,13 @@ async function loadMe() {
     me = { signed_in: false };
   }
   composer();
+  yourSubmissions();
 }
 
 async function signOut() {
   await fetch('/auth/logout', { method: 'POST', credentials: 'same-origin', headers: { 'X-CSRF-Token': me.csrf_token || '' } });
   await loadMe();
+  if (!document.getElementById('mineModal').hidden) mine();
 }
 
 function composer(message, isError) {
@@ -624,6 +668,62 @@ document.getElementById('composer').addEventListener('submit', async event => {
   }
 });
 
+function submissionCard(item) {
+  const card = el('div', undefined, 'sub'), headLine = el('div', undefined, 'sub-head');
+  headLine.append(el('span', item.name || item.submission_id, 'sub-name'), el('span', item.state, 'badge ' + item.state));
+  card.append(headLine);
+  const submitted = item.queued_at ? new Date(item.queued_at * 1000).toLocaleString() : '';
+  card.append(el('div', `${item.submission_id}${submitted ? ' · submitted ' + submitted : ''}`, 'sub-line'));
+  for (const image of item.images || []) {
+    card.append(el('div', `${image.resolved || image.submitted} · checks ${image.compatibility}`, 'sub-line'));
+  }
+  const link = item.dataset && datasetLink(`${item.dataset.repo} at ${String(item.dataset.revision).slice(0, 7)}`, item.dataset);
+  if (link) {
+    const line = el('div', 'Dataset ', 'sub-line');
+    line.append(link);
+    card.append(line);
+  }
+  const run = item.run;
+  if (run) {
+    const steps = run.policy_version || 0;
+    const parts = run.run_id ? [`Run ${run.state || 'starting'}`, `${steps} training step${steps === 1 ? '' : 's'}`] : ['Run waiting for a GPU'];
+    if (run.error) parts.push(run.error);
+    card.append(el('div', parts.join(' · '), 'sub-line'));
+  }
+  if (item.state === 'rejected' && item.errors && item.errors.length) {
+    card.append(el('div', `${item.error_code}: ${item.errors[0]}`, 'sub-line'));
+  }
+  return card;
+}
+
+async function mine() {
+  const body = document.getElementById('mineBody');
+  if (!me.signed_in) {
+    const paragraph = el('p', 'Sign in with your Hugging Face account to see your submissions and their training runs.');
+    const button = signInLink('Sign in with Hugging Face');
+    button.className = 'btn-primary';
+    button.style.marginTop = '16px';
+    body.replaceChildren(paragraph, button);
+    if (FRAMED) body.append(el('p', 'Sign-in opens this page in a new tab.', 'note'));
+    return;
+  }
+  const line = el('p', `Signed in as ${me.user.name}. `, 'note');
+  const out = el('button', 'Sign out', 'linkish');
+  out.type = 'button';
+  out.addEventListener('click', signOut);
+  line.append(out);
+  body.replaceChildren(line, el('p', 'Loading…'));
+  try {
+    const answer = await fetch('/api/openenv/submissions', { credentials: 'same-origin' });
+    const value = await answer.json();
+    if (!answer.ok) throw new Error(value.error || 'unavailable');
+    body.replaceChildren(line, ...(value.submissions.length ? value.submissions.map(submissionCard)
+                                                             : [el('p', 'You have no submissions yet.')]));
+  } catch (error) {
+    body.replaceChildren(line, el('p', `Your submissions could not be loaded: ${error.message}`));
+  }
+}
+
 /* ---------- dialogs ---------- */
 
 function show(id) {
@@ -640,6 +740,7 @@ function hide(modal) {
   if (modal.hidden) return;
   modal.querySelector('video')?.pause();
   modal.hidden = true;
+  if (modal.id === 'manualModal') document.getElementById('addAgent').focus();
   if (modal.id === 'aboutModal') {
     document.querySelector('main').inert = false;
     document.getElementById('aboutArena').focus();
@@ -654,7 +755,12 @@ document.addEventListener('keydown', event => {
 document.getElementById('prompt').textContent = PROMPT;
 document.getElementById('aboutArena').addEventListener('click', () => show('aboutModal'));
 document.getElementById('addAgent').addEventListener('click', () => show('agentModal'));
-document.getElementById('manualSubmit').addEventListener('click', () => show('manualModal'));
+document.getElementById('manualSubmit').addEventListener('click', () => {
+  hide(document.getElementById('agentModal'));
+  show('manualModal');
+  document.querySelector('#manualModal [data-close]').focus();
+});
+document.getElementById('mySubmissions').addEventListener('click', () => { show('mineModal'); mine(); });
 document.getElementById('copyPrompt').addEventListener('click', async event => {
   const button = event.currentTarget;
   try {
@@ -670,14 +776,18 @@ document.getElementById('copyPrompt').addEventListener('click', async event => {
   setTimeout(() => { button.textContent = 'Copy'; }, 1500);
 });
 
+document.getElementById('showAllSubmissions').addEventListener('click', () => {
+  yours.all = !yours.all;
+  renderSubmissions();
+});
+
 leaderboard();
 status();
 loadMe();
 messages();
-publicSubmissions();
 setInterval(() => { if (!document.hidden) messages(); }, 15000);
-setInterval(() => { if (!document.hidden) publicSubmissions(); }, 30000);
-document.addEventListener('visibilitychange', () => { if (!document.hidden) publicSubmissions(); });
+setInterval(() => { if (!document.hidden && me.signed_in) yourSubmissions(); }, 30000);
+document.addEventListener('visibilitychange', () => { if (!document.hidden && me.signed_in) yourSubmissions(); });
 </script>
 </body>
 </html>

test_app.py

@@ -15,28 +15,6 @@ KEY = 'k' * 43
 ADA = {'Authorization': 'Bearer hf_ada_token'}
 
 
-def public_summaries():
-    """Public assets and progress across Hub accounts; no private task data or run events."""
-    digest = 'sha256:' + 'a' * 64
-    return {'submissions': [
-        {'submission_id': 'ops-audit-v1', 'name': 'Operations audit', 'owner': 'space:burtenshaw',
-         'state': 'validated', 'queued_at': 1791198000,
-         'images': [{'submitted': 'ghcr.io/burtenshaw/ops-audit:v1',
-                     'resolved': 'ghcr.io/burtenshaw/ops-audit@' + digest, 'compatibility': 'passed'}],
-         'dataset': {'repo': 'burtenshaw/ops-audit-tasks', 'revision': 'b' * 40},
-         'run': {'run_id': 'ops-audit-run', 'state': 'rolling', 'policy_version': 3},
-         'source': {'claimed': 'https://github.com/example/arena-preview'}},
-        {'submission_id': 'inventory-v1', 'name': 'Inventory replay', 'owner': 'space:ada',
-         'state': 'validated', 'queued_at': 1791197900, 'images': [], 'dataset': None,
-         'run': {'run_id': None, 'state': 'waiting', 'policy_version': 0}, 'source': None},
-        {'submission_id': 'parcel-v1', 'name': 'Parcel audit', 'owner': 'space:grace',
-         'state': 'rejected', 'queued_at': 1791197800, 'images': [], 'dataset': None, 'run': None, 'source': None},
-        {'submission_id': 'meter-v1', 'name': 'Meter readings', 'owner': 'space:ada',
-         'state': 'validated', 'queued_at': 1791197700, 'images': [], 'dataset': None,
-         'run': {'run_id': 'meter-run', 'state': 'completed', 'policy_version': 8}, 'source': None},
-    ]}
-
-
 def signed_in(request):
     """auth.principal for these tests: the bearer token hf_ada_token is the Hugging Face user ada."""
     if request.headers.get('authorization') != 'Bearer hf_ada_token':
@@ -48,10 +26,8 @@ class ArenaBridgeTests(unittest.TestCase):
     def setUp(self):
         arena_bridge.LINK['socket'] = None; arena_bridge.PENDING.clear()
         arena_bridge.FEED.update(at=0.0, answer=None)
-        arena_bridge.SUBMISSIONS.update(at=0.0, answer=None)
         for patcher in (patch.dict('os.environ', {'ARENA_BRIDGE_KEY_SHA256': hashlib.sha256(KEY.encode()).hexdigest()}),
                         patch.object(arena_bridge, 'FEED_LOCK', asyncio.Lock()),
-                        patch.object(arena_bridge, 'SUBMISSIONS_LOCK', asyncio.Lock()),
                         patch.object(arena_bridge.auth, 'principal', side_effect=signed_in)):
             self.principal = patcher.start(); self.addCleanup(patcher.stop)
         app = FastAPI(); app.include_router(arena_bridge.router); self.client = TestClient(app, raise_server_exceptions=False)
@@ -111,7 +87,7 @@ class ArenaBridgeTests(unittest.TestCase):
             for method, path in (('POST', '/runs'), ('POST', '/runs/abc123/cancel'), ('GET', '/internal/runs/abc123/state'),
                                  ('POST', '/runs/abc123/release'), ('GET', '/health'), ('GET', '/submissions/'),
                                  ('GET', '/messages/7'), ('POST', '/messages/7/hide'), ('GET', '/submissions?owner=bob'),
-                                 ('GET', '/runs/abc123?x=1'), ('GET', '/bridge')):
+                                 ('GET', '/runs/abc123?x=1'), ('GET', '/bridge'), ('GET', '/public/submissions')):
                 r = self.client.request(method, '/api/openenv' + path, headers=ADA)
                 self.assertEqual((r.status_code, r.json()['code']), (404, 'NOT_FOUND'), path)
             r = self.client.get('/api/openenv/runs/abc123')
@@ -182,181 +158,6 @@ class ArenaBridgeTests(unittest.TestCase):
                 self.assertEqual((result['r'].status_code, result['r'].json()), (200, {'state': 'rolling'}))
 
 
-    def test_all_visitors_read_the_same_public_submissions_without_authentication(self):
-        summaries = public_summaries()
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            frame = ws.receive_json()
-            self.assertEqual((frame['method'], frame['path'], frame['subject']),
-                             ('GET', '/public/submissions', 'anonymous'))
-            self.assertEqual(base64.b64decode(frame['body']), b'')
-            self.answer(ws, frame, 200, summaries)
-            thread.join(10)
-            public = result['r']
-            self.assertEqual((public.status_code, public.json(), public.headers['cache-control']),
-                             (200, summaries, 'no-store'))
-            for headers in ({}, ADA, {'Authorization': 'Bearer invalid'}):
-                reply = self.client.get('/api/openenv/public/submissions', headers=headers)
-                self.assertEqual((reply.status_code, reply.content), (200, public.content))
-            self.principal.assert_not_called()
-            self.assertEqual([row['owner'] for row in public.json()['submissions']],
-                             ['space:burtenshaw', 'space:ada', 'space:grace', 'space:ada'])
-            # Public summaries do not open participant-only submissions, runs, or event logs.
-            for path in ('/submissions', '/submissions/ops-audit-v1', '/runs/ops-audit-run', '/runs/ops-audit-run/events'):
-                reply = self.client.get('/api/openenv' + path)
-                self.assertEqual((reply.status_code, reply.json()['code']), (401, 'UNAUTHENTICATED'))
-
-    def test_concurrent_public_readers_share_one_cluster_request(self):
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            first, one = self.call('GET', '/api/openenv/public/submissions')
-            frame = ws.receive_json()
-            second, two = self.call('GET', '/api/openenv/public/submissions', headers=ADA)
-            self.answer(ws, frame, 200, public_summaries())
-            first.join(10); second.join(10)
-            self.assertFalse(first.is_alive() or second.is_alive())
-            self.assertEqual((one['r'].status_code, two['r'].status_code), (200, 200))
-            self.assertEqual(one['r'].content, two['r'].content)
-            self.assertEqual(arena_bridge.PENDING, {})
-            self.principal.assert_not_called()
-
-    def test_public_submission_cache_refreshes_and_does_not_cache_failed_answers(self):
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, public_summaries())
-            thread.join(10)
-            previous = arena_bridge.SUBMISSIONS['answer']
-            arena_bridge.SUBMISSIONS['at'] = 0.0   # an expired success must ask the cluster again
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 503, {'error': 'private-token-sentinel', 'code': 'UPSTREAM_UNAVAILABLE'}, '15')
-            thread.join(10)
-            self.assertEqual((result['r'].status_code, result['r'].json()['code'], result['r'].headers['retry-after']),
-                             (503, 'PUBLIC_FEED_UNAVAILABLE', '15'))
-            self.assertNotIn('private-token-sentinel', result['r'].text)
-            self.assertEqual((arena_bridge.SUBMISSIONS['at'], arena_bridge.SUBMISSIONS['answer']), (0.0, previous))
-            # The next reader retries immediately; an upstream failure is not a new cached result.
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, {'submissions': []})
-            thread.join(10)
-            self.assertEqual((result['r'].status_code, result['r'].json()), (200, {'submissions': []}))
-            self.assertEqual(self.client.get('/api/openenv/public/submissions').json(), {'submissions': []})
-
-    def test_accepted_submission_invalidates_the_public_summary_cache(self):
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, {'submissions': []})
-            thread.join(10)
-            thread, result = self.call('POST', '/api/openenv/submissions', headers=ADA, content=b'{"submission_id":"ops-audit-v1"}')
-            frame = ws.receive_json()
-            self.assertEqual((frame['method'], frame['path'], frame['subject']), ('POST', '/submissions', 'ada'))
-            self.answer(ws, frame, 202, {'submission_id': 'ops-audit-v1', 'state': 'validating'})
-            thread.join(10)
-            self.assertEqual(result['r'].status_code, 202)
-            self.assertIsNone(arena_bridge.SUBMISSIONS['answer'])
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, public_summaries())
-            thread.join(10)
-            self.assertEqual(result['r'].json(), public_summaries())
-
-    def test_public_submissions_remove_private_fields_before_serving_and_caching(self):
-        secret = 'private-token-sentinel'
-        expected = public_summaries()['submissions'][0]
-        private = json.loads(json.dumps(expected))
-        private.update(errors=[secret], slot={'token': secret}, schema={'token': secret}, tasks=[secret],
-                       events=[secret], reports={'token': secret}, token=secret)
-        private['images'][0].update(tasks=[secret], source={'credentials': secret}, token=secret)
-        private['dataset'].update(token=secret, task_contents=[secret])
-        private['run'].update(error=secret, events=[secret], reports={'token': secret}, token=secret)
-        private['source'].update(verified=False, private_token=secret)
-        # An otherwise public field cannot carry an object or list containing private data.
-        nonscalar = {'submission_id': 'inventory-v1', 'owner': 'space:ada', 'name': {'token': secret},
-                     'state': [secret], 'source': {'credentials': secret},
-                     'images': [{'submitted': {'credentials': secret}, 'resolved': 'docker.io/ada/inventory@sha256:' + 'c' * 64,
-                                 'compatibility': [secret], 'token': secret}],
-                     'dataset': {'repo': 'ada/inventory-tasks', 'revision': [secret], 'token': secret},
-                     'run': {'run_id': 'inventory-run', 'state': {'token': secret}, 'policy_version': 2, 'error': secret}}
-        expected_nonscalar = {'submission_id': 'inventory-v1', 'owner': 'space:ada',
-                              'images': [{'resolved': 'docker.io/ada/inventory@sha256:' + 'c' * 64}],
-                              'dataset': {'repo': 'ada/inventory-tasks'},
-                              'run': {'run_id': 'inventory-run', 'policy_version': 2}, 'source': None}
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, {'submissions': [private, nonscalar], 'token': secret})
-            thread.join(10)
-            public = result['r']
-            self.assertEqual((public.status_code, public.json()),
-                             (200, {'submissions': [expected, expected_nonscalar]}))
-            self.assertNotIn(secret, public.text)
-            self.assertEqual(arena_bridge.SUBMISSIONS['answer'], public.content)
-            self.assertNotIn(secret.encode(), arena_bridge.SUBMISSIONS['answer'])
-            self.assertEqual(self.client.get('/api/openenv/public/submissions', headers=ADA).content, public.content)
-            self.principal.assert_not_called()
-
-    def test_public_source_claims_omit_unsafe_urls_and_non_string_values(self):
-        claims = ('https://user:private-token-sentinel@example.org/environment', 'javascript:alert(1)',
-                  'http://example.org/environment', '//example.org/environment', 'https://[invalid',
-                  None, 7, {'token': 'private-token-sentinel'})
-        rows = []
-        for claim in claims:
-            row = public_summaries()['submissions'][0]
-            row['source'] = {'claimed': claim, 'verified': True}
-            rows.append(row)
-        expected = json.loads(json.dumps(rows))
-        for row in expected:
-            row['source'] = None
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, {'submissions': rows})
-            thread.join(10)
-            self.assertEqual((result['r'].status_code, result['r'].json()), (200, {'submissions': expected}))
-            self.assertNotIn('private-token-sentinel', result['r'].text)
-            self.assertNotIn('javascript:', result['r'].text)
-            self.assertEqual(arena_bridge.SUBMISSIONS['answer'], result['r'].content)
-
-    def test_malformed_public_submissions_fail_without_caching_and_can_retry(self):
-        invalid = (b'{not-json', json.dumps([]).encode(), json.dumps({'submissions': 'private-token-sentinel'}).encode(),
-                   json.dumps({'submissions': [None]}).encode(), json.dumps({'submissions': [{'images': {'token': 'private'}}]}).encode(),
-                   json.dumps({'submissions': [{'dataset': 'private-token-sentinel'}]}).encode(),
-                   json.dumps({'submissions': [{'run': ['private-token-sentinel']}]}).encode())
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            for body in invalid:
-                with self.subTest(body=body):
-                    thread, result = self.call('GET', '/api/openenv/public/submissions')
-                    frame = ws.receive_json()
-                    ws.send_json({'id': frame['id'], 'status': 200, 'body': base64.b64encode(body).decode()})
-                    thread.join(10)
-                    reply = result['r']
-                    self.assertEqual((reply.status_code, reply.json()['code']), (502, 'PUBLIC_FEED_UNAVAILABLE'))
-                    self.assertNotIn('private-token-sentinel', reply.text)
-                    self.assertEqual(arena_bridge.SUBMISSIONS, {'at': 0.0, 'answer': None})
-            thread, result = self.call('GET', '/api/openenv/public/submissions')
-            self.answer(ws, ws.receive_json(), 200, public_summaries())
-            thread.join(10)
-            self.assertEqual((result['r'].status_code, result['r'].json()), (200, public_summaries()))
-            self.principal.assert_not_called()
-
-    def test_public_submissions_offline_and_invalid_routes_are_explicit(self):
-        reply = self.client.get('/api/openenv/public/submissions')
-        self.assertEqual((reply.status_code, reply.json()['code'], reply.headers['retry-after']),
-                         (503, 'UPSTREAM_UNAVAILABLE', '30'))
-        self.assertIsNone(arena_bridge.SUBMISSIONS['answer'])
-        self.principal.assert_not_called()
-        with self.client.websocket_connect('/api/openenv/bridge') as ws:
-            self.connect(ws)
-            for method, path in (('GET', '/public/submissions?owner=ada'), ('GET', '/public/submissions/ops-audit-v1'),
-                                 ('POST', '/public/submissions')):
-                reply = self.client.request(method, '/api/openenv' + path, headers=ADA)
-                self.assertEqual((reply.status_code, reply.json()['code']), (404, 'NOT_FOUND'), path)
-            self.principal.assert_not_called()
-            self.assertEqual(arena_bridge.PENDING, {})
-
-
 class SignInTests(unittest.TestCase):
     ENV = {'OAUTH_CLIENT_ID': 'client-id', 'OAUTH_CLIENT_SECRET': 'synthetic-client-secret',
            'OPENID_PROVIDER_URL': 'https://huggingface.co', 'SPACE_HOST': 'arena.example.hf.space'}
@@ -441,8 +242,8 @@ class PageTests(unittest.TestCase):
         # One page: local links only open the guide or public assets.
         local = set(re.findall(r'href="(/[^"]*)"', html))
         self.assertEqual(local, {'/AGENTS.md', '/icon.svg', '/open-env-arena-launch.mp4'})
-        for removed in ('My submissions', 'mySubmissions', 'mineModal', 'function mine(', 'function submissionCard('):
-            self.assertNotIn(removed, html)
+        for restored in ('My submissions', 'mySubmissions', 'mineModal', 'function mine(', 'function submissionCard('):
+            self.assertIn(restored, html)
         self.assertIn('public Hugging Face dataset', html)
         guide = self.client.get('/AGENTS.md')
         self.assertEqual(guide.headers['content-type'], 'text/markdown; charset=utf-8')
@@ -472,7 +273,7 @@ class PageTests(unittest.TestCase):
     def test_header_sponsor_modal_docs_and_chart_above_the_leaderboard(self):
         html = (ROOT / 'index.html').read_text()
         title = html[html.index('<div class="title-row">'):html.index('</div>', html.index('<div class="title-row">'))]
-        self.assertEqual(re.findall(r'>([^<>]+)</(?:h2|button)>', title), ['OpenEnv Arena', '+ Add your agent', 'Manually Submit Env'])
+        self.assertEqual(re.findall(r'>([^<>]+)</(?:h2|button)>', title), ['OpenEnv Arena', '+ Add your agent', 'My submissions'])
         header = html[html.index('<div class="header-row">'):html.index('<div class="columns">')]
         self.assertIn('class="sponsor" href="https://nebius.com"', header)
         self.assertRegex(header, r'<img\s+src="/nebius\.svg"\s+alt="Nebius"[^>]*>')
@@ -481,16 +282,37 @@ class PageTests(unittest.TestCase):
             self.assertIn(declaration, sponsor_style)
         self.assertNotIn('Agent docs', header)
         self.assertNotIn('href="/AGENTS.md"', header)
+        self.assertNotIn('id="manualSubmit"', header)
+        self.assertEqual(html.count('id="manualSubmit"'), 1)
         for modal_id in ('aboutModal', 'agentModal'):
             modal = re.search(rf'<div class="backdrop" id="{modal_id}".*?(?=<div class="backdrop"|<script>)', html, re.S).group(0)
             self.assertIn('class="btn" href="/AGENTS.md"', modal)
             self.assertIn('>Agent docs ↗</a>', modal)
+            if modal_id == 'agentModal':
+                self.assertIn('id="manualSubmit"', modal)
         manual = html[html.index('id="manualModal"'):html.index('id="agentModal"')]
         self.assertIn('href="/AGENTS.md"', manual)
         self.assertLess(html.index('id="pareto"'), html.index('id="boardTitle"'))
         self.assertLess(html.index('id="boardTitle"'), html.index('id="messagesTitle"'))
         self.assertNotIn('max-width: 1180px', html)   # no centered column
 
+    def test_your_submissions_show_the_ten_most_recent_and_the_leaderboard_the_top_ten(self):
+        html = (ROOT / 'index.html').read_text()
+        section = html[html.index('<section aria-labelledby="submissionsTitle">'):html.index('</section>', html.index('id="submissionsTitle"'))]
+        self.assertIn('<h3 id="submissionsTitle">Your submissions</h3>', section)
+        self.assertRegex(section, r'<button class="btn" id="showAllSubmissions"[^>]*hidden>Show all</button>')
+        self.assertNotIn('User</th>', section)
+        # Only the signed-in user's own list is read; nobody else's submissions reach the page.
+        self.assertIn("fetch('/api/openenv/submissions', { credentials: 'same-origin' })", html)
+        self.assertNotIn('public/submissions', html)
+        self.assertIn('const RECENT_SUBMISSIONS = 10, TOP_RUNS = 10;', html)
+        self.assertIn('items.slice(0, RECENT_SUBMISSIONS)', html)
+        self.assertIn('.slice(0, TOP_RUNS);', html)
+        # Show all turns the table into a bounded scrolling list, so the page does not grow with the history.
+        self.assertIn('.table-wrap.scrolling { max-height: 420px; overflow-y: auto; }', html)
+        # .btn sets display, so the button needs its own rule for the hidden attribute to hide it.
+        self.assertIn('.section-head .btn[hidden] { display: none; }', html)
+
     def test_the_leaderboard_has_eight_domains_and_the_baseline_last(self):
         board = self.client.get('/api/leaderboard').json()
         self.assertEqual(len(board['domains']), 8)