Refactor bee CLI and LiveCD integration

2026-03-13 16:52:16 +03:00
parent b7c888edb1
commit 6aca1682b9
47 changed files with 3137 additions and 1201 deletions
--- a/audit/internal/app/app.go
+++ b/audit/internal/app/app.go
@@ -0,0 +1,311 @@
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"bee/audit/internal/collector"
+	"bee/audit/internal/platform"
+	"bee/audit/internal/runtimeenv"
+)
+
+const (
+	DefaultAuditJSONPath = "/var/log/bee-audit.json"
+	DefaultAuditLogPath  = "/var/log/bee-audit.log"
+)
+
+type App struct {
+	network  networkManager
+	services serviceManager
+	exports  exportManager
+	tools    toolManager
+	sat      satRunner
+}
+
+type ActionResult struct {
+	Title string
+	Body  string
+}
+
+type networkManager interface {
+	ListInterfaces() ([]platform.InterfaceInfo, error)
+	DefaultRoute() string
+	DHCPOne(iface string) (string, error)
+	DHCPAll() (string, error)
+	SetStaticIPv4(cfg platform.StaticIPv4Config) (string, error)
+}
+
+type serviceManager interface {
+	ListBeeServices() ([]string, error)
+	ServiceStatus(name string) (string, error)
+	ServiceDo(name string, action platform.ServiceAction) (string, error)
+}
+
+type exportManager interface {
+	ListRemovableTargets() ([]platform.RemovableTarget, error)
+	ExportFileToTarget(src string, target platform.RemovableTarget) (string, error)
+}
+
+type toolManager interface {
+	TailFile(path string, lines int) string
+	CheckTools(names []string) []platform.ToolStatus
+}
+
+type satRunner interface {
+	RunNvidiaAcceptancePack(baseDir string) (string, error)
+}
+
+func New(platform *platform.System) *App {
+	return &App{
+		network:  platform,
+		services: platform,
+		exports:  platform,
+		tools:    platform,
+		sat:      platform,
+	}
+}
+
+func (a *App) RunAudit(runtimeMode runtimeenv.Mode, output string) (string, error) {
+	result := collector.Run(runtimeMode)
+	data, err := json.MarshalIndent(result, "", "  ")
+	if err != nil {
+		return "", err
+	}
+
+	switch {
+	case output == "stdout":
+		_, err := os.Stdout.Write(append(data, '\n'))
+		return "stdout", err
+	case strings.HasPrefix(output, "file:"):
+		path := strings.TrimPrefix(output, "file:")
+		if err := os.WriteFile(path, append(data, '\n'), 0644); err != nil {
+			return "", err
+		}
+		return path, nil
+	default:
+		return "", fmt.Errorf("unknown output destination %q — use stdout or file:<path>", output)
+	}
+}
+
+func (a *App) RunAuditNow(runtimeMode runtimeenv.Mode) (ActionResult, error) {
+	path, err := a.RunAudit(runtimeMode, "file:"+DefaultAuditJSONPath)
+	body := "Audit completed."
+	if path != "" {
+		body = "Audit output: " + path
+	}
+	return ActionResult{Title: "Run audit", Body: body}, err
+}
+
+func (a *App) RunAuditToDefaultFile(runtimeMode runtimeenv.Mode) (string, error) {
+	return a.RunAudit(runtimeMode, "file:"+DefaultAuditJSONPath)
+}
+
+func (a *App) ExportLatestAudit(target platform.RemovableTarget) (string, error) {
+	if _, err := os.Stat(DefaultAuditJSONPath); err != nil {
+		return "", err
+	}
+	filename := fmt.Sprintf("audit-%s-%s.json", sanitizeFilename(hostnameOr("unknown")), time.Now().UTC().Format("20060102-150405"))
+	tmpPath := filepath.Join(os.TempDir(), filename)
+	data, err := os.ReadFile(DefaultAuditJSONPath)
+	if err != nil {
+		return "", err
+	}
+	if err := os.WriteFile(tmpPath, data, 0644); err != nil {
+		return "", err
+	}
+	defer os.Remove(tmpPath)
+	return a.exports.ExportFileToTarget(tmpPath, target)
+}
+
+func (a *App) ExportLatestAuditResult(target platform.RemovableTarget) (ActionResult, error) {
+	path, err := a.ExportLatestAudit(target)
+	return ActionResult{Title: "Export audit", Body: "Audit exported to " + path}, err
+}
+
+func (a *App) ListInterfaces() ([]platform.InterfaceInfo, error) {
+	return a.network.ListInterfaces()
+}
+
+func (a *App) DefaultRoute() string {
+	return a.network.DefaultRoute()
+}
+
+func (a *App) DHCPOne(iface string) (string, error) {
+	return a.network.DHCPOne(iface)
+}
+
+func (a *App) DHCPOneResult(iface string) (ActionResult, error) {
+	body, err := a.network.DHCPOne(iface)
+	return ActionResult{Title: "DHCP on " + iface, Body: body}, err
+}
+
+func (a *App) DHCPAll() (string, error) {
+	return a.network.DHCPAll()
+}
+
+func (a *App) DHCPAllResult() (ActionResult, error) {
+	body, err := a.network.DHCPAll()
+	return ActionResult{Title: "DHCP all interfaces", Body: body}, err
+}
+
+func (a *App) SetStaticIPv4(cfg platform.StaticIPv4Config) (string, error) {
+	return a.network.SetStaticIPv4(cfg)
+}
+
+func (a *App) SetStaticIPv4Result(cfg platform.StaticIPv4Config) (ActionResult, error) {
+	body, err := a.network.SetStaticIPv4(cfg)
+	return ActionResult{Title: "Static IPv4 on " + cfg.Interface, Body: body}, err
+}
+
+func (a *App) NetworkStatus() (ActionResult, error) {
+	ifaces, err := a.network.ListInterfaces()
+	if err != nil {
+		return ActionResult{Title: "Network status"}, err
+	}
+	var body strings.Builder
+	for _, iface := range ifaces {
+		ipv4 := "(no IPv4)"
+		if len(iface.IPv4) > 0 {
+			ipv4 = strings.Join(iface.IPv4, ", ")
+		}
+		fmt.Fprintf(&body, "- %s: state=%s ip=%s\n", iface.Name, iface.State, ipv4)
+	}
+	if gw := a.network.DefaultRoute(); gw != "" {
+		fmt.Fprintf(&body, "\nDefault route: %s\n", gw)
+	}
+	return ActionResult{Title: "Network status", Body: strings.TrimSpace(body.String())}, nil
+}
+
+func (a *App) DefaultStaticIPv4FormFields(iface string) []string {
+	return []string{
+		"",
+		"24",
+		strings.TrimSpace(a.network.DefaultRoute()),
+		"77.88.8.8 77.88.8.1 1.1.1.1 8.8.8.8",
+	}
+}
+
+func (a *App) ParseStaticIPv4Config(iface string, fields []string) platform.StaticIPv4Config {
+	get := func(index int) string {
+		if index >= 0 && index < len(fields) {
+			return strings.TrimSpace(fields[index])
+		}
+		return ""
+	}
+	return platform.StaticIPv4Config{
+		Interface: iface,
+		Address:   get(0),
+		Prefix:    get(1),
+		Gateway:   get(2),
+		DNS:       strings.Fields(get(3)),
+	}
+}
+
+func (a *App) ListBeeServices() ([]string, error) {
+	return a.services.ListBeeServices()
+}
+
+func (a *App) ServiceStatus(name string) (string, error) {
+	return a.services.ServiceStatus(name)
+}
+
+func (a *App) ServiceStatusResult(name string) (ActionResult, error) {
+	body, err := a.services.ServiceStatus(name)
+	return ActionResult{Title: "service: " + name, Body: body}, err
+}
+
+func (a *App) ServiceDo(name string, action platform.ServiceAction) (string, error) {
+	return a.services.ServiceDo(name, action)
+}
+
+func (a *App) ServiceActionResult(name string, action platform.ServiceAction) (ActionResult, error) {
+	body, err := a.services.ServiceDo(name, action)
+	return ActionResult{Title: "service: " + name, Body: body}, err
+}
+
+func (a *App) ListRemovableTargets() ([]platform.RemovableTarget, error) {
+	return a.exports.ListRemovableTargets()
+}
+
+func (a *App) TailFile(path string, lines int) string {
+	return a.tools.TailFile(path, lines)
+}
+
+func (a *App) CheckTools(names []string) []platform.ToolStatus {
+	return a.tools.CheckTools(names)
+}
+
+func (a *App) ToolCheckResult(names []string) ActionResult {
+	var body strings.Builder
+	for _, tool := range a.tools.CheckTools(names) {
+		status := "MISSING"
+		if tool.OK {
+			status = "OK (" + tool.Path + ")"
+		}
+		fmt.Fprintf(&body, "- %s: %s\n", tool.Name, status)
+	}
+	return ActionResult{Title: "Required tools", Body: strings.TrimSpace(body.String())}
+}
+
+func (a *App) AuditLogTailResult() ActionResult {
+	body := a.tools.TailFile(DefaultAuditLogPath, 40) + "\n\n" + a.tools.TailFile(DefaultAuditJSONPath, 20)
+	return ActionResult{Title: "Audit log tail", Body: body}
+}
+
+func (a *App) RunNvidiaAcceptancePack(baseDir string) (string, error) {
+	return a.sat.RunNvidiaAcceptancePack(baseDir)
+}
+
+func (a *App) RunNvidiaAcceptancePackResult(baseDir string) (ActionResult, error) {
+	path, err := a.sat.RunNvidiaAcceptancePack(baseDir)
+	return ActionResult{Title: "NVIDIA SAT", Body: "Archive written to " + path}, err
+}
+
+func (a *App) FormatToolStatuses(statuses []platform.ToolStatus) string {
+	var body strings.Builder
+	for _, tool := range statuses {
+		status := "MISSING"
+		if tool.OK {
+			status = "OK (" + tool.Path + ")"
+		}
+		fmt.Fprintf(&body, "- %s: %s\n", tool.Name, status)
+	}
+	return strings.TrimSpace(body.String())
+}
+
+func (a *App) ParsePrefix(raw string, fallback int) int {
+	value, err := strconv.Atoi(strings.TrimSpace(raw))
+	if err != nil || value <= 0 {
+		return fallback
+	}
+	return value
+}
+
+func hostnameOr(fallback string) string {
+	hn, err := os.Hostname()
+	if err != nil || strings.TrimSpace(hn) == "" {
+		return fallback
+	}
+	return hn
+}
+
+func sanitizeFilename(v string) string {
+	var out []rune
+	for _, r := range v {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '-', r == '_', r == '.':
+			out = append(out, r)
+		default:
+			out = append(out, '-')
+		}
+	}
+	if len(out) == 0 {
+		return "unknown"
+	}
+	return string(out)
+}
--- a/audit/internal/app/app_test.go
+++ b/audit/internal/app/app_test.go
@@ -0,0 +1,279 @@
+package app
+
+import (
+	"errors"
+	"testing"
+
+	"bee/audit/internal/platform"
+)
+
+type fakeNetwork struct {
+	listInterfacesFn func() ([]platform.InterfaceInfo, error)
+	defaultRouteFn   func() string
+	dhcpOneFn        func(string) (string, error)
+	dhcpAllFn        func() (string, error)
+	setStaticIPv4Fn  func(platform.StaticIPv4Config) (string, error)
+}
+
+func (f fakeNetwork) ListInterfaces() ([]platform.InterfaceInfo, error) {
+	return f.listInterfacesFn()
+}
+
+func (f fakeNetwork) DefaultRoute() string {
+	return f.defaultRouteFn()
+}
+
+func (f fakeNetwork) DHCPOne(iface string) (string, error) {
+	return f.dhcpOneFn(iface)
+}
+
+func (f fakeNetwork) DHCPAll() (string, error) {
+	return f.dhcpAllFn()
+}
+
+func (f fakeNetwork) SetStaticIPv4(cfg platform.StaticIPv4Config) (string, error) {
+	return f.setStaticIPv4Fn(cfg)
+}
+
+type fakeServices struct {
+	serviceStatusFn func(string) (string, error)
+	serviceDoFn     func(string, platform.ServiceAction) (string, error)
+}
+
+func (f fakeServices) ListBeeServices() ([]string, error) {
+	return nil, nil
+}
+
+func (f fakeServices) ServiceStatus(name string) (string, error) {
+	return f.serviceStatusFn(name)
+}
+
+func (f fakeServices) ServiceDo(name string, action platform.ServiceAction) (string, error) {
+	return f.serviceDoFn(name, action)
+}
+
+type fakeExports struct{}
+
+func (f fakeExports) ListRemovableTargets() ([]platform.RemovableTarget, error) {
+	return nil, nil
+}
+
+func (f fakeExports) ExportFileToTarget(src string, target platform.RemovableTarget) (string, error) {
+	return "", nil
+}
+
+type fakeTools struct {
+	tailFileFn   func(string, int) string
+	checkToolsFn func([]string) []platform.ToolStatus
+}
+
+func (f fakeTools) TailFile(path string, lines int) string {
+	return f.tailFileFn(path, lines)
+}
+
+func (f fakeTools) CheckTools(names []string) []platform.ToolStatus {
+	return f.checkToolsFn(names)
+}
+
+type fakeSAT struct {
+	runFn func(string) (string, error)
+}
+
+func (f fakeSAT) RunNvidiaAcceptancePack(baseDir string) (string, error) {
+	return f.runFn(baseDir)
+}
+
+func TestNetworkStatusFormatsInterfacesAndRoute(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		network: fakeNetwork{
+			listInterfacesFn: func() ([]platform.InterfaceInfo, error) {
+				return []platform.InterfaceInfo{
+					{Name: "eth0", State: "UP", IPv4: []string{"10.0.0.2/24"}},
+					{Name: "eth1", State: "DOWN", IPv4: nil},
+				}, nil
+			},
+			defaultRouteFn: func() string { return "10.0.0.1" },
+		},
+	}
+
+	result, err := a.NetworkStatus()
+	if err != nil {
+		t.Fatalf("NetworkStatus error: %v", err)
+	}
+	if result.Title != "Network status" {
+		t.Fatalf("title=%q want %q", result.Title, "Network status")
+	}
+	if want := "- eth0: state=UP ip=10.0.0.2/24"; !contains(result.Body, want) {
+		t.Fatalf("body missing %q\nbody=%s", want, result.Body)
+	}
+	if want := "- eth1: state=DOWN ip=(no IPv4)"; !contains(result.Body, want) {
+		t.Fatalf("body missing %q\nbody=%s", want, result.Body)
+	}
+	if want := "Default route: 10.0.0.1"; !contains(result.Body, want) {
+		t.Fatalf("body missing %q\nbody=%s", want, result.Body)
+	}
+}
+
+func TestNetworkStatusPropagatesListError(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		network: fakeNetwork{
+			listInterfacesFn: func() ([]platform.InterfaceInfo, error) {
+				return nil, errors.New("boom")
+			},
+			defaultRouteFn: func() string { return "" },
+		},
+	}
+
+	result, err := a.NetworkStatus()
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if result.Title != "Network status" {
+		t.Fatalf("title=%q want %q", result.Title, "Network status")
+	}
+}
+
+func TestParseStaticIPv4ConfigAndDefaults(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		network: fakeNetwork{
+			defaultRouteFn: func() string { return " 192.168.1.1 " },
+			listInterfacesFn: func() ([]platform.InterfaceInfo, error) {
+				return nil, nil
+			},
+			dhcpOneFn:       func(string) (string, error) { return "", nil },
+			dhcpAllFn:       func() (string, error) { return "", nil },
+			setStaticIPv4Fn: func(platform.StaticIPv4Config) (string, error) { return "", nil },
+		},
+	}
+
+	defaults := a.DefaultStaticIPv4FormFields("eth0")
+	if len(defaults) != 4 {
+		t.Fatalf("len(defaults)=%d want 4", len(defaults))
+	}
+	if defaults[1] != "24" || defaults[2] != "192.168.1.1" {
+		t.Fatalf("unexpected defaults: %#v", defaults)
+	}
+
+	cfg := a.ParseStaticIPv4Config("eth0", []string{
+		" 10.10.0.5 ",
+		" 23 ",
+		" 10.10.0.1 ",
+		" 1.1.1.1  8.8.8.8 ",
+	})
+	if cfg.Interface != "eth0" || cfg.Address != "10.10.0.5" || cfg.Prefix != "23" || cfg.Gateway != "10.10.0.1" {
+		t.Fatalf("unexpected cfg: %#v", cfg)
+	}
+	if len(cfg.DNS) != 2 || cfg.DNS[0] != "1.1.1.1" || cfg.DNS[1] != "8.8.8.8" {
+		t.Fatalf("unexpected dns: %#v", cfg.DNS)
+	}
+}
+
+func TestServiceActionResults(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		services: fakeServices{
+			serviceStatusFn: func(name string) (string, error) {
+				return "active", nil
+			},
+			serviceDoFn: func(name string, action platform.ServiceAction) (string, error) {
+				return string(action) + " ok", nil
+			},
+		},
+	}
+
+	statusResult, err := a.ServiceStatusResult("bee-audit")
+	if err != nil {
+		t.Fatalf("ServiceStatusResult error: %v", err)
+	}
+	if statusResult.Title != "service: bee-audit" || statusResult.Body != "active" {
+		t.Fatalf("unexpected status result: %#v", statusResult)
+	}
+
+	actionResult, err := a.ServiceActionResult("bee-audit", platform.ServiceRestart)
+	if err != nil {
+		t.Fatalf("ServiceActionResult error: %v", err)
+	}
+	if actionResult.Title != "service: bee-audit" || actionResult.Body != "restart ok" {
+		t.Fatalf("unexpected action result: %#v", actionResult)
+	}
+}
+
+func TestToolCheckAndLogTailResults(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		tools: fakeTools{
+			tailFileFn: func(path string, lines int) string {
+				return path
+			},
+			checkToolsFn: func(names []string) []platform.ToolStatus {
+				return []platform.ToolStatus{
+					{Name: "dmidecode", OK: true, Path: "/usr/bin/dmidecode"},
+					{Name: "smartctl", OK: false},
+				}
+			},
+		},
+	}
+
+	toolsResult := a.ToolCheckResult([]string{"dmidecode", "smartctl"})
+	if toolsResult.Title != "Required tools" {
+		t.Fatalf("title=%q want %q", toolsResult.Title, "Required tools")
+	}
+	if want := "- dmidecode: OK (/usr/bin/dmidecode)"; !contains(toolsResult.Body, want) {
+		t.Fatalf("body missing %q\nbody=%s", want, toolsResult.Body)
+	}
+	if want := "- smartctl: MISSING"; !contains(toolsResult.Body, want) {
+		t.Fatalf("body missing %q\nbody=%s", want, toolsResult.Body)
+	}
+
+	logResult := a.AuditLogTailResult()
+	if logResult.Title != "Audit log tail" {
+		t.Fatalf("title=%q want %q", logResult.Title, "Audit log tail")
+	}
+	if want := DefaultAuditLogPath + "\n\n" + DefaultAuditJSONPath; logResult.Body != want {
+		t.Fatalf("body=%q want %q", logResult.Body, want)
+	}
+}
+
+func TestRunNvidiaAcceptancePackResult(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		sat: fakeSAT{
+			runFn: func(baseDir string) (string, error) {
+				if baseDir != "/tmp/sat" {
+					t.Fatalf("baseDir=%q want %q", baseDir, "/tmp/sat")
+				}
+				return "/tmp/sat/out.tar.gz", nil
+			},
+		},
+	}
+
+	result, err := a.RunNvidiaAcceptancePackResult("/tmp/sat")
+	if err != nil {
+		t.Fatalf("RunNvidiaAcceptancePackResult error: %v", err)
+	}
+	if result.Title != "NVIDIA SAT" || result.Body != "Archive written to /tmp/sat/out.tar.gz" {
+		t.Fatalf("unexpected result: %#v", result)
+	}
+}
+
+func contains(haystack, needle string) bool {
+	return len(needle) == 0 || (len(haystack) >= len(needle) && (haystack == needle || containsAt(haystack, needle)))
+}
+
+func containsAt(haystack, needle string) bool {
+	for i := 0; i+len(needle) <= len(haystack); i++ {
+		if haystack[i:i+len(needle)] == needle {
+			return true
+		}
+	}
+	return false
+}
--- a/audit/internal/collector/collector.go
+++ b/audit/internal/collector/collector.go
@@ -4,6 +4,7 @@
 package collector

 import (
+	"bee/audit/internal/runtimeenv"
 	"bee/audit/internal/schema"
 	"log/slog"
 	"time"
@@ -11,7 +12,7 @@ import (

 // Run executes all collectors and returns the combined snapshot.
 // Partial failures are logged as warnings; collection always completes.
-func Run() schema.HardwareIngestRequest {
+func Run(runtimeMode runtimeenv.Mode) schema.HardwareIngestRequest {
 	start := time.Now()
 	slog.Info("audit started")

@@ -39,7 +40,7 @@ func Run() schema.HardwareIngestRequest {

 	slog.Info("audit completed", "duration", time.Since(start).Round(time.Millisecond))

-	sourceType := "livcd"
+	sourceType := string(runtimeMode)
 	protocol := "os-direct"

 	return schema.HardwareIngestRequest{
--- a/audit/internal/collector/nvidia.go
+++ b/audit/internal/collector/nvidia.go
@@ -27,6 +27,9 @@ type nvidiaGPUInfo struct {
 // If the driver/tool is unavailable, NVIDIA devices get UNKNOWN status and
 // a stable serial fallback based on board serial + slot.
 func enrichPCIeWithNVIDIA(devs []schema.HardwarePCIeDevice, boardSerial string) []schema.HardwarePCIeDevice {
+	if !hasNVIDIADevices(devs) {
+		return devs
+	}
 	gpuByBDF, err := queryNVIDIAGPUs()
 	if err != nil {
 		slog.Info("nvidia: enrichment skipped", "err", err)
@@ -35,6 +38,15 @@ func enrichPCIeWithNVIDIA(devs []schema.HardwarePCIeDevice, boardSerial string)
 	return enrichPCIeWithNVIDIAData(devs, gpuByBDF, boardSerial, true)
 }

+func hasNVIDIADevices(devs []schema.HardwarePCIeDevice) bool {
+	for _, dev := range devs {
+		if isNVIDIADevice(dev) {
+			return true
+		}
+	}
+	return false
+}
+
 func enrichPCIeWithNVIDIAData(devs []schema.HardwarePCIeDevice, gpuByBDF map[string]nvidiaGPUInfo, boardSerial string, driverLoaded bool) []schema.HardwarePCIeDevice {
 	enriched := 0
 	for i := range devs {
--- a/audit/internal/platform/export.go
+++ b/audit/internal/platform/export.go
@@ -0,0 +1,94 @@
+package platform
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+func (s *System) ListRemovableTargets() ([]RemovableTarget, error) {
+	raw, err := exec.Command("lsblk", "-P", "-o", "NAME,TYPE,PKNAME,RM,FSTYPE,MOUNTPOINT,SIZE,LABEL,MODEL").Output()
+	if err != nil {
+		return nil, err
+	}
+
+	var out []RemovableTarget
+	for _, line := range strings.Split(strings.TrimSpace(string(raw)), "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		fields := parseLSBLKPairs(line)
+		deviceType := fields["TYPE"]
+		if deviceType == "rom" || deviceType == "loop" {
+			continue
+		}
+
+		removable := fields["RM"] == "1"
+		if !removable {
+			if parent := fields["PKNAME"]; parent != "" {
+				if data, err := os.ReadFile(filepath.Join("/sys/class/block", parent, "removable")); err == nil {
+					removable = strings.TrimSpace(string(data)) == "1"
+				}
+			}
+		}
+		if !removable || fields["FSTYPE"] == "" {
+			continue
+		}
+
+		out = append(out, RemovableTarget{
+			Device:     "/dev/" + fields["NAME"],
+			FSType:     fields["FSTYPE"],
+			Size:       fields["SIZE"],
+			Label:      fields["LABEL"],
+			Model:      fields["MODEL"],
+			Mountpoint: fields["MOUNTPOINT"],
+		})
+	}
+
+	sort.Slice(out, func(i, j int) bool { return out[i].Device < out[j].Device })
+	return out, nil
+}
+
+func (s *System) ExportFileToTarget(src string, target RemovableTarget) (string, error) {
+	if src == "" || target.Device == "" {
+		return "", fmt.Errorf("source and target are required")
+	}
+	if _, err := os.Stat(src); err != nil {
+		return "", err
+	}
+
+	mountpoint := strings.TrimSpace(target.Mountpoint)
+	mountedHere := false
+	if mountpoint == "" {
+		mountpoint = filepath.Join("/tmp", "bee-export-"+filepath.Base(target.Device))
+		if err := os.MkdirAll(mountpoint, 0755); err != nil {
+			return "", err
+		}
+		if raw, err := exec.Command("mount", target.Device, mountpoint).CombinedOutput(); err != nil {
+			_ = os.Remove(mountpoint)
+			return string(raw), err
+		}
+		mountedHere = true
+	}
+
+	filename := filepath.Base(src)
+	dst := filepath.Join(mountpoint, filename)
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return "", err
+	}
+	if err := os.WriteFile(dst, data, 0644); err != nil {
+		return "", err
+	}
+	_ = exec.Command("sync").Run()
+
+	if mountedHere {
+		_ = exec.Command("umount", mountpoint).Run()
+		_ = os.Remove(mountpoint)
+	}
+
+	return dst, nil
+}
--- a/audit/internal/platform/network.go
+++ b/audit/internal/platform/network.go
@@ -0,0 +1,156 @@
+package platform
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"sort"
+	"strings"
+)
+
+func (s *System) ListInterfaces() ([]InterfaceInfo, error) {
+	names, err := listInterfaceNames()
+	if err != nil {
+		return nil, err
+	}
+
+	out := make([]InterfaceInfo, 0, len(names))
+	for _, name := range names {
+		state := "unknown"
+		if raw, err := exec.Command("ip", "-o", "link", "show", name).Output(); err == nil {
+			fields := strings.Fields(string(raw))
+			if len(fields) >= 9 {
+				state = fields[8]
+			}
+		}
+
+		var ipv4 []string
+		if raw, err := exec.Command("ip", "-o", "-4", "addr", "show", "dev", name).Output(); err == nil {
+			for _, line := range strings.Split(strings.TrimSpace(string(raw)), "\n") {
+				fields := strings.Fields(line)
+				if len(fields) >= 4 {
+					ipv4 = append(ipv4, fields[3])
+				}
+			}
+		}
+
+		out = append(out, InterfaceInfo{Name: name, State: state, IPv4: ipv4})
+	}
+
+	return out, nil
+}
+
+func (s *System) DefaultRoute() string {
+	raw, err := exec.Command("ip", "route", "show", "default").Output()
+	if err != nil {
+		return ""
+	}
+	fields := strings.Fields(string(raw))
+	for i := 0; i < len(fields)-1; i++ {
+		if fields[i] == "via" {
+			return fields[i+1]
+		}
+	}
+	return ""
+}
+
+func (s *System) DHCPOne(iface string) (string, error) {
+	var out bytes.Buffer
+	if err := exec.Command("ip", "link", "set", iface, "up").Run(); err != nil {
+		fmt.Fprintf(&out, "WARN: ip link set up failed: %v\n", err)
+	}
+	if raw, err := exec.Command("dhclient", "-r", iface).CombinedOutput(); err == nil {
+		out.Write(raw)
+	} else if len(raw) > 0 {
+		out.Write(raw)
+	}
+	raw, err := exec.Command("dhclient", "-4", "-v", iface).CombinedOutput()
+	out.Write(raw)
+	if err != nil {
+		return out.String(), err
+	}
+	return out.String(), nil
+}
+
+func (s *System) DHCPAll() (string, error) {
+	ifaces, err := listInterfaceNames()
+	if err != nil {
+		return "", err
+	}
+	var out strings.Builder
+	for _, iface := range ifaces {
+		fmt.Fprintf(&out, "[%s]\n", iface)
+		log, err := s.DHCPOne(iface)
+		out.WriteString(log)
+		if err != nil {
+			fmt.Fprintf(&out, "ERROR: %v\n", err)
+		}
+		out.WriteString("\n")
+	}
+	return out.String(), nil
+}
+
+func (s *System) SetStaticIPv4(cfg StaticIPv4Config) (string, error) {
+	if cfg.Interface == "" || cfg.Address == "" || cfg.Prefix == "" {
+		return "", fmt.Errorf("interface, address, and prefix are required")
+	}
+
+	dns := cfg.DNS
+	if len(dns) == 0 {
+		dns = []string{"77.88.8.8", "77.88.8.1", "1.1.1.1", "8.8.8.8"}
+	}
+
+	var out strings.Builder
+	_ = exec.Command("ip", "link", "set", cfg.Interface, "up").Run()
+	_ = exec.Command("ip", "addr", "flush", "dev", cfg.Interface).Run()
+	if raw, err := exec.Command("ip", "addr", "add", cfg.Address+"/"+cfg.Prefix, "dev", cfg.Interface).CombinedOutput(); err != nil {
+		return string(raw), err
+	}
+	out.WriteString("address configured\n")
+	if cfg.Gateway != "" {
+		_ = exec.Command("ip", "route", "del", "default").Run()
+		if raw, err := exec.Command("ip", "route", "add", "default", "via", cfg.Gateway, "dev", cfg.Interface).CombinedOutput(); err != nil {
+			return out.String() + string(raw), err
+		}
+		out.WriteString("default route configured\n")
+	}
+
+	var resolv strings.Builder
+	for _, dnsServer := range dns {
+		dnsServer = strings.TrimSpace(dnsServer)
+		if dnsServer == "" {
+			continue
+		}
+		fmt.Fprintf(&resolv, "nameserver %s\n", dnsServer)
+	}
+	if err := os.WriteFile("/etc/resolv.conf", []byte(resolv.String()), 0644); err != nil {
+		return out.String(), err
+	}
+	out.WriteString("dns configured\n")
+	return out.String(), nil
+}
+
+func listInterfaceNames() ([]string, error) {
+	raw, err := exec.Command("ip", "-o", "link", "show").Output()
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for _, line := range strings.Split(strings.TrimSpace(string(raw)), "\n") {
+		fields := strings.SplitN(line, ": ", 3)
+		if len(fields) < 2 {
+			continue
+		}
+		name := fields[1]
+		if name == "lo" || strings.HasPrefix(name, "docker") || strings.HasPrefix(name, "virbr") ||
+			strings.HasPrefix(name, "veth") || strings.HasPrefix(name, "tun") ||
+			strings.HasPrefix(name, "tap") || strings.HasPrefix(name, "br-") ||
+			strings.HasPrefix(name, "bond") || strings.HasPrefix(name, "dummy") {
+			continue
+		}
+		out = append(out, name)
+	}
+	sort.Strings(out)
+	return out, nil
+}
--- a/audit/internal/platform/parse.go
+++ b/audit/internal/platform/parse.go
@@ -0,0 +1,43 @@
+package platform
+
+import "strings"
+
+func parseLSBLKPairs(line string) map[string]string {
+	out := map[string]string{}
+	for _, part := range splitQuotedFields(line) {
+		idx := strings.Index(part, "=")
+		if idx <= 0 {
+			continue
+		}
+		key := part[:idx]
+		value := strings.Trim(part[idx+1:], `"`)
+		out[key] = value
+	}
+	return out
+}
+
+func splitQuotedFields(s string) []string {
+	var out []string
+	var cur strings.Builder
+	inQuotes := false
+	for _, r := range s {
+		switch r {
+		case '"':
+			inQuotes = !inQuotes
+			cur.WriteRune(r)
+		case ' ':
+			if inQuotes {
+				cur.WriteRune(r)
+			} else if cur.Len() > 0 {
+				out = append(out, cur.String())
+				cur.Reset()
+			}
+		default:
+			cur.WriteRune(r)
+		}
+	}
+	if cur.Len() > 0 {
+		out = append(out, cur.String())
+	}
+	return out
+}
--- a/audit/internal/platform/sat.go
+++ b/audit/internal/platform/sat.go
@@ -0,0 +1,101 @@
+package platform
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+func (s *System) RunNvidiaAcceptancePack(baseDir string) (string, error) {
+	if baseDir == "" {
+		baseDir = "/var/log/bee-sat"
+	}
+	ts := time.Now().UTC().Format("20060102-150405")
+	runDir := filepath.Join(baseDir, "gpu-nvidia-"+ts)
+	if err := os.MkdirAll(runDir, 0755); err != nil {
+		return "", err
+	}
+
+	type job struct {
+		name string
+		cmd  []string
+	}
+	jobs := []job{
+		{name: "01-nvidia-smi-q.log", cmd: []string{"nvidia-smi", "-q"}},
+		{name: "02-dmidecode-baseboard.log", cmd: []string{"dmidecode", "-t", "baseboard"}},
+		{name: "03-dmidecode-system.log", cmd: []string{"dmidecode", "-t", "system"}},
+		{name: "04-nvidia-bug-report.log", cmd: []string{"nvidia-bug-report.sh", "--output", filepath.Join(runDir, "nvidia-bug-report.log")}},
+	}
+
+	var summary strings.Builder
+	fmt.Fprintf(&summary, "run_at_utc=%s\n", time.Now().UTC().Format(time.RFC3339))
+	for _, job := range jobs {
+		out, err := exec.Command(job.cmd[0], job.cmd[1:]...).CombinedOutput()
+		if writeErr := os.WriteFile(filepath.Join(runDir, job.name), out, 0644); writeErr != nil {
+			return "", writeErr
+		}
+		rc := 0
+		if err != nil {
+			rc = 1
+		}
+		fmt.Fprintf(&summary, "%s_rc=%d\n", strings.TrimSuffix(strings.TrimPrefix(job.name, "0"), ".log"), rc)
+	}
+	if err := os.WriteFile(filepath.Join(runDir, "summary.txt"), []byte(summary.String()), 0644); err != nil {
+		return "", err
+	}
+
+	archive := filepath.Join(baseDir, "gpu-nvidia-"+ts+".tar.gz")
+	if err := createTarGz(archive, runDir); err != nil {
+		return "", err
+	}
+	return archive, nil
+}
+
+func createTarGz(dst, srcDir string) error {
+	file, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	gz := gzip.NewWriter(file)
+	defer gz.Close()
+
+	tw := tar.NewWriter(gz)
+	defer tw.Close()
+
+	base := filepath.Dir(srcDir)
+	return filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		header, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return err
+		}
+		rel, err := filepath.Rel(base, path)
+		if err != nil {
+			return err
+		}
+		header.Name = rel
+		if err := tw.WriteHeader(header); err != nil {
+			return err
+		}
+		file, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+		_, err = io.Copy(tw, file)
+		return err
+	})
+}
--- a/audit/internal/platform/services.go
+++ b/audit/internal/platform/services.go
@@ -0,0 +1,54 @@
+package platform
+
+import (
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+func (s *System) ListBeeServices() ([]string, error) {
+	seen := map[string]bool{}
+	var out []string
+	for _, pattern := range []string{"/etc/systemd/system/bee-*.service", "/lib/systemd/system/bee-*.service"} {
+		matches, err := filepath.Glob(pattern)
+		if err != nil {
+			return nil, err
+		}
+		for _, match := range matches {
+			name := strings.TrimSuffix(filepath.Base(match), ".service")
+			if !seen[name] {
+				seen[name] = true
+				out = append(out, name)
+			}
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+func (s *System) ServiceState(name string) string {
+	raw, err := exec.Command("systemctl", "is-active", name).CombinedOutput()
+	if err == nil {
+		return strings.TrimSpace(string(raw))
+	}
+	raw, err = exec.Command("systemctl", "show", name, "--property=ActiveState", "--value").CombinedOutput()
+	if err != nil {
+		return "unknown"
+	}
+	state := strings.TrimSpace(string(raw))
+	if state == "" {
+		return "unknown"
+	}
+	return state
+}
+
+func (s *System) ServiceDo(name string, action ServiceAction) (string, error) {
+	raw, err := exec.Command("systemctl", string(action), name).CombinedOutput()
+	return string(raw), err
+}
+
+func (s *System) ServiceStatus(name string) (string, error) {
+	raw, err := exec.Command("systemctl", "status", name, "--no-pager").CombinedOutput()
+	return string(raw), err
+}
--- a/audit/internal/platform/system_test.go
+++ b/audit/internal/platform/system_test.go
@@ -0,0 +1,49 @@
+package platform
+
+import "testing"
+
+func TestSplitQuotedFields(t *testing.T) {
+	t.Parallel()
+
+	line := `NAME="sdb1" TYPE="part" LABEL="BEE EXPORT" MODEL="USB DISK 3.0"`
+	got := splitQuotedFields(line)
+	want := []string{
+		`NAME="sdb1"`,
+		`TYPE="part"`,
+		`LABEL="BEE EXPORT"`,
+		`MODEL="USB DISK 3.0"`,
+	}
+
+	if len(got) != len(want) {
+		t.Fatalf("len(got)=%d len(want)=%d; got=%q", len(got), len(want), got)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got[%d]=%q want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestParseLSBLKPairs(t *testing.T) {
+	t.Parallel()
+
+	line := `NAME="sdb1" TYPE="part" PKNAME="sdb" RM="1" FSTYPE="vfat" MOUNTPOINT="" SIZE="57.3G" LABEL="BEE EXPORT" MODEL="USB DISK 3.0"`
+	got := parseLSBLKPairs(line)
+
+	checks := map[string]string{
+		"NAME":       "sdb1",
+		"TYPE":       "part",
+		"PKNAME":     "sdb",
+		"RM":         "1",
+		"FSTYPE":     "vfat",
+		"MOUNTPOINT": "",
+		"SIZE":       "57.3G",
+		"LABEL":      "BEE EXPORT",
+		"MODEL":      "USB DISK 3.0",
+	}
+	for key, want := range checks {
+		if got[key] != want {
+			t.Fatalf("got[%s]=%q want %q", key, got[key], want)
+		}
+	}
+}
--- a/audit/internal/platform/tools.go
+++ b/audit/internal/platform/tools.go
@@ -0,0 +1,29 @@
+package platform
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+func (s *System) TailFile(path string, lines int) string {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Sprintf("read %s: %v", path, err)
+	}
+	all := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
+	if lines <= 0 || len(all) <= lines {
+		return string(raw)
+	}
+	return strings.Join(all[len(all)-lines:], "\n")
+}
+
+func (s *System) CheckTools(names []string) []ToolStatus {
+	out := make([]ToolStatus, 0, len(names))
+	for _, name := range names {
+		path, err := exec.LookPath(name)
+		out = append(out, ToolStatus{Name: name, Path: path, OK: err == nil})
+	}
+	return out
+}
--- a/audit/internal/platform/types.go
+++ b/audit/internal/platform/types.go
@@ -0,0 +1,44 @@
+package platform
+
+type System struct{}
+
+type InterfaceInfo struct {
+	Name  string
+	State string
+	IPv4  []string
+}
+
+type ServiceAction string
+
+const (
+	ServiceStart   ServiceAction = "start"
+	ServiceStop    ServiceAction = "stop"
+	ServiceRestart ServiceAction = "restart"
+)
+
+type StaticIPv4Config struct {
+	Interface string
+	Address   string
+	Prefix    string
+	Gateway   string
+	DNS       []string
+}
+
+type RemovableTarget struct {
+	Device     string
+	FSType     string
+	Size       string
+	Label      string
+	Model      string
+	Mountpoint string
+}
+
+type ToolStatus struct {
+	Name string
+	Path string
+	OK   bool
+}
+
+func New() *System {
+	return &System{}
+}
--- a/audit/internal/runtimeenv/runtimeenv.go
+++ b/audit/internal/runtimeenv/runtimeenv.go
@@ -0,0 +1,77 @@
+package runtimeenv
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+type Mode string
+
+const (
+	ModeAuto   Mode = "auto"
+	ModeLocal  Mode = "local"
+	ModeLiveCD Mode = "livecd"
+)
+
+type Info struct {
+	Mode     Mode
+	Detected bool
+	Reason   string
+}
+
+func ParseMode(raw string) (Mode, error) {
+	mode := Mode(strings.TrimSpace(strings.ToLower(raw)))
+	switch mode {
+	case "", ModeAuto:
+		return ModeAuto, nil
+	case ModeLocal, ModeLiveCD:
+		return mode, nil
+	default:
+		return "", fmt.Errorf("invalid runtime %q — use auto, local, or livecd", raw)
+	}
+}
+
+func Detect(flagValue string) (Info, error) {
+	flagMode, err := ParseMode(flagValue)
+	if err != nil {
+		return Info{}, err
+	}
+	if flagMode != ModeAuto {
+		return Info{Mode: flagMode, Reason: "flag"}, nil
+	}
+
+	if envMode, ok := getenvMode("BEE_RUNTIME"); ok {
+		return Info{Mode: envMode, Reason: "env:BEE_RUNTIME"}, nil
+	}
+
+	if fileExists("/etc/bee-release") {
+		return Info{Mode: ModeLiveCD, Detected: true, Reason: "marker:/etc/bee-release"}, nil
+	}
+
+	if data, err := os.ReadFile("/proc/cmdline"); err == nil {
+		cmdline := string(data)
+		if strings.Contains(cmdline, " boot=live") || strings.HasPrefix(cmdline, "boot=live ") || strings.Contains(cmdline, "live-media") {
+			return Info{Mode: ModeLiveCD, Detected: true, Reason: "kernel:boot=live"}, nil
+		}
+	}
+
+	return Info{Mode: ModeLocal, Detected: true, Reason: "default:local"}, nil
+}
+
+func getenvMode(name string) (Mode, bool) {
+	value := strings.TrimSpace(os.Getenv(name))
+	if value == "" {
+		return "", false
+	}
+	mode, err := ParseMode(value)
+	if err != nil || mode == ModeAuto {
+		return "", false
+	}
+	return mode, true
+}
+
+func fileExists(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && !info.IsDir()
+}
--- a/audit/internal/runtimeenv/runtimeenv_test.go
+++ b/audit/internal/runtimeenv/runtimeenv_test.go
@@ -0,0 +1,67 @@
+package runtimeenv
+
+import (
+	"os"
+	"testing"
+)
+
+func TestParseMode(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		in   string
+		want Mode
+		ok   bool
+	}{
+		{in: "", want: ModeAuto, ok: true},
+		{in: "auto", want: ModeAuto, ok: true},
+		{in: "local", want: ModeLocal, ok: true},
+		{in: "livecd", want: ModeLiveCD, ok: true},
+		{in: "bad", ok: false},
+	}
+
+	for _, test := range tests {
+		got, err := ParseMode(test.in)
+		if test.ok && err != nil {
+			t.Fatalf("ParseMode(%q): %v", test.in, err)
+		}
+		if !test.ok && err == nil {
+			t.Fatalf("ParseMode(%q): expected error", test.in)
+		}
+		if test.ok && got != test.want {
+			t.Fatalf("ParseMode(%q): got %q want %q", test.in, got, test.want)
+		}
+	}
+}
+
+func TestDetectHonorsFlag(t *testing.T) {
+	t.Parallel()
+
+	info, err := Detect("livecd")
+	if err != nil {
+		t.Fatalf("Detect(flag): %v", err)
+	}
+	if info.Mode != ModeLiveCD || info.Reason != "flag" {
+		t.Fatalf("unexpected info: %+v", info)
+	}
+}
+
+func TestDetectHonorsEnv(t *testing.T) {
+	t.Parallel()
+
+	old := os.Getenv("BEE_RUNTIME")
+	t.Cleanup(func() {
+		_ = os.Setenv("BEE_RUNTIME", old)
+	})
+	if err := os.Setenv("BEE_RUNTIME", "local"); err != nil {
+		t.Fatalf("Setenv: %v", err)
+	}
+
+	info, err := Detect("auto")
+	if err != nil {
+		t.Fatalf("Detect(env): %v", err)
+	}
+	if info.Mode != ModeLocal || info.Reason != "env:BEE_RUNTIME" {
+		t.Fatalf("unexpected info: %+v", info)
+	}
+}
--- a/audit/internal/schema/hardware.go
+++ b/audit/internal/schema/hardware.go
@@ -2,7 +2,7 @@
 // core/internal/ingest/parser_hardware.go. No import dependency on core.
 package schema

-// HardwareIngestRequest is the top-level output document produced by the audit binary.
+// HardwareIngestRequest is the top-level output document produced by `bee audit`.
 // It is accepted as-is by the core /api/ingest/hardware endpoint.
 type HardwareIngestRequest struct {
 	Filename    *string          `json:"filename"`
--- a/audit/internal/tui/forms.go
+++ b/audit/internal/tui/forms.go
@@ -0,0 +1,98 @@
+package tui
+
+import tea "github.com/charmbracelet/bubbletea"
+
+func (m model) updateStaticForm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch msg.String() {
+	case "esc":
+		m.screen = screenNetwork
+		m.formFields = nil
+		m.formIndex = 0
+		return m, nil
+	case "up", "shift+tab":
+		if m.formIndex > 0 {
+			m.formIndex--
+		}
+	case "down", "tab":
+		if m.formIndex < len(m.formFields)-1 {
+			m.formIndex++
+		}
+	case "enter":
+		if m.formIndex < len(m.formFields)-1 {
+			m.formIndex++
+			return m, nil
+		}
+		cfg := m.app.ParseStaticIPv4Config(m.selectedIface, []string{
+			m.formFields[0].Value,
+			m.formFields[1].Value,
+			m.formFields[2].Value,
+			m.formFields[3].Value,
+		})
+		m.busy = true
+		return m, func() tea.Msg {
+			result, err := m.app.SetStaticIPv4Result(cfg)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
+		}
+	case "backspace":
+		field := &m.formFields[m.formIndex]
+		if len(field.Value) > 0 {
+			field.Value = field.Value[:len(field.Value)-1]
+		}
+	default:
+		if msg.Type == tea.KeyRunes && len(msg.Runes) > 0 {
+			m.formFields[m.formIndex].Value += string(msg.Runes)
+		}
+	}
+	return m, nil
+}
+
+func (m model) updateConfirm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch msg.String() {
+	case "left", "up", "tab":
+		if m.cursor > 0 {
+			m.cursor--
+		}
+	case "right", "down":
+		if m.cursor < 1 {
+			m.cursor++
+		}
+	case "esc":
+		m.screen = m.confirmCancelTarget()
+		m.cursor = 0
+		return m, nil
+	case "enter":
+		if m.cursor == 1 {
+			m.screen = m.confirmCancelTarget()
+			m.cursor = 0
+			return m, nil
+		}
+		m.busy = true
+		switch m.pendingAction {
+		case actionExportAudit:
+			target := *m.selectedTarget
+			return m, func() tea.Msg {
+				result, err := m.app.ExportLatestAuditResult(target)
+				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenMain}
+			}
+		case actionRunNvidiaSAT:
+			return m, func() tea.Msg {
+				result, err := m.app.RunNvidiaAcceptancePackResult("")
+				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
+			}
+		}
+	case "ctrl+c":
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
+func (m model) confirmCancelTarget() screen {
+	switch m.pendingAction {
+	case actionExportAudit:
+		return screenExportTargets
+	case actionRunNvidiaSAT:
+		return screenAcceptance
+	default:
+		return screenMain
+	}
+}
--- a/audit/internal/tui/messages.go
+++ b/audit/internal/tui/messages.go
@@ -0,0 +1,25 @@
+package tui
+
+import "bee/audit/internal/platform"
+
+type resultMsg struct {
+	title string
+	body  string
+	err   error
+	back  screen
+}
+
+type servicesMsg struct {
+	services []string
+	err      error
+}
+
+type interfacesMsg struct {
+	ifaces []platform.InterfaceInfo
+	err    error
+}
+
+type exportTargetsMsg struct {
+	targets []platform.RemovableTarget
+	err     error
+}
--- a/audit/internal/tui/screen_acceptance.go
+++ b/audit/internal/tui/screen_acceptance.go
@@ -0,0 +1,14 @@
+package tui
+
+import tea "github.com/charmbracelet/bubbletea"
+
+func (m model) handleAcceptanceMenu() (tea.Model, tea.Cmd) {
+	if m.cursor == 1 {
+		m.screen = screenMain
+		m.cursor = 0
+		return m, nil
+	}
+	m.pendingAction = actionRunNvidiaSAT
+	m.screen = screenConfirm
+	return m, nil
+}
--- a/audit/internal/tui/screen_export.go
+++ b/audit/internal/tui/screen_export.go
@@ -0,0 +1,14 @@
+package tui
+
+import tea "github.com/charmbracelet/bubbletea"
+
+func (m model) handleExportTargetsMenu() (tea.Model, tea.Cmd) {
+	if len(m.targets) == 0 {
+		return m, resultCmd("Export audit", "No removable filesystems found", nil, screenMain)
+	}
+	target := m.targets[m.cursor]
+	m.selectedTarget = &target
+	m.pendingAction = actionExportAudit
+	m.screen = screenConfirm
+	return m, nil
+}
--- a/audit/internal/tui/screen_main.go
+++ b/audit/internal/tui/screen_main.go
@@ -0,0 +1,51 @@
+package tui
+
+import (
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m model) handleMainMenu() (tea.Model, tea.Cmd) {
+	switch m.cursor {
+	case 0:
+		m.screen = screenNetwork
+		m.cursor = 0
+		return m, nil
+	case 1:
+		m.busy = true
+		return m, func() tea.Msg {
+			services, err := m.app.ListBeeServices()
+			return servicesMsg{services: services, err: err}
+		}
+	case 2:
+		m.screen = screenAcceptance
+		m.cursor = 0
+		return m, nil
+	case 3:
+		m.busy = true
+		return m, func() tea.Msg {
+			result, err := m.app.RunAuditNow(m.runtimeMode)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenMain}
+		}
+	case 4:
+		m.busy = true
+		return m, func() tea.Msg {
+			targets, err := m.app.ListRemovableTargets()
+			return exportTargetsMsg{targets: targets, err: err}
+		}
+	case 5:
+		m.busy = true
+		return m, func() tea.Msg {
+			result := m.app.ToolCheckResult([]string{"dmidecode", "smartctl", "nvme", "ipmitool", "lspci", "bee", "nvidia-smi", "dhclient", "lsblk", "mount"})
+			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
+		}
+	case 6:
+		m.busy = true
+		return m, func() tea.Msg {
+			result := m.app.AuditLogTailResult()
+			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
+		}
+	case 7:
+		return m, tea.Quit
+	}
+	return m, nil
+}
--- a/audit/internal/tui/screen_network.go
+++ b/audit/internal/tui/screen_network.go
@@ -0,0 +1,71 @@
+package tui
+
+import (
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m model) handleNetworkMenu() (tea.Model, tea.Cmd) {
+	switch m.cursor {
+	case 0:
+		m.busy = true
+		return m, func() tea.Msg {
+			result, err := m.app.NetworkStatus()
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
+		}
+	case 1:
+		m.busy = true
+		return m, func() tea.Msg {
+			result, err := m.app.DHCPAllResult()
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
+		}
+	case 2:
+		m.pendingAction = actionDHCPOne
+		m.busy = true
+		return m, func() tea.Msg {
+			ifaces, err := m.app.ListInterfaces()
+			return interfacesMsg{ifaces: ifaces, err: err}
+		}
+	case 3:
+		m.pendingAction = actionStaticIPv4
+		m.busy = true
+		return m, func() tea.Msg {
+			ifaces, err := m.app.ListInterfaces()
+			return interfacesMsg{ifaces: ifaces, err: err}
+		}
+	case 4:
+		m.screen = screenMain
+		m.cursor = 0
+		return m, nil
+	}
+	return m, nil
+}
+
+func (m model) handleInterfacePickMenu() (tea.Model, tea.Cmd) {
+	if len(m.interfaces) == 0 {
+		return m, resultCmd("interfaces", "No physical interfaces found", nil, screenNetwork)
+	}
+	m.selectedIface = m.interfaces[m.cursor].Name
+	switch m.pendingAction {
+	case actionDHCPOne:
+		m.busy = true
+		return m, func() tea.Msg {
+			result, err := m.app.DHCPOneResult(m.selectedIface)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
+		}
+	case actionStaticIPv4:
+		defaults := m.app.DefaultStaticIPv4FormFields(m.selectedIface)
+		m.formFields = []formField{
+			{Label: "IPv4 address", Value: defaults[0]},
+			{Label: "Prefix", Value: defaults[1]},
+			{Label: "Gateway", Value: strings.TrimSpace(defaults[2])},
+			{Label: "DNS (space-separated)", Value: defaults[3]},
+		}
+		m.formIndex = 0
+		m.screen = screenStaticForm
+		return m, nil
+	default:
+		return m, nil
+	}
+}
--- a/audit/internal/tui/screen_services.go
+++ b/audit/internal/tui/screen_services.go
@@ -0,0 +1,46 @@
+package tui
+
+import (
+	"bee/audit/internal/platform"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m model) handleServicesMenu() (tea.Model, tea.Cmd) {
+	if len(m.services) == 0 {
+		return m, resultCmd("bee services", "No bee-* services found", nil, screenMain)
+	}
+	m.selectedService = m.services[m.cursor]
+	m.screen = screenServiceAction
+	m.cursor = 0
+	return m, nil
+}
+
+func (m model) handleServiceActionMenu() (tea.Model, tea.Cmd) {
+	action := m.serviceMenu[m.cursor]
+	if action == "back" {
+		m.screen = screenServices
+		m.cursor = 0
+		return m, nil
+	}
+
+	m.busy = true
+	return m, func() tea.Msg {
+		switch action {
+		case "status":
+			result, err := m.app.ServiceStatusResult(m.selectedService)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
+		case "restart":
+			result, err := m.app.ServiceActionResult(m.selectedService, platform.ServiceRestart)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
+		case "start":
+			result, err := m.app.ServiceActionResult(m.selectedService, platform.ServiceStart)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
+		case "stop":
+			result, err := m.app.ServiceActionResult(m.selectedService, platform.ServiceStop)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
+		default:
+			return resultMsg{title: "service", body: "unknown action", back: screenServiceAction}
+		}
+	}
+}
--- a/audit/internal/tui/tui_test.go
+++ b/audit/internal/tui/tui_test.go
@@ -0,0 +1,349 @@
+package tui
+
+import (
+	"testing"
+
+	"bee/audit/internal/app"
+	"bee/audit/internal/platform"
+	"bee/audit/internal/runtimeenv"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func newTestModel() model {
+	return newModel(app.New(platform.New()), runtimeenv.ModeLocal)
+}
+
+func sendKey(t *testing.T, m model, key tea.KeyType) model {
+	t.Helper()
+
+	next, _ := m.Update(tea.KeyMsg{Type: key})
+	return next.(model)
+}
+
+func TestUpdateMainMenuCursorNavigation(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+
+	m = sendKey(t, m, tea.KeyDown)
+	if m.cursor != 1 {
+		t.Fatalf("cursor=%d want 1 after down", m.cursor)
+	}
+
+	m = sendKey(t, m, tea.KeyDown)
+	if m.cursor != 2 {
+		t.Fatalf("cursor=%d want 2 after second down", m.cursor)
+	}
+
+	m = sendKey(t, m, tea.KeyUp)
+	if m.cursor != 1 {
+		t.Fatalf("cursor=%d want 1 after up", m.cursor)
+	}
+}
+
+func TestUpdateMainMenuEnterActions(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		cursor     int
+		wantScreen screen
+		wantBusy   bool
+		wantCmd    bool
+	}{
+		{name: "network", cursor: 0, wantScreen: screenNetwork},
+		{name: "services", cursor: 1, wantScreen: screenMain, wantBusy: true, wantCmd: true},
+		{name: "acceptance", cursor: 2, wantScreen: screenAcceptance},
+		{name: "run audit", cursor: 3, wantScreen: screenMain, wantBusy: true, wantCmd: true},
+		{name: "export", cursor: 4, wantScreen: screenMain, wantBusy: true, wantCmd: true},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			m := newTestModel()
+			m.cursor = test.cursor
+
+			next, cmd := m.Update(tea.KeyMsg{Type: tea.KeyEnter})
+			got := next.(model)
+
+			if got.screen != test.wantScreen {
+				t.Fatalf("screen=%q want %q", got.screen, test.wantScreen)
+			}
+			if got.busy != test.wantBusy {
+				t.Fatalf("busy=%v want %v", got.busy, test.wantBusy)
+			}
+			if (cmd != nil) != test.wantCmd {
+				t.Fatalf("cmd present=%v want %v", cmd != nil, test.wantCmd)
+			}
+		})
+	}
+}
+
+func TestUpdateConfirmCancelViaKeys(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenConfirm
+	m.pendingAction = actionRunNvidiaSAT
+
+	next, _ := m.Update(tea.KeyMsg{Type: tea.KeyRight})
+	got := next.(model)
+	if got.cursor != 1 {
+		t.Fatalf("cursor=%d want 1 after right", got.cursor)
+	}
+
+	next, _ = got.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	got = next.(model)
+	if got.screen != screenAcceptance {
+		t.Fatalf("screen=%q want %q", got.screen, screenAcceptance)
+	}
+	if got.cursor != 0 {
+		t.Fatalf("cursor=%d want 0 after cancel", got.cursor)
+	}
+}
+
+func TestMainMenuSimpleTransitions(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		cursor     int
+		wantScreen screen
+	}{
+		{name: "network", cursor: 0, wantScreen: screenNetwork},
+		{name: "acceptance", cursor: 2, wantScreen: screenAcceptance},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			m := newTestModel()
+			m.cursor = test.cursor
+
+			next, cmd := m.handleMainMenu()
+			got := next.(model)
+
+			if cmd != nil {
+				t.Fatalf("expected nil cmd for %s", test.name)
+			}
+			if got.screen != test.wantScreen {
+				t.Fatalf("screen=%q want %q", got.screen, test.wantScreen)
+			}
+			if got.cursor != 0 {
+				t.Fatalf("cursor=%d want 0", got.cursor)
+			}
+		})
+	}
+}
+
+func TestMainMenuAsyncActionsSetBusy(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		cursor int
+	}{
+		{name: "services", cursor: 1},
+		{name: "run audit", cursor: 3},
+		{name: "export", cursor: 4},
+		{name: "check tools", cursor: 5},
+		{name: "log tail", cursor: 6},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			m := newTestModel()
+			m.cursor = test.cursor
+
+			next, cmd := m.handleMainMenu()
+			got := next.(model)
+
+			if !got.busy {
+				t.Fatalf("busy=false for %s", test.name)
+			}
+			if cmd == nil {
+				t.Fatalf("expected async cmd for %s", test.name)
+			}
+		})
+	}
+}
+
+func TestEscapeNavigation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		screen     screen
+		wantScreen screen
+	}{
+		{name: "network to main", screen: screenNetwork, wantScreen: screenMain},
+		{name: "services to main", screen: screenServices, wantScreen: screenMain},
+		{name: "acceptance to main", screen: screenAcceptance, wantScreen: screenMain},
+		{name: "service action to services", screen: screenServiceAction, wantScreen: screenServices},
+		{name: "export targets to main", screen: screenExportTargets, wantScreen: screenMain},
+		{name: "interface pick to network", screen: screenInterfacePick, wantScreen: screenNetwork},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			m := newTestModel()
+			m.screen = test.screen
+			m.cursor = 3
+
+			next, _ := m.updateKey(tea.KeyMsg{Type: tea.KeyEsc})
+			got := next.(model)
+
+			if got.screen != test.wantScreen {
+				t.Fatalf("screen=%q want %q", got.screen, test.wantScreen)
+			}
+			if got.cursor != 0 {
+				t.Fatalf("cursor=%d want 0", got.cursor)
+			}
+		})
+	}
+}
+
+func TestOutputScreenReturnsToPreviousScreen(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenOutput
+	m.prevScreen = screenNetwork
+	m.title = "title"
+	m.body = "body"
+
+	next, _ := m.updateKey(tea.KeyMsg{Type: tea.KeyEnter})
+	got := next.(model)
+
+	if got.screen != screenNetwork {
+		t.Fatalf("screen=%q want %q", got.screen, screenNetwork)
+	}
+	if got.title != "" || got.body != "" {
+		t.Fatalf("expected output state cleared, got title=%q body=%q", got.title, got.body)
+	}
+}
+
+func TestAcceptanceConfirmFlow(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenAcceptance
+	m.cursor = 0
+
+	next, cmd := m.handleAcceptanceMenu()
+	got := next.(model)
+
+	if cmd != nil {
+		t.Fatal("expected nil cmd")
+	}
+	if got.screen != screenConfirm {
+		t.Fatalf("screen=%q want %q", got.screen, screenConfirm)
+	}
+	if got.pendingAction != actionRunNvidiaSAT {
+		t.Fatalf("pendingAction=%q want %q", got.pendingAction, actionRunNvidiaSAT)
+	}
+
+	next, _ = got.updateConfirm(tea.KeyMsg{Type: tea.KeyEsc})
+	got = next.(model)
+	if got.screen != screenAcceptance {
+		t.Fatalf("screen after esc=%q want %q", got.screen, screenAcceptance)
+	}
+}
+
+func TestExportTargetSelectionOpensConfirm(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenExportTargets
+	m.targets = []platform.RemovableTarget{{Device: "/dev/sdb1", FSType: "vfat", Size: "16G"}}
+
+	next, cmd := m.handleExportTargetsMenu()
+	got := next.(model)
+
+	if cmd != nil {
+		t.Fatal("expected nil cmd")
+	}
+	if got.screen != screenConfirm {
+		t.Fatalf("screen=%q want %q", got.screen, screenConfirm)
+	}
+	if got.pendingAction != actionExportAudit {
+		t.Fatalf("pendingAction=%q want %q", got.pendingAction, actionExportAudit)
+	}
+	if got.selectedTarget == nil || got.selectedTarget.Device != "/dev/sdb1" {
+		t.Fatalf("selectedTarget=%+v want /dev/sdb1", got.selectedTarget)
+	}
+}
+
+func TestInterfacePickStaticIPv4OpensForm(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.pendingAction = actionStaticIPv4
+	m.interfaces = []platform.InterfaceInfo{{Name: "eth0"}}
+
+	next, cmd := m.handleInterfacePickMenu()
+	got := next.(model)
+
+	if cmd != nil {
+		t.Fatal("expected nil cmd")
+	}
+	if got.screen != screenStaticForm {
+		t.Fatalf("screen=%q want %q", got.screen, screenStaticForm)
+	}
+	if got.selectedIface != "eth0" {
+		t.Fatalf("selectedIface=%q want eth0", got.selectedIface)
+	}
+	if len(got.formFields) != 4 {
+		t.Fatalf("len(formFields)=%d want 4", len(got.formFields))
+	}
+}
+
+func TestResultMsgUsesExplicitBackScreen(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenConfirm
+
+	next, _ := m.Update(resultMsg{title: "done", body: "ok", back: screenNetwork})
+	got := next.(model)
+
+	if got.screen != screenOutput {
+		t.Fatalf("screen=%q want %q", got.screen, screenOutput)
+	}
+	if got.prevScreen != screenNetwork {
+		t.Fatalf("prevScreen=%q want %q", got.prevScreen, screenNetwork)
+	}
+}
+
+func TestConfirmCancelTarget(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+
+	m.pendingAction = actionExportAudit
+	if got := m.confirmCancelTarget(); got != screenExportTargets {
+		t.Fatalf("export cancel target=%q want %q", got, screenExportTargets)
+	}
+
+	m.pendingAction = actionRunNvidiaSAT
+	if got := m.confirmCancelTarget(); got != screenAcceptance {
+		t.Fatalf("sat cancel target=%q want %q", got, screenAcceptance)
+	}
+
+	m.pendingAction = actionNone
+	if got := m.confirmCancelTarget(); got != screenMain {
+		t.Fatalf("default cancel target=%q want %q", got, screenMain)
+	}
+}
--- a/audit/internal/tui/types.go
+++ b/audit/internal/tui/types.go
@@ -0,0 +1,107 @@
+package tui
+
+import (
+	"bee/audit/internal/app"
+	"bee/audit/internal/platform"
+	"bee/audit/internal/runtimeenv"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+type screen string
+
+const (
+	screenMain          screen = "main"
+	screenNetwork       screen = "network"
+	screenInterfacePick screen = "interface_pick"
+	screenServices      screen = "services"
+	screenServiceAction screen = "service_action"
+	screenAcceptance    screen = "acceptance"
+	screenExportTargets screen = "export_targets"
+	screenOutput        screen = "output"
+	screenStaticForm    screen = "static_form"
+	screenConfirm       screen = "confirm"
+)
+
+type actionKind string
+
+const (
+	actionNone         actionKind = ""
+	actionDHCPOne      actionKind = "dhcp_one"
+	actionStaticIPv4   actionKind = "static_ipv4"
+	actionExportAudit  actionKind = "export_audit"
+	actionRunNvidiaSAT actionKind = "run_nvidia_sat"
+)
+
+type model struct {
+	app         *app.App
+	runtimeMode runtimeenv.Mode
+
+	screen      screen
+	prevScreen  screen
+	cursor      int
+	busy        bool
+	title       string
+	body        string
+	mainMenu    []string
+	networkMenu []string
+	serviceMenu []string
+
+	services        []string
+	interfaces      []platform.InterfaceInfo
+	targets         []platform.RemovableTarget
+	selectedService string
+	selectedIface   string
+	selectedTarget  *platform.RemovableTarget
+	pendingAction   actionKind
+
+	formFields []formField
+	formIndex  int
+}
+
+type formField struct {
+	Label string
+	Value string
+}
+
+func Run(application *app.App, runtimeMode runtimeenv.Mode) error {
+	program := tea.NewProgram(newModel(application, runtimeMode), tea.WithAltScreen())
+	_, err := program.Run()
+	return err
+}
+
+func newModel(application *app.App, runtimeMode runtimeenv.Mode) model {
+	return model{
+		app:         application,
+		runtimeMode: runtimeMode,
+		screen:      screenMain,
+		mainMenu: []string{
+			"Network setup",
+			"bee service management",
+			"System acceptance tests",
+			"Run audit now",
+			"Export audit to removable drive",
+			"Check required tools",
+			"Show last audit log tail",
+			"Exit",
+		},
+		networkMenu: []string{
+			"Show network status",
+			"DHCP on all interfaces",
+			"DHCP on one interface",
+			"Set static IPv4 on one interface",
+			"Back",
+		},
+		serviceMenu: []string{
+			"status",
+			"restart",
+			"start",
+			"stop",
+			"back",
+		},
+	}
+}
+
+func (m model) Init() tea.Cmd {
+	return nil
+}
--- a/audit/internal/tui/update.go
+++ b/audit/internal/tui/update.go
@@ -0,0 +1,154 @@
+package tui
+
+import (
+	"fmt"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		if m.busy {
+			switch msg.String() {
+			case "ctrl+c":
+				return m, tea.Quit
+			default:
+				return m, nil
+			}
+		}
+		return m.updateKey(msg)
+	case resultMsg:
+		m.busy = false
+		m.title = msg.title
+		if msg.err != nil {
+			m.body = fmt.Sprintf("%s\n\nERROR: %v", strings.TrimSpace(msg.body), msg.err)
+		} else {
+			m.body = msg.body
+		}
+		if msg.back != "" {
+			m.prevScreen = msg.back
+		} else {
+			m.prevScreen = m.screen
+		}
+		m.screen = screenOutput
+		m.cursor = 0
+		return m, nil
+	case servicesMsg:
+		m.busy = false
+		if msg.err != nil {
+			m.title = "bee services"
+			m.body = msg.err.Error()
+			m.prevScreen = screenMain
+			m.screen = screenOutput
+			return m, nil
+		}
+		m.services = msg.services
+		m.screen = screenServices
+		m.cursor = 0
+		return m, nil
+	case interfacesMsg:
+		m.busy = false
+		if msg.err != nil {
+			m.title = "interfaces"
+			m.body = msg.err.Error()
+			m.prevScreen = screenMain
+			m.screen = screenOutput
+			return m, nil
+		}
+		m.interfaces = msg.ifaces
+		m.screen = screenInterfacePick
+		m.cursor = 0
+		return m, nil
+	case exportTargetsMsg:
+		m.busy = false
+		if msg.err != nil {
+			m.title = "export"
+			m.body = msg.err.Error()
+			m.prevScreen = screenMain
+			m.screen = screenOutput
+			return m, nil
+		}
+		m.targets = msg.targets
+		m.screen = screenExportTargets
+		m.cursor = 0
+		return m, nil
+	}
+
+	return m, nil
+}
+
+func (m model) updateKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch m.screen {
+	case screenMain:
+		return m.updateMenu(msg, len(m.mainMenu), m.handleMainMenu)
+	case screenNetwork:
+		return m.updateMenu(msg, len(m.networkMenu), m.handleNetworkMenu)
+	case screenServices:
+		return m.updateMenu(msg, len(m.services), m.handleServicesMenu)
+	case screenServiceAction:
+		return m.updateMenu(msg, len(m.serviceMenu), m.handleServiceActionMenu)
+	case screenAcceptance:
+		return m.updateMenu(msg, 2, m.handleAcceptanceMenu)
+	case screenExportTargets:
+		return m.updateMenu(msg, len(m.targets), m.handleExportTargetsMenu)
+	case screenInterfacePick:
+		return m.updateMenu(msg, len(m.interfaces), m.handleInterfacePickMenu)
+	case screenOutput:
+		switch msg.String() {
+		case "esc", "enter", "q":
+			m.screen = m.prevScreen
+			m.body = ""
+			m.title = ""
+			return m, nil
+		case "ctrl+c":
+			return m, tea.Quit
+		}
+	case screenStaticForm:
+		return m.updateStaticForm(msg)
+	case screenConfirm:
+		return m.updateConfirm(msg)
+	}
+
+	if msg.String() == "ctrl+c" {
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
+func (m model) updateMenu(msg tea.KeyMsg, size int, onEnter func() (tea.Model, tea.Cmd)) (tea.Model, tea.Cmd) {
+	if size == 0 {
+		size = 1
+	}
+	switch msg.String() {
+	case "up", "k":
+		if m.cursor > 0 {
+			m.cursor--
+		}
+	case "down", "j":
+		if m.cursor < size-1 {
+			m.cursor++
+		}
+	case "enter":
+		return onEnter()
+	case "esc":
+		switch m.screen {
+		case screenNetwork, screenServices, screenAcceptance:
+			m.screen = screenMain
+			m.cursor = 0
+		case screenServiceAction:
+			m.screen = screenServices
+			m.cursor = 0
+		case screenExportTargets:
+			m.screen = screenMain
+			m.cursor = 0
+		case screenInterfacePick:
+			m.screen = screenNetwork
+			m.cursor = 0
+		}
+	case "q", "ctrl+c":
+		return m, tea.Quit
+	}
+	return m, nil
+}
--- a/audit/internal/tui/view.go
+++ b/audit/internal/tui/view.go
@@ -0,0 +1,137 @@
+package tui
+
+import (
+	"fmt"
+	"strings"
+
+	"bee/audit/internal/platform"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m model) View() string {
+	if m.busy {
+		return "bee\n\nWorking...\n"
+	}
+	switch m.screen {
+	case screenMain:
+		return renderMenu("bee", "Select action", m.mainMenu, m.cursor)
+	case screenNetwork:
+		return renderMenu("Network", "Select action", m.networkMenu, m.cursor)
+	case screenServices:
+		return renderMenu("bee services", "Select service", m.services, m.cursor)
+	case screenServiceAction:
+		items := make([]string, len(m.serviceMenu))
+		copy(items, m.serviceMenu)
+		return renderMenu("Service: "+m.selectedService, "Select action", items, m.cursor)
+	case screenAcceptance:
+		return renderMenu("System acceptance tests", "Select action", []string{"Run NVIDIA command pack", "Back"}, m.cursor)
+	case screenExportTargets:
+		return renderMenu("Export audit", "Select removable filesystem", renderTargetItems(m.targets), m.cursor)
+	case screenInterfacePick:
+		return renderMenu("Interfaces", "Select interface", renderInterfaceItems(m.interfaces), m.cursor)
+	case screenStaticForm:
+		return renderForm("Static IPv4: "+m.selectedIface, m.formFields, m.formIndex)
+	case screenConfirm:
+		title, body := m.confirmBody()
+		return renderConfirm(title, body, m.cursor)
+	case screenOutput:
+		return fmt.Sprintf("%s\n\n%s\n\n[enter/esc] back  [ctrl+c] quit\n", m.title, strings.TrimSpace(m.body))
+	default:
+		return "bee\n"
+	}
+}
+
+func (m model) confirmBody() (string, string) {
+	switch m.pendingAction {
+	case actionExportAudit:
+		if m.selectedTarget == nil {
+			return "Export audit", "No target selected"
+		}
+		return "Export audit", fmt.Sprintf("Copy latest audit JSON to %s?", m.selectedTarget.Device)
+	case actionRunNvidiaSAT:
+		return "NVIDIA SAT", "Run NVIDIA acceptance command pack?"
+	default:
+		return "Confirm", "Proceed?"
+	}
+}
+
+func renderTargetItems(targets []platform.RemovableTarget) []string {
+	items := make([]string, 0, len(targets))
+	for _, target := range targets {
+		desc := fmt.Sprintf("%s [%s %s]", target.Device, target.FSType, target.Size)
+		if target.Label != "" {
+			desc += " label=" + target.Label
+		}
+		if target.Mountpoint != "" {
+			desc += " mounted=" + target.Mountpoint
+		}
+		items = append(items, desc)
+	}
+	return items
+}
+
+func renderInterfaceItems(interfaces []platform.InterfaceInfo) []string {
+	items := make([]string, 0, len(interfaces))
+	for _, iface := range interfaces {
+		label := iface.Name
+		if len(iface.IPv4) > 0 {
+			label += " [" + strings.Join(iface.IPv4, ", ") + "]"
+		}
+		items = append(items, label)
+	}
+	return items
+}
+
+func renderMenu(title, subtitle string, items []string, cursor int) string {
+	var body strings.Builder
+	fmt.Fprintf(&body, "%s\n\n%s\n\n", title, subtitle)
+	if len(items) == 0 {
+		body.WriteString("(no items)\n")
+	} else {
+		for i, item := range items {
+			prefix := "  "
+			if i == cursor {
+				prefix = "> "
+			}
+			fmt.Fprintf(&body, "%s%s\n", prefix, item)
+		}
+	}
+	body.WriteString("\n[↑/↓] move  [enter] select  [esc] back  [ctrl+c] quit\n")
+	return body.String()
+}
+
+func renderForm(title string, fields []formField, idx int) string {
+	var body strings.Builder
+	fmt.Fprintf(&body, "%s\n\n", title)
+	for i, field := range fields {
+		prefix := "  "
+		if i == idx {
+			prefix = "> "
+		}
+		fmt.Fprintf(&body, "%s%s: %s\n", prefix, field.Label, field.Value)
+	}
+	body.WriteString("\n[tab/↑/↓] move  [enter] next/submit  [backspace] delete  [esc] cancel\n")
+	return body.String()
+}
+
+func renderConfirm(title, body string, cursor int) string {
+	options := []string{"Confirm", "Cancel"}
+	var out strings.Builder
+	fmt.Fprintf(&out, "%s\n\n%s\n\n", title, body)
+	for i, option := range options {
+		prefix := "  "
+		if i == cursor {
+			prefix = "> "
+		}
+		fmt.Fprintf(&out, "%s%s\n", prefix, option)
+	}
+	out.WriteString("\n[←/→/↑/↓] move  [enter] select  [esc] cancel\n")
+	return out.String()
+}
+
+func resultCmd(title, body string, err error, back screen) tea.Cmd {
+	return func() tea.Msg {
+		return resultMsg{title: title, body: body, err: err, back: back}
+	}
+}