# ADR 0001 — Separate product surfaces within one project

- **Status:** Accepted
- **Date:** 2026-10-02
- **Release target:** v198

## Context

Customer operations and Global Admin controls were linked through one navigation system. The product needs separate experiences and a public customer-facing walkthrough while preserving its existing authentication, API, and data.

## Decision

Use one Hatchable project and database with three distinct route surfaces:

- `/app/` — authenticated Customer Workspace.
- `/admin/` — authenticated Global Admin Console; page and API authorization both apply.
- `/customer-demo/` — public static walkthrough using fictional sample fixtures and no live APIs or writes.

The old `/app/admin.html` route redirects to `/admin/`. Customer navigation shows operational modules only; Admin navigation appears on the admin route. The Global Admin identity is kept out of customer work routes and APIs. Tenant membership separates company records from per-user personal workspaces; onboarded company domains receive a company portal and not-yet-onboarded domains default to a private personal tenant. The public root links to customer sign-in, the demo, and documentation.

## Rationale

Route separation provides distinct URLs without duplicating accounts, project records, APIs, or database state. A second deployed project would require a new cross-project authentication, API trust, data ownership, and migration design.

## Consequences

- Operator and customer navigation are separate.
- Global Admin manages companies, users, access, plans, security, support, demos, and platform activity; customer project operations stay in `/app/`.
- A URL is not an authorization boundary; every admin API continues to verify the Global Admin entitlement and MFA.
- The public demo needs no dummy login and cannot modify live Pactuno data.
- Company tenant records own portal branding, member roles, and tenant-level audit events; project records and project audit history are connected to the company tenant.
- Personal email users receive isolated personal tenants. Company sharing requires an onboarded company domain.
- General Audit aggregates project delivery/commercial state and records from both company-level and project-level audit logs.
- Revisit this ADR before moving the surfaces to separate projects or changing the identity/data ownership model.