feat(observability): Phase A.2 — verbatim provider.request "after" capture + self-redaction (267 tests)

Threads the step span's correlated logger into provider.stream (new optional ProviderStreamOptions.logger) so provider-openai-compat opens a child provider.request span at the fetch edge, capturing the verbatim post-transform request + response status/cache-tokens/raw-error. Auth header self-redacted in the provider's OWN code (graduated mask tiers; no shared helper). Capture is fail-safe (never throws into the turn). Adds the first hermetic provider HTTP test (stream.test.ts: fetch mocked, 15 cases). Large payloads use attributes for now; the LogRecord.body channel is a deferred ABI design (notes §10).

Verified: tsc -b clean, 267 tests (250->+17), biome 0 warnings/0 infos. Live boot: provider.request shares turnId with prompt:before (before<->after diffable); auth-key leak count = 0 (self-redaction proven on a real request).

1 files changed, 9 insertions, 0 deletions

diff --git a/packages/kernel/src/contracts/provider.ts b/packages/kernel/src/contracts/provider.ts
index 1d0fd75..62dc8e9 100644
--- a/packages/kernel/src/contracts/provider.ts
+++ b/packages/kernel/src/contracts/provider.ts
@@ -7,6 +7,7 @@
  */
 
 import type { ChatMessage } from "./conversation.js";
+import type { Logger } from "./logging.js";
 import type { ToolContract } from "./tool.js";
 
 /**
@@ -92,6 +93,14 @@ export interface ProviderStreamOptions {
 	readonly maxTokens?: number;
 	/** System prompt to prepend. */
 	readonly systemPrompt?: string;
+	/**
+	 * Correlated logger for this turn's step (Phase A logging ABI). When present,
+	 * the provider should open a child `provider.request` span and capture the
+	 * verbatim post-transform request + raw response/error there, self-redacting
+	 * secrets in its own code. Optional so non-instrumented callers/tests still
+	 * compile (the provider falls back to no capture).
+	 */
+	readonly logger?: Logger;
 }
 
 /**