feat(observability): Phase A logging substrate — Logger/Span ABI + journal sink (250 tests)

Structured, agent-first logging captured durably to an append-only journal file.

Kernel (contracts/logging.ts): leveled/attributed Logger + Span, auto-scoped per extension (host stamps manifest.id, unspoofable), incremental span records (open/close) for crash-reconstructable traces, injected LogSink (pure record-builder). ctx.log on ToolContract; runTurn opens turn/step/tool-call spans and captures the verbatim pre-mutation prompt (the 'before') on the step span.

journal-sink (new package, bootstrap dep — not an extension): LogSink appending NDJSON to a rotating journal; pure serialize + thin fs edge; fail-safe drop, never blocks a turn. host-bin injects it via HostDeps; session-orchestrator threads host.logger (childed per turn) into runTurn.

Redaction is per-extension self-redaction (no shared helper — isolation over DRY). The out-of-process collector + SQLite store + the verbatim 'after' provider.request capture are Phase B / next (notes/observability-design.md §10/§11).

Verified: tsc -b clean, 250 tests (218→+32), biome clean. Live boot: a turn's journal holds host logs + turn/step spans (open+close) + the prompt:before record with the verbatim messages array.

Harness: ORCHESTRATOR §3 rule-scoping map; .dispatch/rules/isolation-over-dry.md; notes/observability-design.md (design D1–D10 + Phase A/B plan).

2 files changed, 232 insertions, 18 deletions

diff --git a/packages/kernel/src/host/host.test.ts b/packages/kernel/src/host/host.test.ts
index 11c2356..7688366 100644
--- a/packages/kernel/src/host/host.test.ts
+++ b/packages/kernel/src/host/host.test.ts
@@ -6,7 +6,6 @@ import type {
 	EventsEmitter,
 	Extension,
 	HostAPI,
-	Logger,
 	Manifest,
 	ManifestContributions,
 	PermissionDecision,
@@ -17,33 +16,92 @@ import type {
 	StorageNamespace,
 } from "../contracts/extension.js";
 import { defineEventHook, defineService } from "../contracts/hooks.js";
+import type {
+	Attributes,
+	ErrorAttributes,
+	LogDeps,
+	Logger,
+	LogRecord,
+	LogSink,
+} from "../contracts/logging.js";
 import type { ProviderContract } from "../contracts/provider.js";
 import type { ToolContract } from "../contracts/tool.js";
 import { createHost, type HostDeps, KERNEL_API_VERSION } from "./host.js";
 
 interface FakeLogger extends Logger {
-	readonly logs: Array<{ level: string; message: string; args: unknown[] }>;
+	readonly logs: Array<{ level: string; message: string; attrs?: Attributes | ErrorAttributes }>;
 }
 
 function createFakeLogger(): FakeLogger {
-	const logs: Array<{ level: string; message: string; args: unknown[] }> = [];
+	const logs: Array<{ level: string; message: string; attrs?: Attributes | ErrorAttributes }> = [];
 	return {
 		logs,
-		debug: (message: string, ...args: unknown[]) => {
-			logs.push({ level: "debug", message, args });
+		debug: (message: string, attrs?: Attributes) => {
+			if (attrs !== undefined) {
+				logs.push({ level: "debug", message, attrs });
+			} else {
+				logs.push({ level: "debug", message });
+			}
+		},
+		info: (message: string, attrs?: Attributes) => {
+			if (attrs !== undefined) {
+				logs.push({ level: "info", message, attrs });
+			} else {
+				logs.push({ level: "info", message });
+			}
+		},
+		warn: (message: string, attrs?: Attributes) => {
+			if (attrs !== undefined) {
+				logs.push({ level: "warn", message, attrs });
+			} else {
+				logs.push({ level: "warn", message });
+			}
 		},
-		info: (message: string, ...args: unknown[]) => {
-			logs.push({ level: "info", message, args });
+		error: (message: string, attrs?: ErrorAttributes) => {
+			if (attrs !== undefined) {
+				logs.push({ level: "error", message, attrs });
+			} else {
+				logs.push({ level: "error", message });
+			}
 		},
-		warn: (message: string, ...args: unknown[]) => {
-			logs.push({ level: "warn", message, args });
+		child(
+			_ctx: Partial<import("../contracts/logging.js").LogContext> & { readonly attrs?: Attributes },
+		): Logger {
+			return createFakeLogger();
 		},
-		error: (message: string, ...args: unknown[]) => {
-			logs.push({ level: "error", message, args });
+		span(_name: string, _attrs?: Attributes): import("../contracts/logging.js").Span {
+			return {
+				id: "fake-span",
+				log: createFakeLogger(),
+				setAttributes() {},
+				addLink() {},
+				child() {
+					return this;
+				},
+				end() {},
+			};
 		},
 	};
 }
 
+function createFakeLogSink(): LogSink & { readonly records: LogRecord[] } {
+	const records: LogRecord[] = [];
+	return {
+		records,
+		emit: (record: LogRecord) => {
+			records.push(record);
+		},
+	};
+}
+
+function createFakeLogDeps(): LogDeps {
+	let idCounter = 0;
+	return {
+		now: () => 1000 + idCounter * 100,
+		newId: () => `span-${++idCounter}`,
+	};
+}
+
 function createFakeConfig(): ConfigAccess {
 	return {
 		get: () => undefined,
@@ -176,12 +234,16 @@ function createFakeAuth(id: string): AuthContract {
 
 describe("createHost", () => {
 	let logger: FakeLogger;
+	let logSink: ReturnType<typeof createFakeLogSink>;
+	let logDeps: LogDeps;
 	let deps: HostDeps;
 	let scheduler: ReturnType<typeof createFakeScheduler>;
 	let events: ReturnType<typeof createFakeEvents>;
 
 	beforeEach(() => {
 		logger = createFakeLogger();
+		logSink = createFakeLogSink();
+		logDeps = createFakeLogDeps();
 		scheduler = createFakeScheduler();
 		events = createFakeEvents();
 		deps = {
@@ -193,6 +255,8 @@ describe("createHost", () => {
 			scheduler,
 			bus: createBus(logger),
 			events,
+			logSink,
+			logDeps,
 		};
 	});
 
@@ -529,6 +593,7 @@ describe("createHost", () => {
 			expect(order).toEqual(["deactivate-c", "deactivate-a"]);
 			const errors = logger.logs.filter((l) => l.level === "error");
 			expect(errors.some((e) => e.message.includes("deactivate"))).toBe(true);
+			expect(errors.some((e) => (e.attrs as { err?: unknown })?.err instanceof Error)).toBe(true);
 		});
 	});
 
@@ -750,4 +815,146 @@ describe("createHost", () => {
 			);
 		});
 	});
+
+	describe("auto-scoped logger (D6)", () => {
+		it("each extension's logger stamps its own manifest.id as extensionId", async () => {
+			let extALogger: Logger | undefined;
+			let extBLogger: Logger | undefined;
+
+			const a = createExtension("ext-a", {
+				activate: (host) => {
+					extALogger = host.logger;
+				},
+			});
+			const b = createExtension("ext-b", {
+				activate: (host) => {
+					extBLogger = host.logger;
+				},
+			});
+
+			const host = createHost([a, b], deps);
+			await host.activate();
+
+			extALogger?.info("from-a");
+			extBLogger?.info("from-b");
+
+			const logRecords = logSink.records.filter((r) => r.kind === "log");
+			expect(logRecords).toHaveLength(2);
+			if (logRecords[0]?.kind === "log") {
+				expect(logRecords[0].extensionId).toBe("ext-a");
+				expect(logRecords[0].msg).toBe("from-a");
+			}
+			if (logRecords[1]?.kind === "log") {
+				expect(logRecords[1].extensionId).toBe("ext-b");
+				expect(logRecords[1].msg).toBe("from-b");
+			}
+		});
+
+		it("an extension cannot spoof extensionId — it is auto-stamped", async () => {
+			let extLogger: Logger | undefined;
+
+			const ext = createExtension("real-id", {
+				activate: (host) => {
+					extLogger = host.logger;
+				},
+			});
+
+			const host = createHost([ext], deps);
+			await host.activate();
+
+			// child() cannot override extensionId
+			const child = extLogger?.child({ extensionId: "spoofed" });
+			child?.info("msg");
+
+			const logRecords = logSink.records.filter((r) => r.kind === "log");
+			expect(logRecords).toHaveLength(1);
+			if (logRecords[0]?.kind === "log") {
+				expect(logRecords[0].extensionId).toBe("real-id");
+			}
+		});
+
+		it("host.logger.error uses structured { err } shape", async () => {
+			let extLogger: Logger | undefined;
+
+			const ext = createExtension("ext", {
+				activate: (host) => {
+					extLogger = host.logger;
+				},
+			});
+
+			const host = createHost([ext], deps);
+			await host.activate();
+
+			extLogger?.error("something broke", { err: new Error("boom") });
+
+			const logRecords = logSink.records.filter((r) => r.kind === "log");
+			expect(logRecords).toHaveLength(1);
+			if (logRecords[0]?.kind === "log") {
+				expect(logRecords[0].level).toBe("error");
+				expect(logRecords[0].msg).toBe("something broke");
+				expect(logRecords[0].attributes?.["error.message"]).toBe("boom");
+			}
+		});
+
+		it("a throwing sink does NOT break the caller", async () => {
+			const brokenSink: LogSink = {
+				emit() {
+					throw new Error("sink down");
+				},
+			};
+			const brokenDeps: HostDeps = {
+				...deps,
+				logSink: brokenSink,
+			};
+
+			let extLogger: Logger | undefined;
+			const ext = createExtension("ext", {
+				activate: (host) => {
+					extLogger = host.logger;
+				},
+			});
+
+			const host = createHost([ext], brokenDeps);
+			await host.activate();
+
+			// Should not throw
+			expect(() => extLogger?.info("msg")).not.toThrow();
+		});
+
+		it("span() + end() emit incremental span-open and span-close records", async () => {
+			let extLogger: Logger | undefined;
+
+			const ext = createExtension("ext", {
+				activate: (host) => {
+					extLogger = host.logger;
+				},
+			});
+
+			const host = createHost([ext], deps);
+			await host.activate();
+
+			const span = extLogger?.span("my-span", { key: "value" });
+			span?.setAttributes({ extra: "attr" });
+			span?.end({ attrs: { result: "ok" } });
+
+			const spanOpens = logSink.records.filter((r) => r.kind === "span-open");
+			const spanCloses = logSink.records.filter((r) => r.kind === "span-close");
+
+			expect(spanOpens).toHaveLength(1);
+			expect(spanCloses).toHaveLength(1);
+
+			if (spanOpens[0]?.kind === "span-open") {
+				expect(spanOpens[0].name).toBe("my-span");
+				expect(spanOpens[0].extensionId).toBe("ext");
+				expect(spanOpens[0].attributes?.key).toBe("value");
+			}
+			if (spanCloses[0]?.kind === "span-close") {
+				expect(spanCloses[0].name).toBe("my-span");
+				expect(spanCloses[0].status).toBe("ok");
+				expect(spanCloses[0].durationMs).toBeGreaterThanOrEqual(0);
+				expect(spanCloses[0].attributes?.extra).toBe("attr");
+				expect(spanCloses[0].attributes?.result).toBe("ok");
+			}
+		});
+	});
 });
diff --git a/packages/kernel/src/host/host.ts b/packages/kernel/src/host/host.ts
index dd61f9f..c7ec7a9 100644
--- a/packages/kernel/src/host/host.ts
+++ b/packages/kernel/src/host/host.ts
@@ -5,7 +5,6 @@ import type {
 	EventsEmitter,
 	Extension,
 	HostAPI,
-	Logger,
 	Manifest,
 	PermissionGate,
 	ScheduledJob,
@@ -19,6 +18,8 @@ import type {
 	FilterHandler,
 	ServiceHandle,
 } from "../contracts/hooks.js";
+import type { LogDeps, Logger, LogSink } from "../contracts/logging.js";
+import { createLogger } from "../contracts/logging.js";
 import type { ProviderContract } from "../contracts/provider.js";
 import type { ToolContract } from "../contracts/tool.js";
 import { resolveActivationOrder } from "./dag.js";
@@ -40,6 +41,8 @@ export interface HostDeps {
 	readonly scheduler: { readonly register: (job: ScheduledJob) => void };
 	readonly bus: Bus;
 	readonly events: EventsEmitter;
+	readonly logSink: LogSink;
+	readonly logDeps: LogDeps;
 }
 
 export interface Host {
@@ -96,8 +99,12 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 		}
 	}
 
-	function buildHostAPI(opts?: { readonly registrationClosed?: boolean }): HostAPI {
+	function buildHostAPI(
+		extensionId: string,
+		opts?: { readonly registrationClosed?: boolean },
+	): HostAPI {
 		const closed = opts?.registrationClosed ?? false;
+		const extLogger = createLogger({ extensionId }, deps.logSink, deps.logDeps);
 		return {
 			defineTool(tool: ToolContract) {
 				if (closed) throw new Error("Registration not available after activation");
@@ -130,7 +137,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 			secrets: deps.secrets,
 			permissions: deps.permissions,
 			events: deps.events,
-			logger: deps.logger,
+			logger: extLogger,
 			getProviders() {
 				return providers;
 			},
@@ -156,7 +163,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 		async activate() {
 			for (const ext of compatible) {
 				try {
-					await ext.activate(buildHostAPI());
+					await ext.activate(buildHostAPI(ext.manifest.id));
 					activated.push(ext);
 					deps.logger.info(`Extension "${ext.manifest.id}" activated`);
 				} catch (err) {
@@ -164,7 +171,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 						manifest: ext.manifest,
 						reason: `Activation failed: ${err instanceof Error ? err.message : String(err)}`,
 					});
-					deps.logger.error(`Extension "${ext.manifest.id}" failed to activate`, err);
+					deps.logger.error(`Extension "${ext.manifest.id}" failed to activate`, { err });
 				}
 			}
 		},
@@ -175,7 +182,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 				try {
 					await ext.deactivate();
 				} catch (err) {
-					deps.logger.error(`Extension "${ext.manifest.id}" failed to deactivate`, err);
+					deps.logger.error(`Extension "${ext.manifest.id}" failed to deactivate`, { err });
 				}
 			}
 		},
@@ -207,7 +214,7 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 			return disabled;
 		},
 		getHostAPI() {
-			return buildHostAPI({ registrationClosed: true });
+			return buildHostAPI("__host__", { registrationClosed: true });
 		},
 	};
 }