Continuity, not checkpoints

verify once.
then nothing.

No puzzle. One touch binds the session to a real human. Every action after rides silently on that proof — until something looks wrong, and the secure enclave asks again. A bot can sit in the page all it wants; it dies at the re-prompt.

One touch, then silent Hash-chained receipts Re-prompt only on risk
Work session · —
checking…
·
Not verifiedBind this session to a human once to begin.
checking this device…
Signed receipt trail
No actions yet. Bind the session, then act — each action self-signs.
chain head∅ unbound
silent · rode on presence re-verified · enclave blocked · no human

Runs in your browser. The first tap triggers a real WebAuthn user-verification prompt where supported.

Why this stops bots

The test isn't the wall. The seam is.

A bot can render the page, click the buttons, even pass a one-time check. What it can't do is survive the moment the session asks the human to prove they're still there.

01 · BIND

One human, one touch

The session opens with a single secure-enclave verification (Face / fingerprint / PIN). That binds every future receipt to a key only this person, on this device, can release.

02 · RIDE

Silent after that

Low-risk actions don't re-prompt. They self-sign and chain onto the previous receipt — tamper-evident, zero friction. This is why it's simpler than a captcha: you mostly do nothing.

03 · CATCH

Re-prompt at the seam

A new device, a location jump, or a behavioral break forces a fresh enclave verification before the next action signs. A bot has no enclave and no human — the chain stops dead.

The honest boundary: this proves the same enrolled human is still driving — cheaply and continuously. It does not prove humanity to a total stranger with no device, and a rooted/emulated device can still lie at enrollment (the fix there is App Attest / Play Integrity). What it removes is the thing bots are actually good at: quietly taking over a session a human started. The cost to a real person is one touch; the cost to a bot is a human and an enrolled device it doesn't have. That ratio — high cost to fraud, near-zero cost to truth — is the whole product.