# ADR-023 — Tenant Restructure Decision

<div id="bkmrk-status%3A-accepted-202" style="padding: 12px; background: #fef3c7; border-left: 4px solid #f59e0b; margin-bottom: 20px;">**Status:** Accepted 2026-05-07</div><div id="bkmrk-cross-reference%3A-thi" style="padding: 12px; background: #dbeafe; border-left: 4px solid #3b82f6; margin-bottom: 20px;">**Cross-reference:** This follows the [ANVIL Filesystem Sweep (Mechanical)](https://docs.alai.no/books/anvil-filesystem-sweep-2026-05-07) — ADR-022. Phase D addresses organizational/tenant concerns.</div>## Context

ADR-022 documented the mechanical filesystem sweep — orphans, broken refs, PHANTOM daemons. After completion CEO observed that the home tree, while mechanically clean, remained **semantically misorganized:**

> "Zelim da sam ponosan file strukture, a ne da sam zabrinut."  
> "alai.no/ucenje" — Alem's personal Quran-19 scholarly site lives inside the ALAI commercial brand tree.

A 6-agent multi-perspective audit (Petter / Brad / Parisa / Lexicon / Kelsey / Skybound) produced ~84 findings, ~22 convergent across 3+ angles. The unanimous top finding: **personal scholarly content under commercial brand surface = brand contamination + GDPR exposure + blocks divestment**.

Beyond ucenje, the audit surfaced:

- BasicConsulting AS treated as separate legal entity in tree (vedtekter, share register expectations) when in fact it is **a domain only** owned by ALAI Holding AS (CEO clarified post-audit)
- ALAI-Tech-DOO is a **real** legal subsidiary (RS d.o.o., Bosnia/Serbia distribution of Bilko/Tok/Drop) but lived under `~/companies/` mixed with agent personas
- 12 agent personas (CodeCraft, Vizu, FlowForge, etc.) mislabeled as "companies" in `~/companies/`
- Client work scattered across `~/projects/` mixed with ALAI internal engineering
- CEO personal data (CV 19×, NAV records, employment-verification PII) scattered across business trees
- `~/Public/` containing CEO PII (employment-verification, ownership cert, firmaattest) — local-network readable
- Lumiscare client `.env` files committed to git history (auth bypass flags)
- Planka `.env` at 644 perms; Snowit terraform.tfstate one accidental `git add .` from leak

## Decision

Implement **multi-tenant home tree** with strict isolation per legal entity / personal scope / client scope:

```
~/business/                # legal entities (ALAI corporate group)
├── ALAI-Holding-AS/      # commercial parent (renamed from ~/ALAI/)
└── ALAI-Tech-DOO/        # RS d.o.o. subsidiary

~/personal/                # CEO natural-person scope (NEW)

~/clients-external/        # one canonical subdir per client (NEW)

~/system/                  # orchestration runtime
└── agents/personas/      # agent persona definitions (12)

~/projects/                # ALAI internal engineering repos ONLY (8 entries, was 23)

```

**Backward compatibility:**

- `~/ALAI` symlinked to `~/business/ALAI-Holding-AS/` for 158 LaunchAgent paths grace period
- `~/companies` symlinked to `~/system/agents/personas/` for 10+ daemon/tool refs grace period

## Sub-decisions

<table id="bkmrk-%23decisionrationaled-"><thead><tr><th>\#</th><th>Decision</th><th>Rationale</th></tr></thead><tbody><tr><td>D-1</td><td>`~/ALAI/` renamed to `~/business/ALAI-Holding-AS/`</td><td>Tenant isolation, name reflects legal entity</td></tr><tr><td>D-2</td><td>Symlink `~/ALAI` → canonical preserved</td><td>158 daemons hardcode old path; rewrite is non-urgent TD</td></tr><tr><td>D-3</td><td>`~/companies/` removed entirely</td><td>Was anti-pattern; entities → `~/business/`, personas → `~/system/agents/personas/`, brand-only domains → not a tree</td></tr><tr><td>D-4</td><td>ALAI-Tech-DOO promoted to peer entity</td><td>Real legal subsidiary per `company.json`</td></tr><tr><td>D-5</td><td>BasicConsulting NOT a tree</td><td>CEO clarified: domain only (`basicconsulting.no`), no firma. Domain assets → `~/business/ALAI-Holding-AS/brand-surfaces/basicconsulting.no/`</td></tr><tr><td>D-6</td><td>`~/personal/` created</td><td>Separation of CEO personal scope from business; GDPR purpose limitation</td></tr><tr><td>D-7</td><td>`~/clients-external/` created</td><td>Tenant isolation per client; ends `~/projects/` sprawl</td></tr><tr><td>D-8</td><td>`ucenje` extracted</td><td>Personal scholarly project moved to own repo (`johnatbasicas/ucenje`) + own subdomain (`ucenje.alai.no`); 301 redirect from `alai.no/ucenje/*`</td></tr><tr><td>D-9</td><td>Agent personas relocated</td><td>12 personas (CodeCraft / Vizu / etc.) → `~/system/agents/personas/`; symlink `~/companies` → here for tool/daemon backward compat</td></tr><tr><td>D-10</td><td>KenanHot reclassified product → client</td><td>Kenan Hot is a person (soccer player, knyhot.pro), not an ALAI product</td></tr><tr><td>D-11</td><td>FreeMyEV stub merged into client</td><td>Was duplicate (stub in products/, active in clients-external)</td></tr><tr><td>D-12</td><td>`ufs/` renamed `unified-form-service/`</td><td>Opaque acronym → descriptive; placed under products/ (deployed at forms.alai.no)</td></tr><tr><td>D-13</td><td>`architecture/` and `services/` renamed in ALAI-Holding-AS</td><td>Disambiguate from `~/system/architecture/` and `~/system/services/` (operational vs commercial) — `architecture` → `product-architecture`, `services` → `service-catalog`</td></tr></tbody></table>

## Consequences

### Positive

- 13 named clients in `~/clients-external/` (one tenant per subdir, no cross-contamination)
- 9 ALAI products in `~/business/ALAI-Holding-AS/products/` (no client-as-product misclassifications)
- 12 agent personas in `~/system/agents/personas/` (correct semantic home; no longer "companies")
- 2 legal entities under `~/business/` (Holding AS + Tech DOO; no third entity confusion)
- CEO personal scope isolated under `~/personal/` (cv, nav, scholarly, code, real-estate, legal-personal)
- `~/projects/` narrowed from 23 → 8 entries (ALAI internal engineering only)
- ucenje brand contamination resolved (ucenje.alai.no separate, alai.no/ucenje 301)
- 26 GB freed (ollama.tar.gz cleanup) + 16 GB freed (test scaffolds + companies archive)
- ~/Public PII quarantined to ~/personal/legal-personal/ (5 sensitive PDFs no longer local-network readable)
- `~/companies/` completely removed (anti-pattern eliminated)

### Negative

- 158 LaunchAgent paths still resolve via `~/ALAI` symlink (TD: rewrite to canonical, ≥30d grace)
- 10+ tool/daemon refs to `~/companies/` resolve via symlink (TD: same grace, lower priority)
- `_legacy-bc-2026-05-07/` content from BasicConsulting unwind required manual reconciliation into `clients/Entur/` and `clients/RPG/` (DONE, but added one-time manual step)
- 19 CV references across grant submissions remain in place (each is a submission artifact, not a duplicate to dedup)
- Some opaque-name decisions deferred (`internal/` left as-is — well-organized but generic name)

### Neutral

- Boot health unchanged (29/29 daemons loaded, 0 failing, before and after)
- Git histories preserved (used `git mv` for in-repo moves, plain `mv` for cross-repo)
- ALAI-Tech-DOO retains its own git repo and `.alai/` orchestration metadata

## Alternatives Considered

<table id="bkmrk-alternativewhy-rejec"><thead><tr><th>Alternative</th><th>Why rejected</th></tr></thead><tbody><tr><td>Status quo (semantic chaos accepted)</td><td>CEO explicit "zelim da sam ponosan, ne zabrinut" + Lexicon legal exposure findings</td></tr><tr><td>Storage-only deeper sweep (no rename)</td><td>ucenje brand contamination is structural, not storage</td></tr><tr><td>`~/tenants/` umbrella with per-tenant subdir</td><td>Equivalent to chosen `~/business/` + `~/personal/` + `~/clients-external/`, but less natural-language for CEO solo founder</td></tr><tr><td>Hard rewrite of all LaunchAgent paths in same operation</td><td>High risk; symlink grace period is industry-standard</td></tr><tr><td>Move ucenje to `broj19.com` (own domain, $12/year)</td><td>Subdomain `ucenje.alai.no` is sufficient (CEO Decision #1B); domain purchase deferred</td></tr><tr><td>Keep BasicConsulting as separate entity tree</td><td>CEO clarified there is no separate firma; would create maintenance burden for non-existent legal entity</td></tr></tbody></table>

## Implementation

<table id="bkmrk-wavescoperesultw1-a-"><thead><tr><th>Wave</th><th>Scope</th><th>Result</th></tr></thead><tbody><tr><td>W1-A (BLOCKER)</td><td>Unload 3 PHANTOM daemons (mlx-router, db-ttl-sweep, distillation-scorer)</td><td>DONE — boot failure resolved, 56 → 53 com.alai daemons</td></tr><tr><td>W1-B (bulk cleanup)</td><td>Archive + delete 35 paths; settings.bak retention; ~/~ cleanup; ~/projects/ALAI collision</td><td>DONE — 30 valid tar archives in `~/backups/_archive/anvil-fs-sweep-2026-05-07/`, ~9GB freed</td></tr><tr><td>W1-C (split-brain)</td><td>6 active pairs merged/renamed; ~/ALAI/CLAUDE.md surgical update</td><td>DONE — agents merged, architecture/services renamed for disambiguation</td></tr><tr><td>W2 (docs)</td><td>canonical-registry.md, ADR-022, drift-detection-design.md</td><td>DONE — MC #99701</td></tr><tr><td>W3 (validation + publish)</td><td>Proveo E2E, BookStack publish</td><td>DONE — Proveo 9/10 PASS, BookStack shelf 2845</td></tr><tr><td>Phase A (org-audit quick wins)</td><td>chmod planka, gitignore tfstate, PII quarantine, ollama.tar.gz delete</td><td>DONE</td></tr><tr><td>Phase B (ucenje extract)</td><td>New repo + CF Pages + 301 redirect</td><td>DONE — ucenje.alai.no live, 301 verified</td></tr><tr><td>Phase D.1 (personal + clients-external)</td><td>Skeleton + AlemPersonal + client repo migration</td><td>DONE</td></tr><tr><td>Phase D.2 (~/ALAI rename)</td><td>Symlink-based canonical rename</td><td>DONE</td></tr><tr><td>Phase D.3 (agent personas)</td><td>12 personas → ~/system/agents/personas/</td><td>DONE</td></tr><tr><td>Phase D.4 (BasicConsulting unwind + companies removal)</td><td>Tenant cleanup + symlink for daemon backward compat</td><td>DONE</td></tr><tr><td>Phase D push-through</td><td>\_multi-client-hub split, virtual-serbia classification, \_legacy-bc reconciliation, futureProjects removal, ufs rename, KenanHot reclassification, FreeMyEV stub merge, nav-bc-residual merge</td><td>DONE</td></tr></tbody></table>

## References

- **Multi-perspective audit:** `~/system/specs/anvil-organizational-audit-2026-05-07.md`
- **Sub-agent reports:** `/tmp/anvil-org-audit/01-petter*.md` … `06-skybound*.md`
- **Mechanical sweep ADR:** `~/system/architecture/decisions/ADR-022-anvil-fs-sweep-2026-05-07.md`
- **Canonical registry:** `~/system/specs/canonical-registry.md` (post-D updates)
- **Tree blueprint (NEW):** `~/system/specs/anvil-tree-blueprint-2026-05-07.md`
- **Git structure rules (NEW):** `~/system/specs/anvil-git-structure-2026-05-07.md`
- **Memory entries:** `project_alai_entity_identity_clarified_2026-05-07.md`, `project_anvil_phase_d_done_2026-05-07.md`
- **MC chain:** #99710 (org audit parent), #99742 (Phase B.1), #99744 (Phase B.2), #99722 (Brønnøysund — closed), #99723 (BC clarification — pending close), #99724 (Lumiscare notification), #99725 (Telegram revoke)
- **Live deployment:** [https://ucenje.alai.no](https://ucenje.alai.no), [https://github.com/johnatbasicas/ucenje](https://github.com/johnatbasicas/ucenje)