# Phase 6: Kernel Observability - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.

**Date:** 2026-03-23
**Phase:** 06-kernel-observability
**Mode:** --auto (all gray areas auto-selected, recommended defaults applied)
**Areas discussed:** Marker Format, dmesg Parsing, Classifier Patterns, Module Placement

---

## Marker Format

| Option | Description | Selected |
|--------|-------------|----------|
| `echo "vmcluster-marker-{uuid4}" > /dev/kmsg` via SSH | Simple, no kernel module needed; root SSH already available; marker appears in dmesg with kernel timestamp | ✓ |
| Write via `logger -k` | Alternative kernel log injection; less direct than /dev/kmsg | |
| Custom kernel module marker | Maximum precision; far too complex for v1 | |

**Auto-selected:** `echo "vmcluster-marker-{uuid4}" > /dev/kmsg` via SSH (recommended default)
**Notes:** Single UUID per `dmesg_mark` call shared across all nodes in the call. Marker string returned to caller for use in `dmesg_collect`.

---

## dmesg Parsing

| Option | Description | Selected |
|--------|-------------|----------|
| `dmesg -r` with raw `[seconds.us]` timestamps | Universal; works on all kernels; requires manual timestamp parsing | ✓ |
| `dmesg -r --time-format=iso` | ISO timestamps easier to parse; not available on older kernels | |
| `/dev/kmsg` direct read | Most structured; requires parsing binary-ish format; more complex | |

**Auto-selected:** `dmesg -r` with fallback detection (try `--time-format=iso`, fall back to raw) (recommended default)
**Notes:** Reuses Phase 3 `SSHConnectionManager.execute()`. Concurrent across nodes via `asyncio.gather`.

---

## Classifier Patterns

| Option | Description | Selected |
|--------|-------------|----------|
| Single-pass regex, first-match-wins priority | Simple, O(n) per line, extensible; priority: panic > oops > kasan > ubsan > warn > normal | ✓ |
| Multi-pass (one regex per category) | Allows multi-label per line; more complex result model | |
| External classifier library | Overkill for v1; adds dependency | |

**Auto-selected:** Single-pass regex, first-match-wins (recommended default)
**Notes:** Baseline patterns: `"Kernel panic"`, `"Oops:"`, `"KASAN:"`, `"UBSAN:"`, `"WARNING:"`. Researcher confirms/extends. Pure function in `classifier.py` — no SSH dependency.

---

## Module Placement

| Option | Description | Selected |
|--------|-------------|----------|
| `observe/dmesg.py` + `observe/classifier.py` per design doc | Matches design doc layout exactly; consistent with existing module structure | ✓ |
| Inline in `observe/__init__.py` | Simpler for small phase; deviates from design doc | |

**Auto-selected:** Follow design doc layout (`observe/dmesg.py` + `observe/classifier.py`) (recommended default)
**Notes:** `observe/__init__.py` registers tools; `dmesg.py` handles SSH collection; `classifier.py` is pure pattern matching.

---

## Agent's Discretion

- Exact fallback detection mechanism for `dmesg --time-format=iso` availability
- Precise regex patterns beyond the baseline five (researcher to confirm)
- Whether `dmesg_mark` return type should be `ToolResult[dict[str, str]]` or bare `dict[str, str]` (design doc says bare; error contract suggests wrapped)

## Deferred Ideas

- Real-time dmesg streaming → OBS-V2-02
- Per-node CPU/memory/disk metrics → OBS-V2-01
