Outcome

Makes the PHP and full OpenCode images able to consume the public JoomEngine MCP for Joomla package through a local, bounded stdio integration.

What changed

• adds joomla-mcp as a manifest-owned composable capability for the php and full images only;
• pins and verifies @joomengine/joomla-mcp@0.7.0, with the JoomEngine repository and inspected commit recorded in the source lock;
• installs stable stdio, authenticated-HTTP, live-test, and configuration-check wrappers while keeping Joomla disabled and unconfigured in every published image;
• adds occtl joomla-configure for one fixed HTTPS Joomla origin with explicit readonly, content, admin, and full profiles;
• defaults to read-only, disables indefinite grants, and requires a separately scoped Joomla Update token for the full profile;
• extends the existing systemd credential path with Joomla site, approval, and update credentials without placing secret values in images, OpenCode JSON, Joomla site files, or Incus process arguments;
• rejects unsafe runtime files, unknown or duplicate credential keys, malformed lines, missing values, and approval secrets shorter than 32 characters;
• adds occtl joomla-test, which runs the upstream non-mutating read profile over Joomla API + local stdio and retains redacted evidence in the workspace;
• verifies the exact package version, wrappers, disabled OpenCode entry, read-only example, absent active site configuration, and sanitized build state during image verification;
• updates the platform to 0.3.0-rc.2 and replaces the stale deferred-repository documentation with the operational deployment and security model.

Security boundaries

The normal image path opens no inbound MCP port and requires no MCP HTTP bearer token or JWKS service. It accepts only a fixed HTTPS Joomla origin and a configured alias. Joomla Web Services plugins, the dedicated API user's permissions, Joomla ACL, enabled toolsets, bounded grants, plans, and one-time apply tokens remain independent controls.

The ready connected policy supports public HTTPS Joomla origins while rejecting private, management, metadata, link-local, and carrier-grade NAT ranges. Private Joomla sites require an approved brokered/restricted path or an explicitly acknowledged lab environment; this change does not weaken the shared ACL.

Validation completed

• Bash syntax for all changed shell files;
• JSON and YAML parsing;
• manifest generation and generated-profile drift checks;
• GitHub/Gitea matrix parity;
• Joomla capability/package/source-lock assertions;
• all four Joomla configuration profiles through mocked Incus;
• HTTPS and unsafe-origin rejection;
• runtime credential ownership, mode, symlink, hard-link, duplicate, unknown-key, and minimum-secret-length checks;
• secret-not-in-Incus-arguments regression test;
• static security and manifest unit tests.

The GitHub validation workflow remains the authoritative ShellCheck/yamllint run.

Deliberate promotion gates

This change does not claim that static tests produce a certified VM image or that every upstream Joomla action family is production-certified. Promotion still requires:

1. real php and full builds on the trusted KVM/Incus builder;
2. package export, verification, and import on a second clean host;
3. the included live read evidence against the intended Joomla 6.x target;
4. denied-operation evidence with an under-privileged Joomla identity;
5. the upstream mutation and recovery matrix only against an explicitly disposable Joomla site;
6. review of upstream coverage/recovery gates for every enabled write or administration family.