Complete native Joomla MCP component with JCB execution and installed acceptance

[Llewellynvdm]

Why

Move the supported TypeScript Joomla MCP server capabilities into an installable PHP component that uses Joomla's native API authentication, ACL, administrator models and console services. Keep the console adapter and generic remote client independently packaged.

Implemented

• Database-backed tools, resources, prompts, schemas and actions with native administrator management, assets and customization-preserving upgrades.
• Authenticated HTTP and trusted local console tracks; explicit grants, immutable plans, idempotency, read-back, audit and recovery.
• Actual installed JCB registration discovery, plugin-aware availability, useful redacted approval previews, isolated execution, owned background jobs and private hash-verified artifacts.
• Native package get/init/pull/push/reset and compiler workflows, including local extension installation and generic remote HTTPS-client execution.
• Dependency-inclusive standalone/combined Joomla ZIPs, deterministic packaging and gated release/update metadata.
• Correct installed-provider permission schemas, bounded Joomla validation feedback and stdio frame limits.

The console plugin and PHP/Docker Compose client remain separate. The component's final workflows pin their reviewed revisions.

Validation

The completion checklist records exact commits, complete evidence and final readiness.

Required final-head workflows:

• PHP 8.3/8.4 contracts and reproducible source/seed checks
• Installed Joomla: PHP 8.3/8.4 × MySQL/PostgreSQL, with plugin and HTTPS client
• Full JoomEngine/JCB native and remote acceptance

The complete runtime baseline already passed 299 CLI JCB checks, 288 remote checks, 30 package-roundtrip checks on each track, 17 worker/recovery checks and the full install/upgrade/uninstall lifecycle. Each compiler track generated and downloaded three verified ZIPs; CLI also installed all three.

Explicit boundaries

The tested JCB distribution registers 111 executable commands and zero native JCB API routes. Router contract tests are not presented as live JCB entity API CRUD. Native file/folder reset indexes missing destination metadata remain an upstream limitation and produce incomplete read-back results.

The requested image tag is octoleo/joomengine:6.1.6-php8.4-apache; its observed installed Joomla version is 6.1.3. Exact platform/source evidence is recorded in docs/IMPLEMENTATION.md.

All final-head push and pull-request checks are green. Ready for human testing and review. This work does not merge or publish a release.

[Llewellynvdm]

Component completion checklist — updated 24 September 2026

Current branch head: 64a1595, on the existing feature/jcb-mcp-runtime branch. All final-head push and pull-request workflows have passed. Component, console-plugin and client PR #1 are complete and ready for human review/testing.

• Complete concrete administrator screens: native models/tables/controllers/views, XML forms/subforms, catalogue and operational grant/execution/job/artifact screens; installed persistence, ACL, assets, revisions and cancellation.
• Complete native installation lifecycle: native access/configuration/manifest, install/update/uninstall, versioned MySQL/PostgreSQL SQL and customization preservation.
• Complete component distribution: dependency-inclusive standalone and combined ZIPs, deterministic builds, update metadata, release validation and tested native package lifecycle.
• Complete JCB API/CLI execution, package/compiler effects, jobs/artifacts/recovery: installed inventory maps all 111 registered commands as executable, with no unaccounted commands. 299 CLI checks, 288 remote HTTPS-client checks, 30 CLI package-roundtrip checks, 30 HTTPS package-roundtrip checks, and 17 real worker/database recovery checks pass. Both compiler tracks generated/downloaded three SHA-256-verified archives; CLI additionally installed and independently verified all three extensions. The native JCB API inventory is zero routes, accurately reported rather than invented. All five package families, dependencies, partial effects and reconciliation have actual execution evidence.
• Finish administrator/lifecycle verification and PHP style alignment: installed assets/revisions, upgrades, customization preservation and native PHP provenance/style are complete. Takeover fixes also cover JCB scope schemas, useful redacted signed-plan previews, disabled registration-plugin visibility, bounded native validation diagnostics and both stdio frame limits.
• Record the final-head installed acceptance and readiness: component 64a1595, console plugin fe387b9 and client 881b100 each pass every final-head push and PR workflow. The full coordinated component tests pin these final companion revisions. All three existing PRs are ready for review/testing.

Final-head acceptance (64a1595)

• PHP 8.3/8.4 contracts and source/seed checks — passed.
• All four installed PHP/database combinations, including standalone console and HTTPS client — passed.
• Complete installed JoomEngine/JCB local and remote acceptance — passed.
• Final golden-image evidence artifact.
• Console final native/package CI — passed; console final installed CI — passed.
• Client final contracts/Docker CI — passed; client final installed CI — passed.

The corresponding push workflows also all passed. The six completion objectives are checked; no implementation or CI work remains open in these PRs.

Inspected complete runtime evidence (75d9685)

• PHP 8.3/8.4 contracts and source/seed checks — passed.
• Installed Joomla core, all four PHP 8.3/8.4 × MySQL/PostgreSQL combinations — passed. Each job includes the separate console plugin and HTTPS client plus component/combined installation, upgrade and uninstall.
• Full JoomEngine/JCB acceptance — push passed and PR passed.
• Inspected golden evidence: 18 plugin checks, seven upgrade checks, 5,430 upgraded-seed checks and 23 uninstall checks, in addition to the native/remote JCB and worker results above.

Companion repositories

• Console plugin PR #1, final pin fe387b962dab605191ef18efe4d5cb94821165d9: native adapters, packaging, 18 installed assertions and finalized evidence documentation.
• PHP/Docker client PR #1, final pin 881b1006b67afc24d35d17b82cd32d16a5593a44: URL/token Compose startup, generic authenticated HTTP/stdio, 25 bridge checks, nine real Compose/TLS checks per PHP image, and installed SDK/executable interoperability. Final contracts/Docker CI passed; final installed CI passed.

Explicit evidence boundaries

The requested image tag is octoleo/joomengine:6.1.6-php8.4-apache; its observed runtime is Joomla 6.1.3, PHP 8.4.25, MariaDB 11.4.13. JCB is verified on that platform; the four-platform database matrix covers Joomla core and companions. The pinned JCB distribution has no registered entity API routes, so router contract tests are not represented as live JCB API CRUD. The inherited file/folder reset index-metadata limitation remains documented; incomplete native effects are reported as incomplete, never successful.

No merge, release publication, production deployment or Packagist registration has been performed.