Excluded to reduce gameability
#transparency #DSA #algorithms #POPIA #OnyxAudit
The announcement
On 13 August 2026, X announced it was open-sourcing "the code that affects a post's visibility in the For You timeline," alongside an Under the Hood page letting some users see which visibility-limiting labels have been applied to them. The account said the company was "committed to setting a new standard for transparency." Elon Musk added that "in making X open source, we are actively seeking criticism to improve fairness and quality of algorithmic recommendations."
So I read the code rather than the summary of it. That distinction matters here, because the summary circulating most widely was written by Grok Bot, labelled "Made with AI," and covers 370,523 lines that almost nobody will open.
What is in the repository
In grox/flows/reply_spam/ there is a complete pipeline for detecting and acting on coordinated reply spam. A classifier receives a reply thread, a language model returns candidate spam posts, several deterministic checks then either confirm or discard the result, and a surviving detection causes two things: the reply's ranking score is set to 0.0, and a safety label is applied.
The label is SafetyLabelType.RiskyHighVizReply. That label feeds the visibility filtering the announcement is about.
The architecture is more careful than I expected. The model does not have the last word. If the newest reply is not among the flagged posts, the whole result is thrown away. If the thread's root author has already replied to that account, the detection is vetoed. If the model flags exactly one post, a singleton check discards it. That is a language model proposing candidates and deterministic code deciding, which is the right way round.
The sentence
prompts.py is about thirty lines. It builds a Jinja environment, points at a templates directory, and exposes functions that render the system prompts, including coordinated_spam_system_prompt().
The templates are not there. The source says why: they are excluded from the open-source repository to reduce gameability of the system.
That is X's own code, on the day X announced it was open-sourcing the code that affects a post's visibility, saying that the instructions driving the classifier which produces a visibility-limiting label have been withheld.
To be precise about what this is and is not: I recovered the interface and the execution path, not the prompt. Anyone reading this as a leak has misread it. The finding is the documented absence and the stated reason for it.
The exemptions
This is the part I think matters more, and I have not seen it reported anywhere.
Coordinated spam detection does not run against everyone. Before the classifier is invoked, an eligibility filter rejects candidates on several grounds, each with a named reason in the code.
If the thread's root author has fewer than 1,000 followers, the candidate is rejected as low_blast_radius. The constant is FOLLOWER_COUNT_THRESHOLD_FOR_SPAM_DETECTION = 1000.
If the thread is less than two levels deep, it is rejected as one_level_deep.
If the replying account has high_page_rank_v2 or grey_badge set, it is skipped as high_page_rank_or_grey_badge.
Replies from Grok and Gork are excluded outright.
Read that back. Reply spam under posts by accounts with fewer than a thousand followers is not policed by this system at all. Accounts with high internal reputation scores are exempt from being labelled. So are grey-badge accounts, which per X's own help pages denote government institutions, officials and multilateral organisations.
Nothing here is hidden. It is all in the released code, which is the point of releasing it. But a follower threshold and a government-account exemption are policy decisions rather than engineering ones, and they were not in the announcement.
What the law actually requires
I expected the European angle to be straightforward and it is not.
Under the Digital Services Act, X is a designated Very Large Online Platform. Article 17 is clear that visibility reduction counts as a restriction requiring a statement of reasons; recital 55 names demotion in ranking and shadow banning explicitly. Article 27 requires the "main parameters" of a recommender system in plain language. Article 15(1)(e) requires a qualitative description of automated moderation tools plus accuracy and error-rate indicators.
None of those require prompts, model weights or source code.
So the honest finding is not that X has broken the DSA by withholding the templates. It has not. The obligations never reached that far. But there is also no gameability exemption in the transparency provisions to rely on. The nearest thing, in Article 40(5)(b), concerns researcher data access and permits a platform to seek amendment of a request that would create significant security vulnerabilities. It does not travel to Article 17 or Article 27.
The exclusion is lawful because nothing demanded the prompts. It is not lawful because a circumvention exemption authorised it. Those are different things, and the second is what the phrasing implies.
That gap is between X and its own claim, not between X and the regulation.
The weights
One more thing, from the README rather than the announcement. The repository states that every hand-engineered feature and most heuristics have been removed, and that a Grok-based transformer does the ranking.
If that is accurate, reading the code tells you the architecture and not the outcome. Why a given post ranked where it did lives in the model weights. What shipped is a mini Phoenix checkpoint of a few transformer layers at roughly three gigabytes, and the repository's own documentation says production uses a larger model with more layers and wider embeddings, without saying how much larger.
Runnable code and a demonstration checkpoint is real progress on inspectability. It is not the same as being able to determine what will be shown to a user, which was the test Musk himself proposed in 2023.
The part that applies here
A user in the European Union whose reply is scored zero and labelled has, in principle, a right to a statement of reasons under Article 17, a regulator currently investigating X's recommender systems, and a researcher access regime being built under Article 40.
A South African user has none of that.
POPIA section 71 restricts automated decisions with legal consequences or a substantial effect on the data subject. A suppressed reply almost certainly does not meet that bar. There is no local equivalent of Article 27, no statement of reasons, no researcher access. The Competition Commission's Media and Digital Platforms Market Inquiry examined algorithmic distribution and reported in November 2025, but it is a competition instrument and creates no individual right to know why your post was buried. -Look out for my part two (illustrated)
Same code. Same label. Same account. Whether you can ask why depends on which country you opened the app in.
==================================================================================================== ONYX DIGITAL INTELLIGENCE | TECHNICAL MEMORANDUM MATRIX REF: ONYX-AUD-2026-XALGO | SUBJECT: Algorithmic Recourse & Classifier Opacity Gaps ====================================================================================================[ TECHNICAL TRIGGER: grox/flows/reply_spam/ ] -> Raw Thread -> Classifier Prompt (WITHHELD) -> Score: 0.0 + RiskyHighVizReply -> System Bypasses: Grey Badge (Gov/NGO) | Follower Threshold (<1000) | Platform Bots
JURISDICTIONAL RECOURSE & DISCOVERY MATRIX
REGION STATUTORY FRAMEWORK USER DISCOVERY RIGHT INSTITUTIONAL / STATE ACCESS
European Union EU DSA (Reg 2022/2065) MANDATORY (Art. 17) ARTICLE 40 RESEARCH ACCESS Articles 15, 17, 27 Statement of Reasons API access via DSC mandate
United States 47 U.S.C. Section 230 NONE ZERO MANDATE First Amendment Juris. Platform discretion rule Subpoena / FTC action only
United Kingdom Online Safety Act 2023 NONE OFCOM REGULATORY POWERS (OSA Framework) Safety metric focus only Systemic audit (no prompts)
South Africa POPIA Act 4 of 2013 BAR NOT MET STATE SECURITY / CYBERCRIME Section 71 & MDPMI No substantial effect Interpol/Law Enf. priority
China CAC Algorithmic Regs ZERO CAC ALGORITHM REGISTRATION Consumer Governance Consumer opacity total Direct code/model registry
Israel / ME Defense & Info-Ops NONE STATE COUNTER-IO DIRECTIVES Geopolitical Directives Operational secrecy Active threat mitigation
LEGAL TAKEAWAY: The 'gameability' justification shields classifier prompts worldwide. However, legal standing to compel an explanation exists exclusively within the EU DSA framework. In all other jurisdictions, algorithmic demotion is legally unchallengeable by the individual.
Method and limitations
I read the repository directly at github.com/xai-org/x-algorithm. The findings above are from the source in grox/flows/reply_spam/ and from the repository README.
I did not recover the prompt templates. I recovered the loader, the function names and the stated reason for their absence.
The classifier references a Gemma-family model constant and is called through an OpenAI-compatible sampler interface. An OpenAI-compatible interface is not evidence of OpenAI; many inference servers expose one. I am not able to state from the code alone which model actually runs in production.
I have not independently verified that the released code path matches production behaviour, and without production weights nobody outside X can.
Repository contents change. Findings reflect the repository as read on 14 August 2026 and should be checked against a pinned commit before being relied upon.
Legal analysis here is my reading of the DSA text and is not legal advice.
Sources
xai-org/x-algorithm: https://github.com/xai-org/x-algorithm
@XOpenSource announcement, 13 August 2026
Regulation (EU) 2022/2065, Articles 15, 17, 24, 27, 40 and recitals 55, 66, 70, 97: https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng
European Commission, first DSA non-compliance decision against X, 5 December 2025
X Help Centre, grey checkmark: https://help.x.com/en/using-x/grey-checkmark
Protection of Personal Information Act 4 of 2013, section 71
Competition Commission, Media and Digital Platforms Market Inquiry final report, November 2025
Clayton Bax
Published under ONYX Digital Intelligence Following the #OnyxAudit methodology.
- X: @onyxaudit
- Email: onyxdigitalintelligence85@protonmail.com
- https://github.com/Baximus855
- @Onyx_Digital@mastodon.social
"Adjacent to true is not true."
Truth has no flag nor favour, only a standard. And it's heavy