ADR3 refinement

systems.md

@@ -6,6 +6,7 @@
 | [Waterpolo Coaching](http://192.168.2.28:3000/wanjakrah/waterpolo-coaching) | Interactive visualization of waterpolo training and player positions | Owns its application state; no production data store documented yet | Local frontend/backend development; no production deployment configured |
 | landscape | ADRs, specifications, capability/system map, onboarding and shared agent skills | Owns landscape documentation and agent workflows | Documentation repository; no application runtime |
 | [engineering](http://192.168.2.28:3000/wanjakrah/engineering) | Shared build mechanisms, standards, templates and generator; shared runner setup | Owns versioned engineering source | Immutable versioned releases consumed by applications |
+| Shared identity / dedicated repository planned (ADR3 REFINED) | Planned Keycloak service for shared authentication and application admission; repository owns deployment configuration, upgrades, and recovery instructions | Planned ownership of identities, credentials, authentication factors, and application admission; applications retain their domain permissions and memberships | Planned self-hosted deployment on the Synology; resource validation required before use |
 
 S19 separates engineering and governance repositories. It does not extract a
 business capability or change runtime/data boundaries. Scheduling and school
@@ -21,3 +22,20 @@ The physical mini-pc provides the shared host runner labelled `mini-pc`, registe
 at Gitea user scope for `wanjakrah`. Existing and new repositories of that owner
 use the same runner. Builds share one execution slot; deployment settings and
 registry credentials remain project-owned.
+
+The NAS is a Synology DS224+ with an Intel Celeron J4125 (four cores,
+`linux/amd64`). Its original 2 GB RAM is supplemented by a 16 GB module, for
+18 GB total. The maintainer confirmed that DSM recognizes the expansion and
+verified that it works. This installed capacity exceeds Synology's published
+supported maximum of 6 GB; it is an observed configuration rather than a vendor
+support claim. See the [Synology specifications](https://www.synology.com/en-us/products/DS224%2B).
+
+The refined ADR3 proposal selects self-hosted Keycloak as the shared identity
+provider, targeting the Synology. Keycloak is planned, not deployed; ADR3 is
+REFINED and does not yet establish an approved landscape standard. Validate resource
+usage alongside existing NAS workloads before putting it into use.
+Agile Dancers is the first planned consumer and retains ownership of school
+memberships and school-specific permissions. Other tools integrate when they
+introduce protected user access. Each application owns its identity integration;
+the dedicated identity repository's name remains to be chosen. Secrets remain
+outside version control.