A Client-Side, Browser-Native Pipeline for Liveness-Gated Facial Verification and Geofenced Attendance in a Government Internship Setting: Multi-Signal Passive Fusion, Server-Side Verification, and a Post-Defense Security Hardening Case Study

This paper is a post-defense revision of a Design Science Research (DSR) study on a browser-native, client-side, layered verification pipeline built as an individual contribution within a larger Capstone attendance-monitoring system for the Directorate General of Customs and Excise (DJBC), Indonesia. The first-revision system paired a single Eye-Aspect-Ratio (EAR) blink gate with a client-side descriptor scan; during the oral defense on 2026-08-08, a printed photograph, physically held up to the panel's own laptop, defeated that gate on both the Login and Attendance screens live in the room. This revision reports the resulting Refine iteration of the DSR cycle: a majority-vote fusion of seven independent passive liveness signals (border-uniformity, pixel micro-motion, color-domain skin plausibility, texture edge-energy, device/photo-edge detection, hand-region skin fraction, and remote photoplethysmography pulse), two mandatory active checks (frame-to-frame box motion and a two-step, randomly-ordered blink/smile/mouth-open challenge), hard anti-automation and virtual-camera gates, multi-angle multi-template enrollment, and a move of descriptor matching at login from an in-browser candidate-pool scan to a server-side Supabase Edge Function gated by a single-use, time-boxed nonce. Functional, simulation-based, and adversarial (red-team) testing exercised every new decision branch, including six concrete presentation- and injection-attack attempts against the hardened pipeline; five of six were blocked outright and the sixth (a hand-wobbled printed photo) required, and received, a second, independently-timed hardening pass before being closed. These results indicate that a purely client-side, multi-signal liveness architecture can close a real, observed spoofing gap without adopting a commercial cloud liveness API, while an explicit case study of the pipeline's own post-defense failure and repair — rather than a claim of a flawless first design — is offered as the paper's primary methodological contribution, alongside the closed engineering gaps (candidate-pool download, single-template enrollment fragility) identified as future work in the first revision.