Licensing: adopt shared redistribution-policy discipline (provenance, UI, sync, cast enforcement)

[jmchilton]

Filed by Claude (AI assistant) on jmchilton's behalf — not authored by them personally.

Licensing: adopt the shared redistribution-policy discipline

Implements the guiding principle Redistributed Content Carries Its License for this instance. All work here is bound to the shared license → redistribution-policy table: galaxyproject/foundry-pattern#4. That table is the source of truth for what each license ID means (verbatim-ok vs own-words-only, obligations, license_file requirement) — this issue is the wiring to enforce it here.

This repo is already ahead on schema enforcement (SPDX enum + validator that refuses external schema notes lacking a license). The gaps are: no license ID escape hatch, license absent from provenance and the UI, and the sync manifest is license-blind.

Prerequisite (shared)

• Land the enum + escape-hatch grammar and the policy mapping from License → redistribution-policy table (shared decision for the licensing principle) foundry-pattern#4. Everything below assumes license is an SPDX ID or LicenseRef-<slug>, and that each ID resolves to a verbatim-ok | own-words-only policy.

TODO

• Schema: enum → enum-or-LicenseRef. In meta_schema.yml (license block ~L302), replace the flat enum: with anyOf: [<enum>, pattern ^LicenseRef-[A-Za-z0-9.-]+$], and extend the enum with the IDs actually in use across instances (CC-BY-4.0, CC-BY-NC-SA-2.0, LGPL-3.0-or-later, …) per the table.
• License into _provenance.json. The cast emitter reads each redistributed ref's license / license_file from its source-note frontmatter and writes them into the per-ref provenance entry (add a license_file content hash alongside the existing src_hash/dst_hash). Bump provenance_schema_version. Refs currently carry kind/mode/src/dst/hashes/source only — this makes the license of every redistributed byte part of the lineage.
• Foreground licenses in the UI (build from scratch — no renderer today). Add a source/license box component and an in-app /licenses/<id>/ route rendering the LICENSES/ files. Crib stat-gen's SourceMeta.astro + src/lib/licenses.ts as a reference implementation (copy the pattern; the repos share no code). Flip the license / license_file fields in site/src/content.config.ts (~L190) from .optional() to required for redistributing note types.
• Tag the sync layer. Add license + license_file per entry in vendored_upstreams.yml (currently license-blind), and have the sync script assert the referenced LICENSES/ file exists at sync time — so license attaches at the point of sync, not only when a downstream note remembers to declare it.
• Cast → license enforcement. Casting refuses a verbatim transform mode when the ref's license resolves to own-words-only in the table. Reconcile the existing license_file-required validator accordingly: verbatim redistribution requires a license_file; own-words-only sources require a license ID but no license_file (nothing is being redistributed). Honor the table's functional-strings carve-out — equations, parameter/API/package names, and numeric thresholds stay verbatim as facts regardless of policy.

Coordination

The policy mapping must not diverge from stat-gen's copy (jmchilton/statistical-genomics-foundry). Treat any change to the license→policy table as a cross-repo change per galaxyproject/foundry-pattern#4 (open question 4 there covers the canonical-home/sync mechanism).