X Arcade / Decoy

Inspiration

X's own head of product says people come to X to get a pulse on humanity, and nothing is more unsettling than machine text wearing a human face. X is already purging chatbot accounts and banning slop apps, but that is enforcement after the fact. Nobody had made spotting the machine something people want to do. And in twenty years, X has never shipped a game.

What it does

Decoy is an arcade game for a room full of phones. Each round shows a real trending X thread with five replies: four are real, one was written by Grok to blend in. Players get 30 seconds to find the machine. Reveal shows the decoy, who picked what, the tell that gives the AI away, and a Grok Imagine share card. Matches run six rounds across text and GIF modes, solo or multiplayer, no app install, no host. A public /stats page counts only real user actions, so our usage numbers are honest by construction.

How we built it

One FastAPI websocket server holds the rooms on a time-driven session clock (10s lobby, 30s round, 14s reveal). Rounds are built offline with a grounded two-call pull that rejects any answer with no search call, because our x_search probe took 42 seconds and that can never sit on a 30-second clock. Every round passes five fail-closed safety gates (source, slurs, decoy count, author leak, URLs) and is re-screened on every serve. The xAI API runs four surfaces: x_search pulls the threads, grok-4.5 writes the imposter, Grok Imagine makes share cards (6.5s probe) and GIF-round clips, and Grok voice hosts the arcade (TTS 1.78s, realtime token 0.13s, commentator line on the fast model in 0.6s). The whole thing deploys to a Hugging Face Space through a gated GitHub Actions workflow that refuses to ship if the test suites or media inventory fail.

Challenges we ran into

Host-driven rooms gave us three dead-button bugs, so we deleted the host and made the clock run the room. The GIF decoy leaked three ways (URL path, file type, a lone pending status), so all reply media now serves through one opaque per-round proxy with uniform headers, and you cannot find the decoy in dev tools. Live pulls kept surfacing threads that pass regex gates but fail a sponsor sniff test, so every fresh round gets a human content read. That read pulled seven rounds from the pool the night before judging, including one built on an active criminal case.

Accomplishments that we're proud of

A 32-check abuse battery passes against the live Space. Offline replay runs with a socket guard proving zero network egress. During guessing the answer never leaves the server. The demo video was produced by the pipeline itself: a self-recording presenter page that plays pre-rendered Grok voice narration over the deck and captures its own tab. Built in one day.

What we learned

The gap between schema-valid and shippable is the whole product. Every round that had to be pulled passed the automated gates, which is exactly why the gates plus a human read is the design, not either alone. We also learned that anti-cheat is a fairness feature: the game is only fun if the decoy genuinely cannot be found by inspection.

What's next for X Arcade / Decoy

The cabinet takes cartridges: Decoy is game one, and the round contract makes new games cheap. The flywheel thesis is that every guess is a labeled human judgment on what reads machine-written, which is the signal enforcement needs. We label it a thesis because we measured zero flywheel metrics. The ask is one cartridge on a real X surface to measure it, and sponsored arenas where the same five gates that screen every round become the brand-safety guarantee.

Built With

• docker
• fastapi
• github-actions
• grok
• grok-imagine
• grok-voice
• html5
• huggingface
• javascript
• python
• websockets
• x-search
• xai-api