codd-dev 2.12.0__tar.gz → 2.14.0__tar.gz

{codd_dev-2.12.0 → codd_dev-2.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codd-dev
-Version: 2.12.0
+Version: 2.14.0
 Summary: CoDD: Coherence-Driven Development — cross-artifact change impact analysis
 Project-URL: Homepage, https://github.com/yohey-w/codd-dev
 Project-URL: Repository, https://github.com/yohey-w/codd-dev
@@ -153,10 +153,11 @@ This is what lets CoDD ship one core that works for Next.js, Django, FastAPI, Ra
 
 ## 🧭 Roadmap
 
-- **v2.12.0 (current)** — Test-completeness gates: C7 `actors_without_journeys` amber promotion + new C8 `ci_health` static check (workflow presence, trigger coverage, verification-in-workflow). Defaults to opt-in for legacy projects; new `codd init` projects get `ci:` defaults from the template. See [post-mortem](docs/post-mortems/test_completeness_gap.md).
+- **v2.14.0 (current)** — 8 structural gaps closed (cmd_466 dogfood). Sidecar `<test>.codd.yaml` with `verified_by:` (C6) and `axis_matrix:` (C9); lexicon schema SSoT; completeness_audit batch; `scan.exclude` bug fix (−52% amber noise); `codd dag verify --auto-repair`; elicit mock-AI sentinel; AI timeout → 3600 s SSoT. Dogfood re-run: red 22 → 0. See [CHANGELOG](CHANGELOG.md).
+- **v2.13.0** — Opt-out protection: `OptOutPolicy` requires a `justification` + `expires_at` for every config-level opt-out (`ci.provider=none`, etc.). Silent SKIP abolished; severity preserved. `codd validate` reports policy violations. See [post-mortem](docs/post-mortems/optout_loophole.md).
+- **v2.12.0** — Test-completeness gates: C7 `actors_without_journeys` amber promotion + new C8 `ci_health` static check (workflow presence, trigger coverage, verification-in-workflow). See [post-mortem](docs/post-mortems/test_completeness_gap.md).
 - **v2.11.0** — Sprint-less `codd implement` (`--design <path> --output <dir>` directly; `implementation_plan.md` parser removed). See [migration guide](docs/migrations/v2.11.0-sprintless.md).
-- **v2.10.0** — Lexicon-driven completeness, 38 plug-ins, LLM-enhanced init, scope/phase filter, auto-repair across the full DAG.
-- **v2.13.0 (next)** — C8 `ci_health` runtime mode (opt-in `ci.runtime_check: true`) polling the CI provider for latest-run-on-default-branch success.
+- **v2.15.0 (next)** — C8 `ci_health` runtime mode (opt-in `ci.runtime_check: true`) polling the CI provider for latest-run-on-default-branch success.
 
 ---
 

{codd_dev-2.12.0 → codd_dev-2.14.0}/README.md

@@ -113,10 +113,11 @@ This is what lets CoDD ship one core that works for Next.js, Django, FastAPI, Ra
 
 ## 🧭 Roadmap
 
-- **v2.12.0 (current)** — Test-completeness gates: C7 `actors_without_journeys` amber promotion + new C8 `ci_health` static check (workflow presence, trigger coverage, verification-in-workflow). Defaults to opt-in for legacy projects; new `codd init` projects get `ci:` defaults from the template. See [post-mortem](docs/post-mortems/test_completeness_gap.md).
+- **v2.14.0 (current)** — 8 structural gaps closed (cmd_466 dogfood). Sidecar `<test>.codd.yaml` with `verified_by:` (C6) and `axis_matrix:` (C9); lexicon schema SSoT; completeness_audit batch; `scan.exclude` bug fix (−52% amber noise); `codd dag verify --auto-repair`; elicit mock-AI sentinel; AI timeout → 3600 s SSoT. Dogfood re-run: red 22 → 0. See [CHANGELOG](CHANGELOG.md).
+- **v2.13.0** — Opt-out protection: `OptOutPolicy` requires a `justification` + `expires_at` for every config-level opt-out (`ci.provider=none`, etc.). Silent SKIP abolished; severity preserved. `codd validate` reports policy violations. See [post-mortem](docs/post-mortems/optout_loophole.md).
+- **v2.12.0** — Test-completeness gates: C7 `actors_without_journeys` amber promotion + new C8 `ci_health` static check (workflow presence, trigger coverage, verification-in-workflow). See [post-mortem](docs/post-mortems/test_completeness_gap.md).
 - **v2.11.0** — Sprint-less `codd implement` (`--design <path> --output <dir>` directly; `implementation_plan.md` parser removed). See [migration guide](docs/migrations/v2.11.0-sprintless.md).
-- **v2.10.0** — Lexicon-driven completeness, 38 plug-ins, LLM-enhanced init, scope/phase filter, auto-repair across the full DAG.
-- **v2.13.0 (next)** — C8 `ci_health` runtime mode (opt-in `ci.runtime_check: true`) polling the CI provider for latest-run-on-default-branch success.
+- **v2.15.0 (next)** — C8 `ci_health` runtime mode (opt-in `ci.runtime_check: true`) polling the CI provider for latest-run-on-default-branch success.
 
 ---
 

{codd_dev-2.12.0 → codd_dev-2.14.0}/codd/cli.py

@@ -4890,7 +4890,28 @@ def dag_build(project_path: str, output_format: str, cache: bool, output: str |
     type=click.Choice(["text", "json"]),
     help="Output format",
 )
-def dag_verify(project_path: str, check_names: tuple[str, ...], output_format: str):
+@click.option(
+    "--auto-repair",
+    is_flag=True,
+    default=False,
+    help="Apply violation-output suggestions mechanically (e.g. append "
+    "suggested_lexicon_entry to project_lexicon.yaml). Implies a dry-run "
+    "preview unless --apply is also supplied.",
+)
+@click.option(
+    "--apply",
+    "apply_changes",
+    is_flag=True,
+    default=False,
+    help="Write changes to disk when --auto-repair is set. Default: dry run.",
+)
+def dag_verify(
+    project_path: str,
+    check_names: tuple[str, ...],
+    output_format: str,
+    auto_repair: bool,
+    apply_changes: bool,
+):
     """Run DAG completeness checks."""
     from codd.dag.runner import run_all_checks
 
@@ -4901,10 +4922,13 @@ def dag_verify(project_path: str, check_names: tuple[str, ...], output_format: s
         click.echo(f"Error: {exc}")
         raise SystemExit(1)
 
+    opt_out_results = [result for result in results if _dag_result_status(result) == "opt_out"]
     failed_red = [
         result
         for result in results
-        if not _dag_result_passed(result) and _dag_result_severity(result) == "red"
+        if not _dag_result_passed(result)
+        and _dag_result_severity(result) == "red"
+        and _dag_result_status(result) != "opt_out"
     ]
     amber_findings = [
         result
@@ -4917,7 +4941,10 @@ def dag_verify(project_path: str, check_names: tuple[str, ...], output_format: s
     else:
         for result in results:
             severity = _dag_result_severity(result)
-            if _dag_result_passed(result):
+            status_value = _dag_result_status(result)
+            if status_value == "opt_out":
+                status = "OPT_OUT"
+            elif _dag_result_passed(result):
                 status = "PASS"
             else:
                 status = "WARN" if severity == "amber" else "FAIL"
@@ -4929,6 +4956,24 @@ def dag_verify(project_path: str, check_names: tuple[str, ...], output_format: s
             click.echo(f"\n{len(failed_red)} check(s) FAILED (severity=red)")
         elif amber_findings:
             click.echo(f"\n{len(amber_findings)} check(s) WARN (severity=amber, deploy allowed)")
+        if opt_out_results:
+            click.echo(f"\n{len(opt_out_results)} active opt-out(s) (deploy allowed):")
+            for result in opt_out_results:
+                click.echo(f"  - {_dag_result_name(result)}: {_dag_result_message(result)}")
+
+    if auto_repair:
+        from codd.dag.auto_repair import apply_auto_repair
+
+        outcome = apply_auto_repair(project_root, results, dry_run=not apply_changes)
+        click.echo("")
+        verb = "Would apply" if not apply_changes else "Applied"
+        click.echo(f"{verb} {len(outcome.applied)} repair(s):")
+        for action in outcome.applied:
+            click.echo(f"  - {action.description}")
+        if outcome.skipped:
+            click.echo(f"\nSkipped {len(outcome.skipped)} non-repairable violation(s):")
+            for action in outcome.skipped:
+                click.echo(f"  - {action.description}")
 
     raise SystemExit(1 if failed_red else 0)
 
@@ -5185,6 +5230,14 @@ def _dag_result_passed(result: Any) -> bool:
     return _dag_result_value(result, "passed") is not False
 
 
+def _dag_result_status(result: Any) -> str:
+    return str(_dag_result_value(result, "status") or "")
+
+
+def _dag_result_message(result: Any) -> str:
+    return str(_dag_result_value(result, "message") or "")
+
+
 def _dag_result_has_findings(result: Any) -> bool:
     for key in (
         "violations",

{codd_dev-2.12.0 → codd_dev-2.14.0}/codd/coverage_metrics.py

@@ -183,12 +183,17 @@ def compute_dag_completeness(
         return _exception_result("dag_completeness", threshold, exc)
 
     red_results = [result for result in results if _dag_result_severity(result) == "red"]
-    failed_red = [result for result in red_results if _dag_result_passed(result) is False]
+    failed_red = [
+        result
+        for result in red_results
+        if _dag_result_passed(result) is False and _dag_result_status(result) != "opt_out"
+    ]
     amber_findings = [
         result
         for result in results
         if _dag_result_severity(result) == "amber" and _dag_result_has_findings(result)
     ]
+    opt_outs = [result for result in results if _dag_result_status(result) == "opt_out"]
 
     total = len(red_results)
     uncovered = len(failed_red)
@@ -197,6 +202,7 @@ def compute_dag_completeness(
     details = [f"checks: {len(results)}", f"red_failures: {uncovered}"]
     details.extend(_format_dag_result(result) for result in failed_red[:5])
     details.extend(f"warning: {_format_dag_result(result)}" for result in amber_findings[:5])
+    details.extend(f"opt_out: {_format_dag_result(result)}" for result in opt_outs[:5])
 
     return CoverageResult(
         metric="dag_completeness",
@@ -361,6 +367,10 @@ def _dag_result_passed(result: Any) -> bool:
     return _dag_result_value(result, "passed") is not False
 
 
+def _dag_result_status(result: Any) -> str:
+    return str(_dag_result_value(result, "status") or "")
+
+
 def _dag_result_name(result: Any) -> str:
     return str(_dag_result_value(result, "check_name") or result.__class__.__name__)
 

codd_dev-2.14.0/codd/dag/auto_repair.py

@@ -0,0 +1,164 @@
+"""Mechanical auto-repair for DAG-verify violations.
+
+Reads the violation output produced by ``codd dag verify`` and applies the
+``suggested_*`` payloads to the project's filesystem without invoking AI.
+
+Currently supported repair types:
+
+* ``missing_journey_lexicon`` — append the ``suggested_lexicon_entry`` to
+  ``project_lexicon.yaml`` under ``required_artifacts``.
+
+Repair types that need a project-specific anchor (e.g. ``no_plan_task_for_journey``
+which requires the user to choose which plan section gets the new outputs)
+are listed in ``RepairOutcome.skipped`` with a human-readable reason so the
+operator knows what still has to be done by hand.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Iterable
+
+import yaml
+
+
+@dataclass(frozen=True)
+class RepairAction:
+    description: str
+
+
+@dataclass
+class RepairOutcome:
+    applied: list[RepairAction] = field(default_factory=list)
+    skipped: list[RepairAction] = field(default_factory=list)
+
+
+def apply_auto_repair(
+    project_root: Path,
+    results: Iterable[Any],
+    *,
+    dry_run: bool = True,
+) -> RepairOutcome:
+    """Apply mechanical repairs derived from DAG verify violation output.
+
+    Parameters
+    ----------
+    project_root
+        Project root used to resolve relative file paths.
+    results
+        Iterable of DAG check result objects (or dicts) as returned by
+        ``codd.dag.runner.run_all_checks``.
+    dry_run
+        When True, the function reports what *would* be applied without
+        modifying the filesystem.
+    """
+
+    outcome = RepairOutcome()
+    suggested_entries: list[dict[str, Any]] = []
+
+    for result in results:
+        violations = _result_value(result, "violations") or []
+        if not isinstance(violations, list):
+            continue
+        for violation in violations:
+            if not isinstance(violation, dict):
+                continue
+            v_type = violation.get("type")
+            if v_type == "missing_journey_lexicon":
+                entry = violation.get("suggested_lexicon_entry")
+                if isinstance(entry, dict) and entry.get("id"):
+                    suggested_entries.append(entry)
+                else:
+                    outcome.skipped.append(
+                        RepairAction(
+                            description=(
+                                "missing_journey_lexicon without suggested_lexicon_entry; "
+                                "violation cannot be auto-repaired"
+                            )
+                        )
+                    )
+                continue
+            outcome.skipped.append(
+                RepairAction(
+                    description=f"{v_type or '<unknown>'} — no mechanical repair available",
+                )
+            )
+
+    if suggested_entries:
+        repaired_ids = _apply_lexicon_entries(
+            project_root, suggested_entries, dry_run=dry_run
+        )
+        for entry_id in repaired_ids:
+            verb = "would append" if dry_run else "appended"
+            outcome.applied.append(
+                RepairAction(
+                    description=(
+                        f"project_lexicon.yaml: {verb} required_artifacts entry "
+                        f"'{entry_id}'"
+                    )
+                )
+            )
+        skipped_existing = {entry["id"] for entry in suggested_entries} - set(repaired_ids)
+        for entry_id in sorted(skipped_existing):
+            outcome.skipped.append(
+                RepairAction(
+                    description=(
+                        f"project_lexicon.yaml: required_artifacts entry "
+                        f"'{entry_id}' already declared"
+                    )
+                )
+            )
+
+    return outcome
+
+
+def _apply_lexicon_entries(
+    project_root: Path,
+    entries: list[dict[str, Any]],
+    *,
+    dry_run: bool,
+) -> list[str]:
+    lexicon_path = project_root / "project_lexicon.yaml"
+    if not lexicon_path.is_file():
+        return []
+
+    payload = yaml.safe_load(lexicon_path.read_text(encoding="utf-8")) or {}
+    if not isinstance(payload, dict):
+        return []
+
+    required_artifacts = payload.get("required_artifacts")
+    if not isinstance(required_artifacts, list):
+        required_artifacts = []
+
+    existing_ids = {
+        entry.get("id")
+        for entry in required_artifacts
+        if isinstance(entry, dict) and entry.get("id")
+    }
+
+    added_ids: list[str] = []
+    for entry in entries:
+        entry_id = entry.get("id")
+        if not entry_id or entry_id in existing_ids:
+            continue
+        required_artifacts.append(dict(entry))
+        existing_ids.add(entry_id)
+        added_ids.append(entry_id)
+
+    if not added_ids:
+        return added_ids
+
+    payload["required_artifacts"] = required_artifacts
+    if not dry_run:
+        lexicon_path.write_text(
+            yaml.safe_dump(payload, sort_keys=False, allow_unicode=True),
+            encoding="utf-8",
+        )
+    return added_ids
+
+
+def _result_value(result: Any, key: str) -> Any:
+    if isinstance(result, dict):
+        return result.get(key)
+    return getattr(result, key, None)

{codd_dev-2.12.0 → codd_dev-2.14.0}/codd/dag/builder.py

@@ -222,7 +222,11 @@ def _add_design_docs(dag: DAG, project_root: Path, settings: dict[str, Any]) ->
     design_docs: dict[str, dict[str, Any]] = {}
     aliases: dict[str, str] = {}
     frontmatter_alias = _frontmatter_alias_settings(settings)
-    for md_path in _glob_project_paths(project_root, settings.get("design_doc_patterns", [])):
+    for md_path in _glob_project_paths(
+        project_root,
+        settings.get("design_doc_patterns", []),
+        exclude_patterns=settings.get("scan_exclude_patterns"),
+    ):
         if not md_path.is_file():
             continue
         node_id = _relative_id(md_path, project_root)
@@ -256,7 +260,11 @@ def _add_impl_files(dag: DAG, project_root: Path, settings: dict[str, Any]) -> d
     impl_nodes: dict[str, Path] = {}
     capability_patterns = _capability_patterns(settings)
     implementation_suffixes = _suffix_tuple(settings.get("implementation_suffixes")) or LEGACY_IMPLEMENTATION_SUFFIXES
-    for file_path in _glob_project_paths(project_root, settings.get("impl_file_patterns", [])):
+    for file_path in _glob_project_paths(
+        project_root,
+        settings.get("impl_file_patterns", []),
+        exclude_patterns=settings.get("scan_exclude_patterns"),
+    ):
         if (
             not file_path.is_file()
             or file_path.suffix not in implementation_suffixes
@@ -284,7 +292,11 @@ def _add_impl_files(dag: DAG, project_root: Path, settings: dict[str, Any]) -> d
 def _add_test_files(dag: DAG, project_root: Path, settings: dict[str, Any]) -> dict[str, Path]:
     test_nodes: dict[str, Path] = {}
     test_suffixes = _suffix_tuple(settings.get("test_suffixes")) or LEGACY_TEST_SUFFIXES
-    for file_path in _glob_project_paths(project_root, settings.get("test_file_patterns", [])):
+    for file_path in _glob_project_paths(
+        project_root,
+        settings.get("test_file_patterns", []),
+        exclude_patterns=settings.get("scan_exclude_patterns"),
+    ):
         if not file_path.is_file() or file_path.suffix not in test_suffixes or not _is_test_file(file_path, project_root):
             continue
         node_id = _relative_id(file_path, project_root)
@@ -1067,7 +1079,11 @@ def _alias_candidates(import_ref: str, project_root: Path, aliases: dict[str, li
     return candidates
 
 
-def _glob_project_paths(project_root: Path, patterns: Any) -> list[Path]:
+def _glob_project_paths(
+    project_root: Path,
+    patterns: Any,
+    exclude_patterns: Any = None,
+) -> list[Path]:
     paths: dict[str, Path] = {}
     for pattern in _as_list(patterns):
         if not isinstance(pattern, str) or not pattern:
@@ -1075,7 +1091,69 @@ def _glob_project_paths(project_root: Path, patterns: Any) -> list[Path]:
         for expanded in _expand_braces(pattern):
             for path in project_root.glob(expanded):
                 paths[str(path.resolve())] = path.resolve()
-    return [paths[key] for key in sorted(paths)]
+    excludes = [
+        str(pattern)
+        for pattern in _as_list(exclude_patterns)
+        if isinstance(pattern, str) and pattern.strip()
+    ]
+    if not excludes:
+        return [paths[key] for key in sorted(paths)]
+    project_root_resolved = project_root.resolve()
+    filtered: list[Path] = []
+    for key in sorted(paths):
+        path = paths[key]
+        if _path_matches_any_pattern(path, project_root_resolved, excludes):
+            continue
+        filtered.append(path)
+    return filtered
+
+
+def _path_matches_any_pattern(
+    path: Path,
+    project_root: Path,
+    patterns: list[str],
+) -> bool:
+    try:
+        relative = path.resolve().relative_to(project_root)
+    except ValueError:
+        return False
+    rel_text = relative.as_posix()
+    parts = relative.parts
+
+    for pattern in patterns:
+        if fnmatch.fnmatch(rel_text, pattern):
+            return True
+        # Honour shell-style "any depth" wildcards by stripping the outer
+        # ``**/`` and ``/**`` decorations and looking for the inner pattern
+        # against any path slice. Examples:
+        #   **/node_modules/**  -> "node_modules"  must appear as a path component
+        #   **/dist/**          -> "dist"          must appear as a path component
+        #   src/**/*.py         -> not stripped here; falls back to fnmatch above
+        inner = pattern
+        stripped = True
+        while stripped:
+            stripped = False
+            if inner.startswith("**/"):
+                inner = inner[3:]
+                stripped = True
+            if inner.endswith("/**"):
+                inner = inner[:-3]
+                stripped = True
+        if not inner or inner == pattern:
+            continue
+        if "/" not in inner and "*" not in inner:
+            if inner in parts:
+                return True
+            continue
+        # Inner still contains glob syntax: check every contiguous slice of
+        # the relative path against ``inner`` so e.g. ``a/b/c/d`` matches
+        # ``a/b`` or ``c/d`` etc.
+        for start in range(len(parts)):
+            for end in range(start + 1, len(parts) + 1):
+                candidate = "/".join(parts[start:end])
+                if fnmatch.fnmatch(candidate, inner):
+                    return True
+    return False
 
 
 def _expand_braces(pattern: str) -> list[str]:
@@ -1306,6 +1384,11 @@ def _apply_scan_patterns(settings: dict[str, Any], config: dict[str, Any]) -> No
     source_dirs = _as_list(scan.get("source_dirs"))
     test_dirs = _as_list(scan.get("test_dirs"))
     doc_dirs = _as_list(scan.get("doc_dirs"))
+    exclude_patterns = [
+        str(pattern)
+        for pattern in _as_list(scan.get("exclude"))
+        if isinstance(pattern, str) and pattern.strip()
+    ]
 
     if source_dirs:
         _extend_unique(
@@ -1324,6 +1407,8 @@ def _apply_scan_patterns(settings: dict[str, Any], config: dict[str, Any]) -> No
         )
     if doc_dirs:
         _extend_unique(settings, "design_doc_patterns", _file_patterns_for_dirs(doc_dirs, (".md",)))
+    if exclude_patterns:
+        _extend_unique(settings, "scan_exclude_patterns", exclude_patterns)
 
 
 def _normalize_dag_section(section: dict[str, Any]) -> dict[str, Any]:

{codd_dev-2.12.0 → codd_dev-2.14.0}/codd/dag/checks/__init__.py

@@ -3,8 +3,12 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
+from datetime import date
 from pathlib import Path
-from typing import Any
+from typing import Any, TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from codd.dag.checks.opt_out import OptOutDeclaration, OptOutPolicy, OptOutSignal
 
 
 _REGISTRY: dict[str, type[Any]] = {}
@@ -34,14 +38,50 @@ class DagCheck:
         dag: Any | None = None,
         project_root: str | Path | None = None,
         settings: dict[str, Any] | None = None,
+        opt_out_policy: "OptOutPolicy | None" = None,
+        today: date | None = None,
     ) -> None:
         self.dag = dag
         self.project_root = Path(project_root) if project_root is not None else None
         self.settings = settings or {}
+        self.opt_out_policy = opt_out_policy
+        self.today = today or date.today()
 
     def run(self, dag: Any | None = None) -> CheckResult:
         raise NotImplementedError
 
+    def detect_opt_out(self, codd_config: dict[str, Any]) -> "OptOutSignal | None":
+        """Return an OptOutSignal when this check's config requests an opt-out.
+
+        Default: no opt-out detection. Subclasses that own a config-level
+        opt-out flag (e.g. ``ci.provider: none``) override this and route the
+        request through :class:`OptOutPolicy` rather than handling it inline.
+        """
+
+        del codd_config
+        return None
+
+    def resolve_opt_out(
+        self,
+        codd_config: dict[str, Any] | None = None,
+    ) -> "tuple[OptOutSignal, OptOutDeclaration | None] | None":
+        """Convenience helper: run detect_opt_out and look up a declaration.
+
+        Returns ``None`` when no opt-out signal is detected. Returns
+        ``(signal, declaration_or_None)`` otherwise so the caller can decide
+        whether the missing-or-expired declaration should fail red or pass
+        through.
+        """
+
+        config = codd_config if codd_config is not None else self.settings
+        signal = self.detect_opt_out(config)
+        if signal is None:
+            return None
+        declaration = (
+            self.opt_out_policy.lookup(signal.check_name) if self.opt_out_policy else None
+        )
+        return signal, declaration
+
 
 def register_dag_check(name: str):
     """Register a DAG check class under ``name``."""

{codd_dev-2.12.0 → codd_dev-2.14.0}/codd/dag/checks/ci_health.py

@@ -12,9 +12,15 @@ from typing import Any, Mapping
 import yaml
 
 from codd.dag.checks import DagCheck, register_dag_check
+from codd.dag.checks.opt_out import (
+    OPT_OUT_STATUS,
+    OptOutDeclaration,
+    OptOutSignal,
+)
 
 
 _DEFAULT_PROVIDER = "github" + "_actions"
+_OPT_OUT_PROVIDER = "none"
 
 
 @dataclass
@@ -30,7 +36,11 @@ class CiConfig:
     @classmethod
     def from_mapping(cls, value: Mapping[str, Any] | None) -> "CiConfig":
         if not isinstance(value, Mapping):
-            return cls(provider="none")
+            # Missing ``ci:`` section is no longer treated as a silent opt-out.
+            # The default provider applies; if no workflow files exist this
+            # surfaces as a normal red ``ci_workflow_missing`` finding rather
+            # than a free PASS.
+            return cls()
 
         config = cls()
         return cls(
@@ -87,17 +97,67 @@ class CiHealthCheck(DagCheck):
         del dag
         root = Path(project_root or self.project_root or ".").resolve()
         active_settings = codd_config or settings or self.settings
-        return self.check(root, CiConfig.from_mapping(_mapping_value(active_settings, "ci")))
+        config = CiConfig.from_mapping(_mapping_value(active_settings, "ci"))
+        return self.check(root, config)
+
+    def detect_opt_out(self, codd_config: dict[str, Any]) -> OptOutSignal | None:
+        config = CiConfig.from_mapping(_mapping_value(codd_config, "ci"))
+        if self._is_opt_out_provider(config):
+            return OptOutSignal(
+                check_name=self.check_name,
+                source="ci.provider=none",
+            )
+        return None
 
-    def check(self, project_root: Path, config: CiConfig) -> CiHealthResult:
-        project_root = Path(project_root).resolve()
-        if config.provider.strip().lower() == "none":
+    @staticmethod
+    def _is_opt_out_provider(config: CiConfig) -> bool:
+        return config.provider.strip().lower() == _OPT_OUT_PROVIDER
+
+    def _make_opt_out_result(self, declaration: OptOutDeclaration | None) -> CiHealthResult:
+        today = self.today
+        if declaration is None:
+            return CiHealthResult(
+                status="fail",
+                severity="red",
+                block_deploy=True,
+                message=(
+                    "C8 ci_health: ci.provider=none requires an opt_outs declaration "
+                    "in codd.yaml (check: ci_health, reason: ..., expires_at: "
+                    "YYYY-MM-DD)."
+                ),
+                passed=False,
+            )
+        if declaration.is_expired(today):
             return CiHealthResult(
-                status="skip",
-                message="ci.provider=none, C8 SKIP",
-                passed=True,
+                status="fail",
+                severity="red",
+                block_deploy=True,
+                message=(
+                    f"C8 ci_health: opt-out expired on "
+                    f"{declaration.expires_at.isoformat()} "
+                    f"(reason: {declaration.reason}); renew the entry or remove it."
+                ),
+                passed=False,
             )
+        return CiHealthResult(
+            status=OPT_OUT_STATUS,
+            severity=self.severity,
+            block_deploy=False,
+            message=(
+                f"C8 ci_health opt-out active "
+                f"(reason: {declaration.reason}, "
+                f"expires: {declaration.expires_at.isoformat()})"
+            ),
+            passed=False,
+        )
 
+    def check(self, project_root: Path, config: CiConfig) -> CiHealthResult:
+        project_root = Path(project_root).resolve()
+        if self._is_opt_out_provider(config):
+            declaration = (
+                self.opt_out_policy.lookup(self.check_name) if self.opt_out_policy else None
+            )
+            return self._make_opt_out_result(declaration)
         workflow_files = self._locate_workflows(project_root, config.workflow_glob)
         if not workflow_files:
             finding = CiHealthFinding(