ONE-SYSTEM M3.2.8 — GLOBAL USERNAME IDENTITY & AUTHENTICATION REGRESSION GATE
READ-ONLY — NO DATA OR SCHEMA MODIFICATION
==========================================================================

[1] RUNTIME / DATABASE
PHP 8.2+ runtime                                              PASS — 8.2.33
Database connection                                           PASS
Current database                                              PASS — amiga723_one_system_vnext_v02

[2] GLOBAL USERNAME DATABASE CONTRACT
Table core_users                                              PASS
Table core_tenants                                            PASS
Table core_auth_sessions                                      PASS
Table core_auth_login_attempts                                PASS
core_users.id                                                 PASS
core_users.tenant_id                                          PASS
core_users.username                                           PASS
core_users.password_hash                                      PASS
core_users.status                                             PASS
Global UNIQUE uq_user_username                                PASS — username
Username cardinality                                          PASS — users=0, distinct=0, null=0
No duplicate/null usernames                                   PASS
Duplicate username query                                      PASS — 0 rows

[3] AUTHSERVICE IDENTITY CONTRACT
AuthService username lookup                                   PASS
AuthService LIMIT 1 identity                                  PASS
AuthService does not require tenant input                     PASS
AuthService records tenant after identity resolution          PASS
AuthService creates tenant-bound session                      PASS
AuthService avoids legacy login_attempts.user_id              PASS
AuthService avoids legacy login_attempts.created_at           PASS

[4] SESSION BOUNDARY CONTRACT
Session create requires tenant                                PASS
Session stores user_id                                        PASS
Session stores tenant_id                                      PASS
Session validates ACTIVE user                                 PASS
Session validates user/tenant consistency                     PASS
Session checks expiry/revocation                              PASS
Session cookie is HttpOnly                                    PASS
Session cookie is SameSite Lax                                PASS

[5] AUTHORIZATION / TENANT ISOLATION CONTRACT
Authorization default-deny empty input                        PASS
Authorization role tenant match                               PASS
Authorization active user required                            PASS
Authorization active role required                            PASS
Authorization active module required                          PASS
Authorization uses module_code                                PASS
Authorization avoids legacy module_id                         PASS

[6] LIVE USER INTEGRATION PRECONDITION
Real login success test                                       SKIP — core_users is empty; no test identity exists. No fixture is created because this gate is read-only.
Wrong-password integration test                               SKIP — No live test identity.
Inactive-user integration test                                SKIP — No live test identity.
Cross-tenant identity test                                    SKIP — No live identities.

[7] FINAL GATE
STATUS: PASS
M3.2.8 global username identity and authentication contract is clean.

SKIPS:
- Real login success test: core_users is empty; no test identity exists. No fixture is created because this gate is read-only.
- Wrong-password integration test: No live test identity.
- Inactive-user integration test: No live test identity.
- Cross-tenant identity test: No live identities.

NO DATA OR SCHEMA WAS MODIFIED.
DELETE THIS TEST FILE AFTER THE GATE IS RECORDED.