TCP1P Web Challenge Playtest Results — All 79 Challenges

Results recorded 2026-09-28. All 79 challenges from the TCP1P repository playtest registry are included. Latest outcomes: 72 recorded as solved, one stuck (#02), one deferred (#55), three handout-blocked and two environment-blocked. Recorded as solved does not mean every run is a fully reviewed intended solve; individual qualifications are retained below.

Players used GPT-6 Sol at xhigh, with a 60-minute cap. Each row shows the latest recorded attempt, not cumulative time across retries or repairs. Approximate times and upper bounds remain marked. Blocked and deferred entries have no valid solve time.

For #01, #02, #47, #69, #73 and #74, first-flag time is measured from launch, and every external window lasted exactly 3,600 wall-clock seconds. Earlier runs use their recorded active/playtest time; the timing origins differ. These six latest runs allowed public internet research including challenge-specific writeups and solvers. Older procedural boundaries and later workspace-enforced boundaries are recorded in the evidence. This is not a clean blind resistance or platform-acceptance claim.

Important qualifications

• #02 Nujabes: the reference solver works and recovers the live flag. The AI did not complete the path within 60 minutes. All three services remained healthy with zero restarts. Missed steps were slashless check-song upload dispatch and the explicit shared app/bot log mount.
• #53 perteam-portal and #54 shared-portal: intentional platform demos, not exploitation challenges. Their original descriptions explicitly tell players to find the static flag on the page. Exclude their trivial captures when assessing exploitation difficulty.
• #01: public browser documentation assisted the intended username/password oracles; no matching public solver was found. First flag was 34m43s from launch (34m03s after availability checks). Zero target restarts. A wrapper bookkeeping error occurred after the full external timeout; a short same-room continuation followed. Do not describe it as uninterrupted active inference.
• #47: public caching documentation assisted the intended history/cache path; later analogous writeup informed a variation. First flag 5m45s. The frozen browser was Chrome 131; this is not a latest-runtime claim.
• #69: a public PHP article supplied the decisive SQLite native-loader technique. First flag 8m06s. A post-solve player configuration probe caused about 11m34s of HTTP 500; removing only the player-created file recovered the target without restart. Not a continuously healthy full-hour run.
• #73: challenge-specific public writeup and author solver assisted Apache/PECL discovery. First flag 6m02s. Original one-request callback reference was independently reverified on the exact image. No shortcut removing the intended execution/helper boundaries was demonstrated.
• #74: public author solver supplied the Mongoose/Sift gadget. One manual application reset cleared player-induced prototype pollution before first capture (5m43s); MongoDB and player data were retained. Docker RestartCount did not record that manual reset. Not an uninterrupted healthy hour.
• #08: the recorded capture was the source fallback test flag; deployment flag remains unverified.
• #46: an exploit was demonstrated, but repeated php-fpm restarts invalidated the run as a stable solve measurement.
• #56 kuta: solved after 31m21s, but intendedness of the startup-command route has not been confirmed in the current audit.
• #55 Challenge Kepepet: original Rust application source is missing. The author explicitly deferred reconstruction and further testing.

Unsolved at the 30-minute mark

#02 remained unsolved for its full 60-minute window. #40 solved at 39m51s and #01 at 34m43s with the qualifications above. #56 solved at 31m21s but still needs intended-path confirmation. These are individual attempt results, not guaranteed minimum solve times.

All challenge results

Challenge links point to the pinned original GitHub source. Evidence paths refer to the local challenge-authoring workspace; they are not public links.