feat(tpm): add read-only TPM validation

bible-local/README.md

@@ -23,6 +23,11 @@ Generic engineering rules live in `bible/rules/patterns/`.
   - `lscpu`
   - `sensors`
   - `stress-ng`
+- TPM check (read-only)
+  - `tpm2_getcap properties-fixed`
+  - `tpm2_getcap pcrs`
+  - `tpm2_pcrread`
+  - `tpm2_gettestresult` (reads the existing result; does not start `TPM2_SelfTest`)
 - Memory check
   - `free`
   - `timeout <timeout_sec> memtester`

bible-local/architecture/runtime-flows.md

@@ -149,7 +149,8 @@ Current validation state:
   5. pcie collector    (lspci -vmm -D, /sys/bus/pci/devices/)
   6. psu collector     (ipmitool fru + sdr — silent if no /dev/ipmi0)
   7. nvidia enrichment (nvidia-smi — skipped if binary absent or driver not loaded)
-  8. output JSON → /var/log/bee-audit.json
+  8. TPM inventory (sysfs presence + `tpm2_getcap properties-fixed`; no state changes)
+  9. output JSON → /var/log/bee-audit.json
 ```
 
 Every collector returns `nil, nil` on tool-not-found. Errors are logged, never fatal.
@@ -159,6 +160,7 @@ Acceptance flows:
 - NVIDIA GPU burn-in can use either `bee-gpu-burn` or `bee-john-gpu-stress` (John the Ripper jumbo via OpenCL)
 - `bee sat memory` → `memtester` archive
 - `bee sat storage` → SMART/NVMe diagnostic archive and short self-test trigger where supported
+- `bee` TPM Validate → read-only capabilities, PCR values, and existing self-test result; never starts `TPM2_SelfTest`
 - SAT `summary.txt` now includes `overall_status` and per-job `*_status` values (`OK`, `FAILED`, `UNSUPPORTED`)
 - `bee-gpu-burn` should prefer cuBLASLt GEMM load over the old integer/PTX burn path:
   - Ampere: `fp16` + `fp32`/TF32 tensor-core load

bible-local/architecture/system-overview.md

@@ -18,7 +18,7 @@ Fills gaps where Redfish/logpile is blind:
 
 ## In scope
 
-- Read-only hardware inventory: board, CPU, memory, storage, PCIe, PSU, GPU, NIC, RAID
+- Read-only hardware inventory: board, CPU, memory, storage, PCIe, PSU, GPU, NIC, RAID, TPM
 - Machine-readable health summary derived from collector verdicts
 - Operator-triggered acceptance tests for NVIDIA, memory, and storage
 - NVIDIA SAT includes diagnostic collection plus a lightweight in-image GPU stress step via `bee-gpu-burn`

bible-local/docs/hardware-ingest-contract.md

@@ -763,6 +763,11 @@ PSU без `serial_number` игнорируется.
 }
 ```
 
+`bee` emits the following TPM keys in this object: `TpmPresent`, `TpmEnabled`,
+`TpmDevice`, `TpmInterface`, `TpmVersion`, `TpmManufacturer`, and
+`TpmFirmwareVersion`. Detection and identity collection are read-only; absent
+optional identity fields are omitted.
+
 ---
 
 ## Обработка статусов компонентов

bible-local/docs/validate-vs-burn.md

@@ -18,6 +18,7 @@ Tests on the **Validate** page are purely diagnostic. They:
 | Storage | `smartctl -a`, `nvme smart-log` — reads SMART data only |
 | CPU | `stress-ng` for a bounded duration; CPU-only, no I/O |
 | AMD GPU | `rocm-smi --showallinfo`, `dmidecode` — read-only queries |
+| TPM | `tpm2_getcap`, `tpm2_pcrread`, `tpm2_gettestresult` — read-only queries; does not start `TPM2_SelfTest` |
 
 ## Burn Tests (hardware wear)