Copy this PIN from the first box to the second. Type it or paste it, either is fine. The gate does not care what the digits are; it already knows them. It cares where they came from.
A CAPTCHA asks a question the server cannot answer. This gate asks one it already can. The PIN is SHA-256(challenge ‖ "pin") reduced to six digits, so the server knows the answer before the page loads, and a correct answer proves nothing by itself. What the gate scores is the provenance of the six characters in the second box.
keydown, beforeinput, input and paste events. A typed character is an insertText preceded by a key within 60 ms. A pasted run is an insertFromPaste whose clipboard text matches. A drop is insertFromDrop. Backspaces are corrections and count as evidence. The value at check time must equal the value the last input event left behind; a value that changed without an event was set by a script.isTrusted is false on anything dispatched from JavaScript. A synthetic keystroke is rejected, not merely scored.copy event on the first box before a paste is the clipboard round trip a person makes, and counts as evidence.A driven browser. Keyboard automation with a randomised delay produces trusted events at whatever cadence the operator chooses, and that is the "driven browser" simulation with jitter, which passes. The gate stops scripts that fill forms by setting values, scripts that dispatch events, and anything that moves faster than reading. What remains is priced by the proof of work behind it and recognised by the fleet statistics in front of it.
Text in, text out. It works with a screen reader, a braille display, a keyboard alone, voice input, and a paste. Of the human-interaction gates on this site, it is the one that fits the linux.farm prime directive.