This is a submission for the MLH x DEV Writing Challenge.
File A imports B. B imports C. C imports A.
A dependency checker can flag that cycle. A diagram draws it as a knot of arrows. In GITZILLA, it glows on a monster as a weak point, and your whole team is aiming at it.
Every developer has fought a codebase. At HackPSU Fall 2026, our team made the fight literal. GITZILLA is a browser multiplayer game where GitHub repositories become fighters and software architecture becomes a boss you can take apart, with your phone as the controller.
Under the pixel art sits one question: what if fighting a codebase's structure helped you understand it?
What I Built
GITZILLA is our four-person team's project. My part was the documentation and submission materials, including the README update.
A dependency graph you can dodge
The analysis pipeline reads a bounded archive of a repository and extracts import relationships across nine languages. Tarjan's strongly connected components algorithm finds cycles like the A, B, C loop above, which can become boss weaknesses.
Heavily imported files inform the boss's heart. Major components become breakable limbs, and every attack belongs to a component. Break the limb, and the attack it powers disappears. That rule turns a visual metaphor into a mechanic: you change the fight by dismantling the architecture.
A Genesis reveal connects source facts to each character's attributes and appearance. After a raid, an autopsy explains which components broke, and "Adopt an Organ" links lead to maintainers and open-source issues. Inspect the code, play against its structure, then return to the repository with a reason to care.
Three modes, three fairness questions
Each mode forced a different answer to the same question: what should a repository be allowed to buy?
- Cooperative raids (1 to 8 players). Heroes share an equal stat budget, so a famous repository does not get a stronger character. Bots fill seats for practice or smaller squads.
- PvP royale (2 to 8 players). Fighters compete inside a shrinking "GC sweep" zone. Repo Power makes measured repository signals part of the competition. It blends code-quality heuristics (60%) with logarithmically scaled repository signals (40%) and maps the result into bounded combat stats. It is an explainable game mechanic, not a universal grade for software quality.
- Classroom raids (up to 30 students). Teachers assign coding tasks, and nine Python lesson presets include starter code and self-checks. Submissions power a shared class attack, but only improvement earns new damage, so resubmitting unchanged work cannot farm progress.
The classroom also taught us to separate audiences. Teachers see private review details, while the projector shows class aggregates. Source checks never execute student code on the server, and GitHub CI evidence is tied to the exact submitted revision.
Demo
Play GITZILLA · Guided walkthrough · Source code · Devpost submission
Start with the guided walkthrough. To raid, create a room, pick hero and boss repositories, and share the room link or QR code. On a compatible phone, tilt to move, swing or tap to attack, swipe or tilt hard to dash, and circle the phone or hold for a skill. Desktop and touch-only controls work too.
One match, several ways to see it
The 2D and Three.js views render the same authoritative match state, and in 3D, voxel extrusion gives the pixel-art characters real volume.
On compatible Apple Vision Pro browsers, WebXR immersive VR places the live arena on a world-pinned virtual tabletop. A paired phone controls the player while the headset supplies the view. Native USDZ previews provide a separate, frozen model of the scene.
A capture of GITZILLA's 3D renderer, included in our guided demo.
Partner Technologies
Our partner technologies make the most sense as answers to one question: who gets to decide? Each has a narrow job, and those boundaries are the most reusable idea in the project.
Gemini gives each repository a personality
For eligible public repositories, Gemini receives bounded structure, README context, and extracted identifiers, then returns schema-constrained designs, names, and taunts. Local code validates the response and renders the art. Gemini never sets combat stats or drives the real-time simulation.
Latency shaped the design too. A deterministic design makes every character available immediately, and background generation can refine it without holding up a match. Cached results and DeepSeek provide additional paths, with provider provenance recording which one produced each design. Credentialed repository analyses bypass external art generation and public source caches.
The pattern travels well beyond games. Define the model's output contract, validate locally, keep a usable fallback, and never let critical behavior wait on generation.
Auth0 connects identity to repository eligibility
"Bring your repository" is an authorization problem, because a typed name proves nothing about who may use it. GITZILLA uses Auth0 with GitHub sign-in, and the server checks repository eligibility, then checks it again when the match starts.
The same identity pairs a phone with that player's seat on a desktop or headset, which introduced a subtle input problem. The display sends neutral input of its own, and that idle signal must not overwrite movement arriving from the phone. The server arbitrates between the sources, so a player can watch one device and steer with another.
Solana lets players check what the server recorded
Eligible public PvP matches with at least two humans produce downloadable Ed25519-signed match receipts. No wallet is needed to play or download one. Anchoring is optional. The player signs a message, GITZILLA sponsors a Solana Devnet transaction, and a Memo records a salted SHA-256 digest.
The chain board does the same for leaderboard snapshots. Each becomes a Merkle tree, its root is anchored, and the browser verifies that a row belongs to that snapshot without putting every leaderboard field on-chain. This finalized Devnet snapshot, recorded at slot 514,999,427, contains the root used by the live board's browser proof check. The Merkle tree implementation is public.
The trust boundary is easy to overstate. These proofs attest to the server's recorded results and snapshot membership. They do not independently prove that gameplay was fair. Pending and unavailable anchoring states stay visible, and receipt downloads still work when anchoring cannot complete.
Vultr hosts a deployment designed for recovery
A signed result only matters if it survives. Our Vultr deployment tooling uses immutable Git revisions, configuration checks, persistent-state backups, fresh-process health checks, and rollback to the previous release, under a dedicated service account with a restricted writable directory.
SQLite persists receipts and chain-board state. The detail worth borrowing: pending transactions are saved before broadcast, so a restart or retry reuses the exact signed bytes instead of silently discarding a result a player just earned.
Hackathon Experience
Our team spanned three universities and two Penn State campuses: Farhan Mir (Rutgers New Brunswick), Nareh Avagyan (UMBC), Wilf Lin (Penn State University Park), and me, Evangeline Juliet John Francis Kennedy (Penn State Brandywine).
Documenting the project meant following one idea through very different systems. The dependency graph had to explain the boss. The Genesis reveal had to match the actual kit. The result screen had to describe what the server recorded. My takeaway is that the connections between features deserve as much attention as the features.
Three fixes worth stealing
Wait for real sensor readings. Phone motion access can be approved while no readings arrive. The controller waits for real readings and handles lost streams, and the server expires stale controls after 300 ms, so a disconnected phone cannot leave a fighter running forever.
Restore current state on reconnect. Combat simulates at 30 Hz, and WebSocket snapshots go out at 20 Hz. A reconnecting client receives the current state without replaying old combat events, and the server alone decides outcomes on every display.
A victory animation needs something to animate. In XR, the boss's dissolve had to begin while its visual data still existed, or the celebration could target a character that had already vanished. The fix tied the animation to the death sequence and kept the last visible appearance as a fallback.
Each fix taught the same lesson: a feature includes its timing, its recovery path, and its behavior when something goes wrong.
What comes next
Our core feature scope is complete, with a deployed browser game and production foundations including persistent results, health checks, and rollback. The next validation steps are broader physical-device coverage, longer load tests, rehearsing backup recovery, and feedback from real classrooms.
We built with AI-assisted tools including Cursor, Grok Bot, Claude Code, and Codex, with Vitest and Playwright supporting verification.
Every codebase fights back eventually. We wanted that fight to be something people could play together and learn from.
Which open-source repository would you turn into a boss, and what would its signature attack be?
Top comments (1)
Eureka! This is a great project for HackPSU, what a vibrant group of little entrepreneurs you are.