repo-oa admission is asserted, not verified: 78 entries have no repository, 247 have no licence

[lfnothias]

Surfaced while fixing the red verify-paper gate in #22. The gate fix is correct, but it stops CI from failing on this, so recording it here rather than letting it disappear behind a green build.

The data

All 568 status: included entries in collections/metabolomics/v2/corpus.yaml carry access.type: repo-oa and access.verified_via: git_clone_succeeded_at_build. Two subsets do not support that claim.

Problem	Count
repo_url: "" yet verified_via: git_clone_succeeded_at_build	78
access.license: null (of which 169 have a real repo_url)	247

An empty repo_url cannot have been cloned at build. Examples, all license_tier: restricted:

10.1002/9780470508183          (Wiley book)
10.1007/978-3-319-47656-8_6
10.1007/s00044-016-1764-y
10.1016/j.aca.2018.05.001
10.1021/acs.analchem.0c03895

These are the "no-repo entries" the backfill in c414aeecc explicitly left behind (no-repo entries 138->78), so the number is known — it just isn't enforced anywhere.

Why it is ambiguous rather than simply wrong

repo-oa has two conflicting definitions in this repository:

• governance/CONTENT_POLICY.md §3 — "a public git repository cloned at build qualifies as repo-oa. This is the paper-access axis only — what a consumer may do with the tool is the separate license_tier axis." Under this reading, repo-oa asserts public availability, and the 247 null-licence entries are fine because license_tier: restricted already makes them link-only.
• scripts/release_gate.py:282-288 — "paper is non-OA, but the repository is openly licensed (permissive/copyleft), with the specific code SPDX recorded per-paper." Under this reading, 247 entries claim a right that was never established.

The 78 no-repo entries fail both readings.

Note also that repo-permissive and repo-copyleft appear only in release_gate.py and verify-paper.yml. No governance document defines them.

What needs deciding

1. Which definition of repo-oa governs. Reconcile CONTENT_POLICY.md §3 and the release_gate.py comment, and define repo-permissive / repo-copyleft (or drop them).
2. What happens to the 78 entries with no repository. They have neither an open paper nor a repository, so under either reading they have no admission basis. Re-tier, or remove from included.
3. Whether verified_via: git_clone_succeeded_at_build should be written at all when no clone was attempted. It is currently the value for 100% of entries, which makes the field carry no information.

Then enforce it

Once the semantics are settled, verify-paper.yml should gate on evidence rather than on the tier name — at minimum, a repo-* entry must have a non-empty repo_url. That check will fail on the 78 until they are resolved, which is the correct outcome.

Deliberately not doing this in #22: it would turn main red again, and dropping or re-tiering 78 already-published entries is a content decision, not a CI fix.