[vitormattos]

Why

The LibreSign PHP application and its tests already use PHP. The Coverage publisher had accumulated Python and Bash implementation/test code even though those languages are not technically required for JSON, HTML, provenance, historical aggregation or GitHub Releases archiving. Consolidate the publisher's backend logic and tests in PHP 8.3+, without rerunning application tests or inventing data.

Changes

• Replace all Python processing scripts and the three standalone Bash scripts in scripts/ with a single PHP CLI entry point, scripts/coverage.php, backed by focused PHP classes in src/.
• Add composer.json, locked composer.lock, and PHPUnit tests, replacing the Python unittest suite. Use PHP 8.3 with PHPUnit 12, both on CI and for the publisher job.
• Preserve the public dashboard's JavaScript/CSS, upstream Octocov/Jekyll actions, and GitHub Actions orchestration. Tiny Bash steps for orchestrating CI actions remain; GNU tar is called as a safe argv-based subprocess from PHP to stream large HTML archives at bounded memory.
• Preserve selection of one complete native Octocov + Clover/HTML source run, verified source repository/ref/SHA/run, repository_dispatch trust boundary, separation of previews from official main, immutable-by-policy SHA/run/attempt Releases, and checksum verification.
• Preserve Coveralls historical trend as a separate measurement series; never recompute PHP coverage in the publisher.
• Extract static HTML into templates/ and adjust README, AGENTS.md, and the maintainer guide to match the PHP architecture.
• Delete the Python scripts/tests and the Bash scripts now replaced by PHP.

Evidence

Real archived data parity: Compared the old Python and new PHP output using the existing verified GitHub Release archives:

Case	Result
Latest archived source coverage summary	Semantically identical JSON for 498 files, 24 directories, including rounding
Coveralls historical trend	Semantically identical JSON for 764 main-branch records
Native metadata fixture	Byte-for-byte identical output to Python (including timestamps and formatting)
Compressed Clover/Octocov format	PHP gzip output tested against gzip -n -9
Real compressed PHPUnit HTML archive	Restored 732 files with PHP 8.3 at memory_limit=128M, matching the reference report index hash
Theme applied to real archived PHPUnit report	719 HTML files updated and all relative asset paths resolved

Automated verification:

• PHPUnit 60 tests / 203 assertions passed on PHP 8.3 and PHP 8.5.
• Composer lock validation and all PHP syntax checks passed.
• actionlint passed for all publisher workflows; JavaScript node --check passed.
• Tests include source-run trust checks, missing artifacts, archive immutability/conflicts, checksum failures, fallback restoration, separate history series, HTML and domain links.
• Four incremental commits were created with DCO and verified cryptographic signatures using Git Signing MCP.

Review / rollout

This is a major implementation migration. Please inspect the source-run verification, Releases idempotency, and generated site parity before merging. The PR validation CI is expected to run PHP on GitHub Actions. The Pages deployment, real dispatch, and live website need a production smoke test after a separately authorized merge.

No PHP application code in LibreSign/libresign is modified. No automatic merge requested.