# Phase 1 — Install & verify

Run on the server (PHP 8.3, Composer, Node all present).

## 1. Create the project from the official React starter kit
```bash
composer global require laravel/installer
laravel new bi-platform            # choose: React starter kit, Pest for tests
cd bi-platform
```
This gives you Fortify auth (login, register, email verification, password reset,
2FA), Inertia v2 + React 19 + TypeScript + Tailwind + shadcn/ui, and the sidebar
layout — the app shell and auth from spec §4–§6 are already in place.

## 2. Overlay the Phase 1 files
Copy the contents of this package over the project root, preserving paths:
```bash
cp -R phase1-foundation/app/*        ./app/
cp -R phase1-foundation/database/*   ./database/
cp -R phase1-foundation/resources/*  ./resources/
cp -R phase1-foundation/tests/*      ./tests/
# routes/web.php: MERGE (don't overwrite) — see the file's header comment
```
Add the demo seeder call to `database/seeders/DatabaseSeeder.php`:
```php
$this->call(\Database\Seeders\DemoTenantSeeder::class);
```

## 3. Apply the wiring edits
Follow `docs/WIRING.md` (5 short edits).

## 4. Configure MySQL + run
```bash
# set DB_* in .env for your MySQL 8 database
php artisan migrate:fresh --seed
npm install && npm run build      # or: npm run dev
```

## 5. Verify the release gate
```bash
php artisan test --filter=TenantIsolationTest
php artisan test --filter=RbacTest
php artisan test --filter=AuditTest
```
All three must pass before Phase 2 begins. TenantIsolationTest is the §19 gate:
it proves reads, writes, id-lookups, cache keys, and the escape hatch all respect
org boundaries.

## Demo logins (from DemoTenantSeeder)
- Acme:   `owner@acme.test` / `password`
- Globex: `owner@globex.test` / `password`