[Llewellynvdm]

Adminer, browser isolation and public-image delivery

This branch adds a database workspace to the existing in-browser Joomla/PHP/MariaDB runtime, introduces verified per-tab isolation fallback and restricted approved-image delivery, and makes project credits follow one consistent order.

Implementation objectives

Database workspace

• Pin and stage the multilingual MySQL/MariaDB Adminer distribution with checksum and required notices.
• Adapt Adminer to the existing PDO transport without changing MariaDB, database credentials, stored data or engine builds.
• Add the original committed database icon next to JoomEngine Code, with the short label DB, accessible Database name, correct light/dark rendering and icon-only narrow layout.
• Reuse the active site's PHP, database and request queue; no second Joomla installation or database copy.
• Support left/right/bottom dock, floating, full workspace, and detached window.
• Show at most one embedded Code/Database panel. Detached tools may remain visible while another tool shares the site.
• Preserve code buffers and database navigation/query drafts during tool switches; never replay a write when detaching.
• Preserve site iframe identity, authentication, saved-site lifecycle, backup/export portability and lazy loading.

Browser isolation

• Prefer COEP credentialless with COOP same-origin; preserve normal URLs, PHP networking and zero automatic relay traffic.
• Verify the controlling service worker, crossOriginIsolated, usable SharedArrayBuffer and required worker capabilities before runtime creation.
• Fall back to require-corp through bounded controlled navigation only when credentialless fails verification.
• Version startup state; distinguish initial takeover and fallback; stop with accurate diagnostics if neither succeeds without resetting storage.
• Keep the confirmed policy fixed for the running page and scoped to its top-level owner, not global shared state.
• Recover policy after worker suspension/restart using validated navigation/ownership metadata; propagate to preview, workers and detached windows.
• Apply correct document/worker/error headers and avoid cache contamination between modes.
• Provide a controlled fallback-disable switch independent of saved Joomla and deployment content.
• Explain top-level and embedding limitations without user-agent or screen-size detection.

Approved public images and relay

• Inventory supported Joomla/JCB package and metadata image references; explicitly record scope and excluded assets.
• Version a shared reviewed registry with asset IDs, canonical URLs, owner, type, byte limit, allowed redirects, available hashes and update/cache policy.
• Keep registry authority server-side; extensions, imported configuration and caller URLs cannot add access.
• Implement a separately hostable HTTPS relay for GET/HEAD public images only; document the actual deployment contract, configuration and rollback.
• Add a deployment-relative service-worker asset route outside virtual Joomla/PHP routes; preserve the nested-request deadlock guard.
• Enforce CORS for the configured Playground origin while separately enforcing registry and abuse limits.
• Strip cookies, Authorization, arbitrary caller headers and upstream Set-Cookie.
• Reject credential URLs, unapproved query parameters and redirects; enforce public destinations and DNS-rebinding controls.
• Bound timeout, size, redirects, concurrency and rate; validate MIME, actual image format and original-byte hashes.
• Exclude runtime SVG proxying unless explicitly reviewed and hash pinned with suitable protections.
• Use one compatibility-gated resolver for approved browser images and PHP Fetch/cURL/stream downloads; preserve ordinary requests.
• Cover approved src, srcset, picture, CSS and dynamic image requests with a verified browser mechanism.
• Preserve cancellation, timeout, HTTP status and exact binary bytes; keep JCB checksum, format guards and verified-cache behavior.
• Keep original source URLs portable; no proxy URL persistence in content, metadata, templates, database or exports.
• Cache only validated public content with registry/content identity and explicit freshness; failed requests remain bounded diagnostics.
• Record relay endpoint/deployment status honestly; never invent an operational endpoint or claim local relay testing proves production availability.

Credits

• Keep About order: Joomla; Joomla Component Builder; JoomEngine Playground; PHP; MariaDB; Sean Morris php-wasm; JoomEngine MariaDB WASM Bridge; lite4mariadb; editor projects; Adminer; all remaining acknowledgments below.
• Make NOTICE follow that order, omitting JoomEngine Playground.
• Reorder existing README credits consistently and add Adminer immediately after editor credits.
• Place vector attribution among the remaining credits at the bottom, crediting the upstream project simply without discussing how the artwork was supplied or purchased.
• Preserve legally required licenses and notices.

Delivery and validation

• Create an isolated branch from current main and open a draft PR immediately.
• Push runtime implementation progressively; complete implementation before spending time on full test runs.
• Run existing relevant checks and only focused new contract tests after implementation; repair failures before ready/merge.
• Exercise normal/fallback modes, a deliberately restricted image fixture, exact PHP image bytes, rejected requests, relay outage, persistence/export, service-worker recovery and mixed-mode tabs.
• Include available automated Chromium, Firefox and WebKit evidence, clearly separating responsive layout from runtime checks.
• Leave real iPhone/iPad and representative Android testing to the maintainers after deployment, as requested; this is not a merge blocker.
• Mark the implementation ready for review and report relay hosting requirements; merging remains gated by the branch's required GitHub checks.

Implementation and release status

Adminer, tool switching, per-owner isolation, the restricted relay, the reviewed
image registry and ordered credits are implemented. The relay-dependent fallback
ships disabled until an operator supplies and verifies a real HTTPS relay.
GitHub Pages serves only the static client; no deployed relay is invented here.
The build rejects enabling fallback without enabled relay configuration.

The Adminer executable bundle adds 445,011 bytes (about 435 KiB), or
251,792 bytes (about 246 KiB) when its files are individually gzipped.
It loads only when DB is opened and reuses the existing PHP/MariaDB runtimes.

Validation recorded on 31 October 2026:

• Source syntax and the repository source suite: 388 passed.
• Real Adminer on PHP 8.3, 8.4 and 8.5 with MariaDB: table/schema browsing,
  Unicode SQL and exports, local session/CSRF protection; PHP 8.4 additionally
  exercises row editing and SQL file import.
• Chromium 156.0.8078.4: real Joomla authentication, Adminer SQL,
  Code/DB exclusion and detached coexistence, PHP restart, private tool routes,
  portable export, save/reload/reopen and unchanged saved database contents.
  A real highlighted SQL draft survives detaching/redocking and remains unexecuted.
• Chromium 156.0.8078.4 and automated Linux WebKit 27.2: headerless hosting,
  controlled isolation bootstrap, shared WASM memory, nested workers, per-owner
  policies and reload recovery. Chromium also forcibly stops/restarts the SW.
• Both engines start real PHP 8.4, MariaDB and Joomla under require-corp.
  A fixture host deliberately has neither CORS nor CORP. Approved src,
  srcset, picture, CSS and dynamic images display; actual PHP streams and
  cURL receive the exact original 69-byte PNG with its SHA-256 intact.
• Normal-mode fixture traffic makes zero automatic relay requests. Relay outage,
  unknown registry IDs, invalid formats, redirects, oversize content and private
  destinations have bounded failure contracts.

The GitHub validation workflow builds the complete candidate and runs the
existing native/runtime/browser checks plus focused isolation, image and Adminer
coverage. Its final status gates merging; the evidence above is not a claim
that an unfinished workflow passed.

Before enabling compatibility delivery, deploy the relay, verify its real
outbound access and all approved image IDs, configure its HTTPS address and
allowed Playground origin, and then enable fallback. All 31 canonical image
URLs were downloaded through this environment's standard HTTP transport on
2026-10-31: each returned HTTP 200 without redirects, matched the JCB metadata
MD5 and expected MIME, and now has a recorded SHA-256 and measured size in the
registry. The relay's separate direct DNS/pinned-HTTPS upstream check failed
with EAI_AGAIN before connection in this environment. The downloaded-byte
verification therefore does not certify the production relay's outbound access
or its deployment; fixture tests prove its controlled transport contract.
No physical iPhone/iPad or Android result is claimed. Maintainers perform those
checks after deployment as requested; they are not implementation merge blockers.

See database usage, browser compatibility and rollout,
approved image inventory, and relay deployment.

Final validation

Candidate 317492786eb1896d37b260bf88b82f126af4a7c8 passed all 17 checks in
GitHub validation.
This includes the complete native build/provisioning/snapshots, Chromium and
Firefox runtime/UI/editor/rocket/version-installation checks, actual Adminer
lifecycle, and Chromium/WebKit isolation and exact image delivery.

Firefox's earlier compiler scenario failed on optional Mastodon fetches canceled
by form navigation. The two exact public GET endpoints now receive deterministic
empty news feed responses in that existing test scenario, with both calls
verified. All compiler, runtime, image and unexpected-error assertions remain
unchanged. Production networking and JCB behavior are unchanged.

One runner stalled fetching Ubuntu browser dependencies and timed out before
starting its tests. Only that cancelled job and its dependent validation gate
were retried; the retry passed and the other fifteen successful results were
retained. The final workflow conclusion is success.

README commit bfea14d preserves the original wording and exact message,
“Update the Joomla playground credits”, without extra message text or co-author
attribution. The original signed commit is no longer in branch history.

Local syntax checks and 388 source tests pass. The existing real Adminer
lifecycle test passed. The actual pinned JCB news-feed implementation also passed
a focused Firefox check; a complete local deploy run was blocked by this
environment's external-image networking, so the successful GitHub runtime jobs
provide that complete evidence. No additional test suite was added.

The merge-triggered Pages build and publication succeeded, with all 18 jobs passing on merge commit f3e3f0886ee656977e9de0e93b093ddc70df4a20. No follow-up fix PR was needed.
The restricted relay is implemented but no production endpoint is configured;
relay-dependent fallback remains disabled pending deployment/configuration.
Physical-device testing remains with the maintainers after deployment.