feat(observability): Phase A logging substrate — Logger/Span ABI + journal sink (250 tests)

Structured, agent-first logging captured durably to an append-only journal file.

Kernel (contracts/logging.ts): leveled/attributed Logger + Span, auto-scoped per extension (host stamps manifest.id, unspoofable), incremental span records (open/close) for crash-reconstructable traces, injected LogSink (pure record-builder). ctx.log on ToolContract; runTurn opens turn/step/tool-call spans and captures the verbatim pre-mutation prompt (the 'before') on the step span.

journal-sink (new package, bootstrap dep — not an extension): LogSink appending NDJSON to a rotating journal; pure serialize + thin fs edge; fail-safe drop, never blocks a turn. host-bin injects it via HostDeps; session-orchestrator threads host.logger (childed per turn) into runTurn.

Redaction is per-extension self-redaction (no shared helper — isolation over DRY). The out-of-process collector + SQLite store + the verbatim 'after' provider.request capture are Phase B / next (notes/observability-design.md §10/§11).

Verified: tsc -b clean, 250 tests (218→+32), biome clean. Live boot: a turn's journal holds host logs + turn/step spans (open+close) + the prompt:before record with the verbatim messages array.

Harness: ORCHESTRATOR §3 rule-scoping map; .dispatch/rules/isolation-over-dry.md; notes/observability-design.md (design D1–D10 + Phase A/B plan).

1 files changed, 14 insertions, 7 deletions

diff --git a/packages/kernel/src/host/host.ts b/packages/kernel/src/host/host.ts
index dd61f9f..c7ec7a9 100644
--- a/packages/kernel/src/host/host.ts
+++ b/packages/kernel/src/host/host.ts
@@ -5,7 +5,6 @@ import type {
 	EventsEmitter,
 	Extension,
 	HostAPI,
-	Logger,
 	Manifest,
 	PermissionGate,
 	ScheduledJob,
@@ -19,6 +18,8 @@ import type {
 	FilterHandler,
 	ServiceHandle,
 } from "../contracts/hooks.js";
+import type { LogDeps, Logger, LogSink } from "../contracts/logging.js";
+import { createLogger } from "../contracts/logging.js";
 import type { ProviderContract } from "../contracts/provider.js";
 import type { ToolContract } from "../contracts/tool.js";
 import { resolveActivationOrder } from "./dag.js";
@@ -40,6 +41,8 @@ export interface HostDeps {
 	readonly scheduler: { readonly register: (job: ScheduledJob) => void };
 	readonly bus: Bus;
 	readonly events: EventsEmitter;
+	readonly logSink: LogSink;
+	readonly logDeps: LogDeps;
 }
 
 export interface Host {
@@ -96,8 +99,12 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 		}
 	}
 
-	function buildHostAPI(opts?: { readonly registrationClosed?: boolean }): HostAPI {
+	function buildHostAPI(
+		extensionId: string,
+		opts?: { readonly registrationClosed?: boolean },
+	): HostAPI {
 		const closed = opts?.registrationClosed ?? false;
+		const extLogger = createLogger({ extensionId }, deps.logSink, deps.logDeps);
 		return {
 			defineTool(tool: ToolContract) {
 				if (closed) throw new Error("Registration not available after activation");
@@ -130,7 +137,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 			secrets: deps.secrets,
 			permissions: deps.permissions,
 			events: deps.events,
-			logger: deps.logger,
+			logger: extLogger,
 			getProviders() {
 				return providers;
 			},
@@ -156,7 +163,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 		async activate() {
 			for (const ext of compatible) {
 				try {
-					await ext.activate(buildHostAPI());
+					await ext.activate(buildHostAPI(ext.manifest.id));
 					activated.push(ext);
 					deps.logger.info(`Extension "${ext.manifest.id}" activated`);
 				} catch (err) {
@@ -164,7 +171,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 						manifest: ext.manifest,
 						reason: `Activation failed: ${err instanceof Error ? err.message : String(err)}`,
 					});
-					deps.logger.error(`Extension "${ext.manifest.id}" failed to activate`, err);
+					deps.logger.error(`Extension "${ext.manifest.id}" failed to activate`, { err });
 				}
 			}
 		},
@@ -175,7 +182,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 				try {
 					await ext.deactivate();
 				} catch (err) {
-					deps.logger.error(`Extension "${ext.manifest.id}" failed to deactivate`, err);
+					deps.logger.error(`Extension "${ext.manifest.id}" failed to deactivate`, { err });
 				}
 			}
 		},
@@ -207,7 +214,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 			return disabled;
 		},
 		getHostAPI() {
-			return buildHostAPI({ registrationClosed: true });
+			return buildHostAPI("__host__", { registrationClosed: true });
 		},
 	};
 }