A proprietary repository can declare its license in composer.json or package.json and still have no root LICENSE file. It can also have no MCP config. Harness Score used to score both as hygiene failures.
Harness Score 1.8.0, published on October 2, 2026, takes those checks out of the percentage when they do not apply. They stay in the report. They do not earn points for absence.
Thanks to Anderson Rogani for reporting this in issue #73.
What leaves the score
HYG-05 is not applicable when there is no root LICENSE, LICENSE.md, LICENSE.txt, or COPYING, and the root manifest license is proprietary or UNLICENSED. Composer accepts a string or an array of only those values. A nested manifest does not count. A real license file still passes.
HYG-08 is not applicable when no MCP config exists. HYG-04 can still pass, because there is nothing to leak. HYG-08 does not award points for that absence.
The JSON field is checks[].applicable: false, with passed still false and zero points earned. Those points leave the numerator and the denominator. --diff calls that became-not-applicable or became-applicable.
"private": true and Cargo publish = false are publish flags, not licenses. HYG-05 never reads Cargo.toml.
What I scanned
On October 2, 2026, npx --yes harness-score@1.8.0 scored an otherwise empty directory with "license": "proprietary" in composer.json at L0, 11/103. HYG-05 and HYG-08 were not applicable. The full catalog is still 108 points when every check applies.
"private": true alone still failed HYG-05, at 11/105. So did "license": "MIT" with no license file. Comparing the private package with the proprietary Composer sample, the CLI reported:
Score: 11/105 (10%) → 11/103 (11%) (+1pp)
Now not applicable: HYG-05
Earned hygiene points stayed at 10. The percentage rose because a failed check left the denominator.
npm view harness-score version returned 1.8.0. If you gate CI on --min-level, pin that version and compare earned points over the applicable maximum. I did not scan the private repository from the original report.
Top comments (0)