# Capability and system map

| System / repository | Responsibilities | Data ownership | Deployment |
| --- | --- | --- | --- |
| [Agile Dancers](http://192.168.2.28:3000/wanjakrah/agiledancers) | Current school administration, import/export, scheduling and show planning | Owns its application PostgreSQL data | Existing frontend/backend application deployment; project-owned Compose configuration |
| [Waterpolo Coaching](http://192.168.2.28:3000/wanjakrah/waterpolo-coaching) | Interactive visualization of waterpolo training and player positions | Owns its application state; no production data store documented yet | Local frontend/backend development; no production deployment configured |
| landscape | ADRs, specifications, capability/system map, onboarding and shared agent skills | Owns landscape documentation and agent workflows | Documentation repository; no application runtime |
| [engineering](http://192.168.2.28:3000/wanjakrah/engineering) | Shared build mechanisms, standards, templates and generator; shared runner setup | Owns versioned engineering source | Immutable versioned releases consumed by applications |
| Shared identity / dedicated repository planned (ADR3 REFINED) | Planned Keycloak service for shared authentication and application admission; repository owns deployment configuration, upgrades, and recovery instructions | Planned ownership of identities, credentials, authentication factors, and application admission; applications retain their domain permissions and memberships | Planned self-hosted deployment on the Synology; resource validation required before use |

S19 separates engineering and governance repositories. It does not extract a
business capability or change runtime/data boundaries. Scheduling and school
administration remain candidates for future examination under ADR1. Any later
system extraction must specify contracts, enforced data ownership and failure
behavior before migration.

Waterpolo Coaching uses Three.js (https://threejs.org/) with TypeScript and Vite
instead of the Angular frontend used by Agile Dancers. Its npm lint, test, build
and container contracts still follow the common engineering recipe.

The physical mini-pc provides the shared host runner labelled `mini-pc`, registered
at Gitea user scope for `wanjakrah`. Existing and new repositories of that owner
use the same runner. Builds share one execution slot; deployment settings and
registry credentials remain project-owned.

The NAS is a Synology DS224+ with an Intel Celeron J4125 (four cores,
`linux/amd64`). Its original 2 GB RAM is supplemented by a 16 GB module, for
18 GB total. The maintainer confirmed that DSM recognizes the expansion and
verified that it works. This installed capacity exceeds Synology's published
supported maximum of 6 GB; it is an observed configuration rather than a vendor
support claim. See the [Synology specifications](https://www.synology.com/en-us/products/DS224%2B).

The refined ADR3 proposal selects self-hosted Keycloak as the shared identity
provider, targeting the Synology. Keycloak is planned, not deployed; ADR3 is
REFINED and does not yet establish an approved landscape standard. Validate resource
usage alongside existing NAS workloads before putting it into use.
Agile Dancers is the first planned consumer and retains ownership of school
memberships and school-specific permissions. Other tools integrate when they
introduce protected user access. Each application owns its identity integration;
the dedicated identity repository's name remains to be chosen. Secrets remain
outside version control.