feat(observability): Phase A.2 — verbatim provider.request "after" capture + self-redaction (267 tests)

Threads the step span's correlated logger into provider.stream (new optional ProviderStreamOptions.logger) so provider-openai-compat opens a child provider.request span at the fetch edge, capturing the verbatim post-transform request + response status/cache-tokens/raw-error. Auth header self-redacted in the provider's OWN code (graduated mask tiers; no shared helper). Capture is fail-safe (never throws into the turn). Adds the first hermetic provider HTTP test (stream.test.ts: fetch mocked, 15 cases). Large payloads use attributes for now; the LogRecord.body channel is a deferred ABI design (notes §10).

Verified: tsc -b clean, 267 tests (250->+17), biome 0 warnings/0 infos. Live boot: provider.request shares turnId with prompt:before (before<->after diffable); auth-key leak count = 0 (self-redaction proven on a real request).

1 files changed, 84 insertions, 19 deletions

diff --git a/packages/kernel/src/runtime/run-turn.test.ts b/packages/kernel/src/runtime/run-turn.test.ts
index 48f0b5a..667476f 100644
--- a/packages/kernel/src/runtime/run-turn.test.ts
+++ b/packages/kernel/src/runtime/run-turn.test.ts
@@ -817,26 +817,26 @@ describe("runTurn", () => {
 		}
 	});
 
-	describe("span instrumentation", () => {
-		function createTestLogger(): {
-			logger: Logger;
-			sink: LogSink & { records: LogRecord[] };
-			deps: LogDeps;
-		} {
-			let idCounter = 0;
-			const deps: LogDeps = {
-				now: () => 1000 + idCounter * 100,
-				newId: () => `span-${++idCounter}`,
-			};
-			const records: LogRecord[] = [];
-			const sink: LogSink & { records: LogRecord[] } = {
-				records,
-				emit: (record) => records.push(record),
-			};
-			const logger = createLogger({ extensionId: "test" }, sink, deps);
-			return { logger, sink, deps };
-		}
+	function createTestLogger(): {
+		logger: Logger;
+		sink: LogSink & { records: LogRecord[] };
+		deps: LogDeps;
+	} {
+		let idCounter = 0;
+		const deps: LogDeps = {
+			now: () => 1000 + idCounter * 100,
+			newId: () => `span-${++idCounter}`,
+		};
+		const records: LogRecord[] = [];
+		const sink: LogSink & { records: LogRecord[] } = {
+			records,
+			emit: (record) => records.push(record),
+		};
+		const logger = createLogger({ extensionId: "test" }, sink, deps);
+		return { logger, sink, deps };
+	}
 
+	describe("span instrumentation", () => {
 		it("emits turn + step span open/close in order", async () => {
 			const provider = createFakeProvider([
 				[
@@ -1040,4 +1040,69 @@ describe("runTurn", () => {
 			}
 		});
 	});
+
+	describe("provider logger threading", () => {
+		it("passes step span logger to provider.stream opts when logger provided", async () => {
+			let capturedOpts: Record<string, unknown> | undefined;
+
+			const provider: ProviderContract = {
+				id: "fake",
+				stream(_messages, _tools, opts) {
+					capturedOpts = opts !== undefined ? { ...opts } : undefined;
+					return (async function* () {
+						yield { type: "text-delta", delta: "hi" } as ProviderEvent;
+						yield { type: "usage", usage: { inputTokens: 1, outputTokens: 1 } } as ProviderEvent;
+						yield { type: "finish", reason: "stop" } as ProviderEvent;
+					})();
+				},
+			};
+
+			const { logger } = createTestLogger();
+
+			await runTurn({
+				provider,
+				messages: [userMessage],
+				tools: [],
+				dispatch: { maxConcurrent: 1, eager: false },
+				conversationId: "conv-1",
+				turnId: "turn-1",
+				emit: () => {},
+				logger,
+			});
+
+			expect(capturedOpts).toBeDefined();
+			expect(capturedOpts?.logger).toBeDefined();
+			expect(typeof (capturedOpts?.logger as Record<string, unknown>).info).toBe("function");
+			expect(typeof (capturedOpts?.logger as Record<string, unknown>).span).toBe("function");
+		});
+
+		it("passes undefined for opts.logger when no logger provided", async () => {
+			let capturedOpts: Record<string, unknown> | undefined;
+
+			const provider: ProviderContract = {
+				id: "fake",
+				stream(_messages, _tools, opts) {
+					capturedOpts = opts !== undefined ? { ...opts } : undefined;
+					return (async function* () {
+						yield { type: "text-delta", delta: "hi" } as ProviderEvent;
+						yield { type: "usage", usage: { inputTokens: 1, outputTokens: 1 } } as ProviderEvent;
+						yield { type: "finish", reason: "stop" } as ProviderEvent;
+					})();
+				},
+			};
+
+			await runTurn({
+				provider,
+				messages: [userMessage],
+				tools: [],
+				dispatch: { maxConcurrent: 1, eager: false },
+				conversationId: "conv-1",
+				turnId: "turn-1",
+				emit: () => {},
+			});
+
+			expect(capturedOpts).toBeDefined();
+			expect(capturedOpts?.logger).toBeUndefined();
+		});
+	});
 });