AI Game Day

The game

AI Game Day is a team game for learning generative AI by using it. Teams of up to four work through timed tasks: researching a problem with an AI assistant, writing a product requirements document, preparing a briefing, and prototyping with AI coding tools. The original content has 3 tasks and 14 subtasks, worth 700 base points, or up to 1,400 with time bonuses. At the event, a live leaderboard tracked every team's progress.

I designed it for a single live event in 2025 and built it on React and Supabase with AI coding tools: Lovable produced the first version of the app, Devin and Claude Code added features and fixes, and I integrated the work and shipped it.

The problem

After the event, I commissioned a review of the codebase. It documented 14 findings, and the critical one was that any signed-in user could make themselves an admin. It also found that the code accepted any non-empty answer, the browser calculated its own points, and one task clock was shared by every team, which made the timing unfair.

Nobody was using the app, so rather than patch it, I deleted its hosted database, and the participant data in it, as a deliberate containment step. That left nothing to show, and the game's content was tangled through database migrations and code.

What I did

I commissioned a brief for the rebuild, drafted with an AI assistant and approved by me. It treated three asks as one problem: a demo, a setup that isn't tied to one database, and new themes. All three came from content, rules and storage being welded together: an inventory counted 81 Supabase touchpoints in 22 production files.

I had the codebase investigated before anything was rebuilt. Then I chose a small "Showcase" scope over a fuller reusable kit, until there's evidence that someone wants to run another event.

What came out of it

• A demo that needs no server. The whole game runs in the browser: one team, progress saved in the browser, and three simulated rival teams so the leaderboard has something to show. It makes no network requests beyond loading the page and its three files, and an automated test and a bundle check enforce that. It downloads about 400 kB of JavaScript (125 kB compressed); the original app was 678 kB.
• Game packs: content and theme as data. Each theme is one validated JSON file, replacing content that was spread across database migrations, code and page copy. Swapping the pack re-themes the whole game with no code change. The validator checks for problems this project actually had, such as achievements that couldn't be earned after a content change, and checks colour contrast. There are two packs: the original event content and a neutral starter.
• A guide to writing packs, with an LLM prompt that turns an organisation's brief into a pack. On the first test run, the output failed validation; the prompt was fixed, and a fresh run passed and built into a working demo.
• The rules as a portable engine. Unlocking, attempts, scoring tiers, achievements and ranking are now pure TypeScript functions, and the new code has 99 automated tests. The engine fixes the timing unfairness: each subtask is timed from when it unlocked for that team. The demo uses the engine; the original app still has its old logic.
• A database history that replays. The original 53 migrations couldn't be replayed, and the investigation found more wrong with them than had been documented, including six duplicate files and one migration that can't run on any Postgres. They were reduced to a single baseline (38 replayed, 15 left out with the reasons recorded), checked against the types generated from the old production database, and rebuilt cleanly with supabase db reset.
• A storage interface. The demo talks to storage through one interface, designed so other databases can be added. Only the browser-only adapter is built: the Supabase adapter isn't, and the original app's pages don't use the interface yet.
• Ready to share. An MIT licence, a mobile layout, a basic accessibility pass, and build fixes so a clean install works on any platform.
• Decisions written down. A findings document and three architecture decision records: rules in TypeScript, the storage interface, and game packs.

What is still true

• The 2025 event app isn't running. Its database was deleted. The live link is a single-team demo, not the event app.
• The security findings are documented, not fixed, in the original app's code. Users can still give themselves the admin role there, and the browser still records its own points. The demo isn't affected, because it has no server, accounts or shared data.
• The fuller kit wasn't built. The Supabase adapter, a server-side engine and the admin-role fix are deferred, deliberately, until a second event has a date and an owner.

How AI was used

I built it, and later rebuilt it, with AI coding tools, which I directed through briefs, reviews and decisions about scope. In 2026, Claude Code carried out the review, the investigation and the rebuild from the brief, using one separate agent for the Supabase inventory and another for a review before publication. I chose the scope, approved the MIT licence and set up the deploy to Cloudflare.

The repository keeps write-ups of the AI-assisted debugging and an honest list of what went wrong. One lesson runs through it: each security fix made sense on its own, but nobody tested how they interacted.

What I learned

AI tools can produce a working event app quickly. What decides whether it can be trusted is the brief, the review, and checks that test how separate fixes combine.

Licence and source

AI Game Day is free and MIT-licensed. The public repository is a snapshot of the development repository, taken on 19 October 2026, without its history.