Restore green CI: reconcile the two open-access gates, refresh the licence ledger, stage #15/#16

[lfnothias]

Gets main back to green and clears the community proposal queue. No release is cut and no tag is pushed.

Why main is red

Two gates have been failing on every corpus-touching push since 2026-06-24 (tip c414aeecc).

1. The two open-access gates disagree. scripts/release_gate.py (the release authority) admits the repository-OA tier — repo-oa, repo-permissive, repo-copyleft — but .github/workflows/verify-paper.yml never learned about it. All 568 papers in collections/metabolomics/v2/corpus.yaml carry access.type: repo-oa, so the workflow rejected every one of them while the release gate passed them.

This reconciles the workflow with the release gate and adds tests/test_oa_tier_parity.py, which fails if they ever drift apart again. The test was checked against the broken workflow first to confirm it actually catches the regression.

2. One skill description broke the lint. asb-metabolomics/SKILL.md opened with "Use FIRST when…"; the lint requires one of Use when / Reference for / Explains / Decision support for. Reworded, meaning preserved.

Both gates were verified locally by extracting and executing the workflows' own inline scripts, not a re-implementation:

PASS: description discipline OK (7722 skill files checked)
PASS: Paper access-tier validation OK (684 included papers checked)

License-clarification wave

verify had never been run against the ledger, so it still showed all five trial issues as open. Refreshed: 2 closed, 1 responded, 2 open.

• MassBank #394 — answered. GPL-3 covers the software; the records in the data repository carry per-record CC licences. No single SPDX id applies, so license_after stays null deliberately.
• LipidOne stage: metabolomics/v1 (initial dogfooding cut) #1 — we filed against a repo that was already licensed. The BSD-2-Clause text is embedded in its README, and our scan only looked for a LICENSE file. Closed with an apology.

governance/license_clarification/README.md now warns that licences hide outside LICENSE files, with the three real cases we hit (README-embedded text, an R DESCRIPTION field, and a LICENSE.txt). Treat a null licenseInfo as unknown, never unlicensed.

Proposal queue

Staged the two proposals that were never triaged:

• Propose: OmniPath #15 OmniPath Metabo — bioRxiv preprint, licence read from api.biorxiv.org (cc_by), repo BSD-3-Clause.
• Propose: Galaxy W4M #16 Workflow4Metabolomics — our first external proposal (@yguitton). Anchored on Giacomoni 2015 (Bioinformatics, CC-BY); the Delport 2025 Current Protocols paper is green OA with no reuse licence, so it is a context link only. Repo is GPL-3.

Also corrects RforMassSpectrometry's source_issue from 14 to 13.

Known gap, not fixed here

OPEN_ACCESS_POLICY.md claims preprints are "always CC-BY by repository policy". bioRxiv lets authors choose CC-BY-NC-ND or no-reuse, so that rule can admit text we may not redistribute. The OmniPath entry verifies the licence via the API rather than relying on the rule. Correcting the policy is a separate change.

Verification

• 227 passed (was 227 before; +2 new parity tests, no regressions)
• Both failing gates replayed green from the workflow YAML itself
• Ledger verify is idempotent — a re-run preserves license_after and the new note field

Review findings folded in

Two independent reviewers went over this branch. What changed as a result:

• Parity test only guarded one direction. It asserted the workflow admits everything the release gate does, but not the reverse — so a future edit could have let CI admit a tier the release gate rejects, shipping non-open content to the public branch that would only fail at release time. Both directions are now asserted, plus a guard against rebinding the tier set inside a conditional (which would have made the static check go stale silently). All three failure modes were reproduced before and after.
• The workflow comment cited the wrong policy. repo-oa is defined in CONTENT_POLICY.md §3, not OPEN_ACCESS_POLICY.md. Corrected, and CONTENT_POLICY.md §3 now documents the repo-* tiers as part of the CI-enforced set, so the doc matches what CI actually does.
• The preprint rule is fixed here rather than deferred. It is a factual error with no code depending on it, and leaving it uncorrected in the same PR that fixes the sibling licence-detection doc would have been inconsistent.

One reviewer finding was not accepted: that 10.64898/2026.06.18.733117 is not a bioRxiv DOI. Prefix 10.64898 is registered to openRxiv, which took bioRxiv/medRxiv over from Cold Spring Harbor; the DOI resolves to biorxiv.org and api.biorxiv.org returns the record with license: cc_by. A comment now records this so it does not get "corrected" later.

What this PR does not do

It does not bless the corpus. Making verify-paper recognise repo-oa means it stops failing on all 568 entries — including 78 that claim verified_via: git_clone_succeeded_at_build with an empty repo_url, and 247 with no recorded licence. That gap predates this branch (corpus.yaml is untouched here) and the old red CI was not detecting it — it was failing on the tier name, indiscriminately, including on the 306 entries that are properly licensed.

Filed as #23, with the exact counts, the two conflicting definitions of repo-oa, and the enforcement that should replace the tier-name check. Resolving it means re-tiering or removing already-published entries, which is a content decision, not a CI fix.