ADR-023 — Tenant Restructure Decision

Context

ADR-022 documented the mechanical filesystem sweep — orphans, broken refs, PHANTOM daemons. After completion CEO observed that the home tree, while mechanically clean, remained semantically misorganized:

"Zelim da sam ponosan file strukture, a ne da sam zabrinut."
"alai.no/ucenje" — Alem's personal Quran-19 scholarly site lives inside the ALAI commercial brand tree.

A 6-agent multi-perspective audit (Petter / Brad / Parisa / Lexicon / Kelsey / Skybound) produced ~84 findings, ~22 convergent across 3+ angles. The unanimous top finding: personal scholarly content under commercial brand surface = brand contamination + GDPR exposure + blocks divestment.

Beyond ucenje, the audit surfaced:

• BasicConsulting AS treated as separate legal entity in tree (vedtekter, share register expectations) when in fact it is a domain only owned by ALAI Holding AS (CEO clarified post-audit)
• ALAI-Tech-DOO is a real legal subsidiary (RS d.o.o., Bosnia/Serbia distribution of Bilko/Tok/Drop) but lived under ~/companies/ mixed with agent personas
• 12 agent personas (CodeCraft, Vizu, FlowForge, etc.) mislabeled as "companies" in ~/companies/
• Client work scattered across ~/projects/ mixed with ALAI internal engineering
• CEO personal data (CV 19×, NAV records, employment-verification PII) scattered across business trees
• ~/Public/ containing CEO PII (employment-verification, ownership cert, firmaattest) — local-network readable
• Lumiscare client .env files committed to git history (auth bypass flags)
• Planka .env at 644 perms; Snowit terraform.tfstate one accidental git add . from leak

Decision

Implement multi-tenant home tree with strict isolation per legal entity / personal scope / client scope:

~/business/                # legal entities (ALAI corporate group)
├── ALAI-Holding-AS/      # commercial parent (renamed from ~/ALAI/)
└── ALAI-Tech-DOO/        # RS d.o.o. subsidiary

~/personal/                # CEO natural-person scope (NEW)

~/clients-external/        # one canonical subdir per client (NEW)

~/system/                  # orchestration runtime
└── agents/personas/      # agent persona definitions (12)

~/projects/                # ALAI internal engineering repos ONLY (8 entries, was 23)

Backward compatibility:

• ~/ALAI symlinked to ~/business/ALAI-Holding-AS/ for 158 LaunchAgent paths grace period
• ~/companies symlinked to ~/system/agents/personas/ for 10+ daemon/tool refs grace period

Sub-decisions

Consequences

Positive

• 13 named clients in ~/clients-external/ (one tenant per subdir, no cross-contamination)
• 9 ALAI products in ~/business/ALAI-Holding-AS/products/ (no client-as-product misclassifications)
• 12 agent personas in ~/system/agents/personas/ (correct semantic home; no longer "companies")
• 2 legal entities under ~/business/ (Holding AS + Tech DOO; no third entity confusion)
• CEO personal scope isolated under ~/personal/ (cv, nav, scholarly, code, real-estate, legal-personal)
• ~/projects/ narrowed from 23 → 8 entries (ALAI internal engineering only)
• ucenje brand contamination resolved (ucenje.alai.no separate, alai.no/ucenje 301)
• 26 GB freed (ollama.tar.gz cleanup) + 16 GB freed (test scaffolds + companies archive)
• ~/Public PII quarantined to ~/personal/legal-personal/ (5 sensitive PDFs no longer local-network readable)
• ~/companies/ completely removed (anti-pattern eliminated)

Negative

• 158 LaunchAgent paths still resolve via ~/ALAI symlink (TD: rewrite to canonical, ≥30d grace)
• 10+ tool/daemon refs to ~/companies/ resolve via symlink (TD: same grace, lower priority)
• _legacy-bc-2026-05-07/ content from BasicConsulting unwind required manual reconciliation into clients/Entur/ and clients/RPG/ (DONE, but added one-time manual step)
• 19 CV references across grant submissions remain in place (each is a submission artifact, not a duplicate to dedup)
• Some opaque-name decisions deferred (internal/ left as-is — well-organized but generic name)

Neutral

• Boot health unchanged (29/29 daemons loaded, 0 failing, before and after)
• Git histories preserved (used git mv for in-repo moves, plain mv for cross-repo)
• ALAI-Tech-DOO retains its own git repo and .alai/ orchestration metadata

Alternatives Considered

Implementation

References

• Multi-perspective audit: ~/system/specs/anvil-organizational-audit-2026-05-07.md
• Sub-agent reports: /tmp/anvil-org-audit/01-petter*.md … 06-skybound*.md
• Mechanical sweep ADR: ~/system/architecture/decisions/ADR-022-anvil-fs-sweep-2026-05-07.md
• Canonical registry: ~/system/specs/canonical-registry.md (post-D updates)
• Tree blueprint (NEW): ~/system/specs/anvil-tree-blueprint-2026-05-07.md
• Git structure rules (NEW): ~/system/specs/anvil-git-structure-2026-05-07.md
• Memory entries: project_alai_entity_identity_clarified_2026-05-07.md, project_anvil_phase_d_done_2026-05-07.md
• MC chain: #99710 (org audit parent), #99742 (Phase B.1), #99744 (Phase B.2), #99722 (Brønnøysund — closed), #99723 (BC clarification — pending close), #99724 (Lumiscare notification), #99725 (Telegram revoke)
• Live deployment: https://ucenje.alai.no, https://github.com/johnatbasicas/ucenje