Turing's Last Cipher — decrypt a message no one ever actually wrote

This is a submission for the June Solstice Game Jam

What I built

Turing's Last Cipher is a text-based cipher/puzzle adventure. A plain envelope arrives,

postmarked June 21st, full of jumbled letters and one typed line: "For whoever still cares to

listen. — A.T." Your terminal blinks awake, an AI assistant introduces itself, and together

you start decrypting what Alan Turing supposedly never finished saying.

You solve real ciphers — Caesar, Atbash, Vigenère, a dial-it-yourself Enigma — across four

chapters. But the assistant helping you is not as steady as it first seems. Its hints get

slippery. It starts to mislead. And by the end you learn why: these messages were never

written by Turing. They were generated by a modern AI reconstructing him. The closing

question mirrors the Turing Test in reverse — if an AI can reproduce every thought of a person,

is it that person?

▶ Play it now (Cloud Run): https://turings-last-cipher-336966558985.us-central1.run.app

Source (MIT): https://github.com/gpiwonka/turings-last-cipher

[https://youtu.be/vWUti1cqmK4]

The four chapters

1. 
   Classical ciphers — Caesar → Atbash → Vigenère. The assistant is honest and genuinely
   helpful. You learn to trust it.


2. 
   Enigma-lite — solved with an in-game Enigma you actually dial: historical rotor wirings,
   reflector, plugboard, ring settings. The secret ring settings stay on the server; you find
   the rotor start positions yourself.


3. 
   Trust erosion — a substitution puzzle where the assistant starts steering you wrong. The
   game never lets a lie make a puzzle unsolvable — a deterministic path to the answer always
   remains — but you stop taking its word for things.


4. 
   The twist ending — and the question it leaves you with.

Categories I'm claiming

🏳️‍🌈 Overall / Best Ode to Alan Turing. Turing isn't set dressing here — he's in both the

mechanics and the narrative. You break the same families of ciphers he worked with, you

operate an Enigma, and the entire story is an argument about the Turing Test. I tried to handle

his biography — the persecution, the conviction, the loss — with dignity, because that grief is

the emotional core of the ending, not a gimmick.

🤖 Best Google AI Usage. The in-game assistant's hints and dialogue are rendered live by the

Gemini API (gemini-2.5-flash), and the whole thing is deployed on Google Cloud Run.

The interesting part is how the AI is used — see below.

How the AI is used (and how it is deliberately constrained)

The twist of the game is an unreliable AI, so the engineering question was: how do you let a

language model voice an untrustworthy narrator without letting it break the puzzle?

My rule was a hard separation between truth and wording:

• 
  Ciphers are deterministic C#. The LLM never performs crypto. Encryption, decryption, and
  answer-checking live in a pure, fully unit-tested Core library. LLMs corrupt
  character-level crypto, so they're simply not allowed near it.


• 
  Truth lives in code, never in the model. Every puzzle has a known plaintext; a
  deterministic oracle is the only authority on whether you solved it.


• 
  The "unreliable AI" is scripted game logic. The server decides, per scene, whether the
  assistant is Truthful, Misleading, or Withholding (trust erodes chapter by chapter). Gemini
  only phrases the line under that policy.


• 
  The prompt never contains the plaintext. It gets the cipher name, the genuine hint, and
  the policy — so a rendered hint can't leak the answer, and a misleading hint can't block
  you (the cipher plus a frequency-analysis tool always give a path through).


• 
  The API key never reaches the client, and if Gemini is unavailable the game falls back to
  static per-policy text — so it's fully playable offline, which matters when judges have
  flaky networks.

So Gemini does exactly what a language model is good at (voice, flavor, character) and nothing

it's bad at (being the source of truth).

How it's made

• 
  Blazor WebAssembly client + ASP.NET Core (.NET 9) Minimal API, in a single
  container. The API hosts the WASM client and exposes /api/*. Blazor WASM (not Server)
  was deliberate — it avoids a persistent SignalR circuit, which is fragile on Cloud Run's
  scale-to-zero.


• 
  Stateless server. The client tracks the current scene id; the server is the authority for
  solution checking and never sends plaintext to the client.


• 
  Content-driven story graph (content/scenes/story.json) with a startup validator that
  catches dangling links and unsolvable puzzles before shipping.


• 
  Deployed to Google Cloud Run from a multi-stage Dockerfile; the server honors the
  injected PORT.

Disclosure

• Built from scratch during the jam. No prior game code reused.


• 
  AI-assisted development: I used Claude Code as a pair programmer for scaffolding,
  infrastructure, and review. All design decisions and the cipher/oracle invariants are my own.


• 
  Gemini generates only in-game wording (assistant hints and dialogue) — never puzzle
  state, gates, or correctness. Any flavor text baked into the story was finalized and stored
  before encryption, never generated live.


• Licensed MIT.

Reflection

The thing I'm proudest of is that the unreliable-narrator twist is also the architecture: the

game is, at every level, about an AI that can sound exactly like a trustworthy source while not

being one — and the code is built so that the model is allowed to sound like anything while

the truth stays provably elsewhere. That separation is the whole point of the Turing Test, and

it turned out to be the whole point of the build too.

Thanks for reading — and for playing. Decrypt carefully.