Skip to main content

CAP.L0.NO_ACTIVE_RULES — nothing was checked, and that is not a clean result

  • Category: safety
  • Level: 0
  • Stability: stable
  • Suites: audit

A run is only as meaningful as the rules it applied. When the level, the category scope and the maturity tier between them leave no rule at all, the report that comes back is byte-for-byte what a perfectly healthy database produces: no findings, exit code 0.

This notice is the difference between those two outcomes.

How a run ends up with nothing​

It is easier to do by accident than it sounds. --level=1 --category=idiom has no members: idiom rules start at level 6, and level 1 admits only the destructive band. Nothing is wrong with either flag; their intersection is simply empty.

The same happens with a category that no rule in the active band carries, or a level low enough that the suite you are running has nothing in range.

What to do​

Read the run header. It states the level, the categories the run was scoped to, and how many rules were active and hidden:

level<=1 active-rules=0 hidden-rules=23
categories=idiom

hidden-rules is the number to look at: if it is large while active-rules is zero, the rules exist and your filters excluded all of them. Widen the level, widen the category scope, or remove the filter entirely.

Why it is undetermined rather than a failure​

Nothing was judged, so nothing can be said to have failed. What must not happen is the run reading as a pass — and under --strict it does not: an undetermined result becomes exit code 3.