Capture provider failures in secure debug artifacts

docs/integrations/promptkit.md

@@ -42,7 +42,7 @@ logical profile ID and resolved backend and model. Ordinary errors, summaries,
 logs, and outputs exclude endpoints, credentials, rendered messages, schemas,
 request bodies, response bodies, and complete parameter maps.
 
-Promptkit receives the YAML data package as an inline input and returns structured JSON that Weatherreporter validates before rendering its own Markdown template. Before accepting that JSON, Weatherreporter requires exactly one preparation callback and reconciles its prompt/profile/backend/model and rendered/input hashes with the inspected identity and completed result. The callback output contract and completed validation must use the report's expected JSON Schema mode and path. The package contains only reviewed prompt-facing warning summaries, never source transport or provenance details. Safe active provenance remains in memory. Content-rich diagnostics are opt-in through `--llm-debug-dir`; see [operations](../operations.md) for retention and permissions.
+Promptkit receives the YAML data package as an inline input and returns structured JSON that Weatherreporter validates before rendering its own Markdown template. Before accepting that JSON, Weatherreporter requires exactly one preparation callback and reconciles its prompt/profile/backend/model and rendered/input hashes with the inspected identity and completed result. The callback output contract and completed validation must use the report's expected JSON Schema mode and path. The package contains only reviewed prompt-facing warning summaries, never source transport or provenance details. Safe active provenance remains in memory. Content-rich diagnostics are opt-in through `--llm-debug-dir`; see [operations](../operations.md) for retention and permissions. Ordinary generation errors disclose only the safe Weatherreporter category and optional HTTP status; provider code, type, and message are written only to the explicit secure failure-debug artifact.
 
 Each embedded prompt permits one Promptkit-owned corrective generation after an
 eligible failed or explicitly empty result. This is not an application retry:

docs/operations.md

@@ -178,6 +178,12 @@ Preparation captures retain only the provider endpoint origin and reviewed
 execution settings. URL user information, paths, queries, fragments, and
 unrecognized provider parameters are omitted.
 
+Each run directory may contain `preparation.json` (v3), `execution.json` (v3),
+and, for a provider generation failure, `failure.json` (v1). The failure
+artifact retains the safe category, HTTP status, and provider code, type, and
+message for trusted debugging only. Ordinary command output never includes
+those provider details.
+
 Capture writes are confined to the requested root and fail if an unsafe
 filesystem component prevents secure artifact creation.
 

docs/policy/architecture.md

@@ -66,6 +66,8 @@ directly.
 - Sensitive rendered prompts, schemas, input bodies, provider endpoints, and
   credentials never enter normal summaries or logs. They are written only to
   an explicit secure debug root when requested.
+- Provider-controlled diagnostics never enter ordinary outputs; they are
+  retained only in explicit secure failure-debug artifacts.
 
 ## Output, Notification, And Testing Invariants
 

docs/roadmap/implementation.md

@@ -439,6 +439,8 @@ GOWORK=off go test -race -count=1 ./internal/comparison ./internal/app
 
 ### Stage 8: Add Secure Provider-Failure Debug Capture
 
+Status: Complete.
+
 Purpose: expose useful PromptKit v0.7.0 provider diagnostics only through the
 existing explicit secure debug boundary while keeping ordinary errors safe.