Embed Reanimator Chart web viewer

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "bible"]
 	path = bible
 	url = https://git.mchus.pro/mchus/bible.git
+[submodule "internal/chart"]
+	path = internal/chart
+	url = https://git.mchus.pro/reanimator/chart.git

PLAN.md

@@ -4,13 +4,13 @@ Hardware audit LiveCD for offline server inventory.
 Produces `HardwareIngestRequest` JSON compatible with core/reanimator.
 
 **Principle:** OS-level collection — reads hardware directly, not through BMC.
-Fully unattended — no user interaction required at any stage. Boot → update → audit → output → done.
-All errors are logged, never presented interactively. Every failure path has a silent fallback.
+Automatic boot audit plus operator console. Boot runs audit immediately, but local/SSH operators can rerun checks through the TUI and CLI.
+Errors are logged and should not block boot on partial collector failures.
 Fills the gaps where logpile/Redfish is blind: NVMe, DIMM serials, GPU serials, physical disks behind RAID, full SMART, NIC firmware.
 
 ---
 
-## Status snapshot (2026-03-06)
+## Status snapshot (2026-03-14)
 
 ### Phase 1 — Go Audit Binary
 
@@ -23,8 +23,10 @@ Fills the gaps where logpile/Redfish is blind: NVMe, DIMM serials, GPU serials,
 - 1.7 PSU collector — **DONE (basic FRU path)**
 - 1.8 NVIDIA GPU enrichment — **DONE**
 - 1.8b Component wear / age telemetry — **DONE** (storage + NVMe + NVIDIA + NIC SFP/DOM + NIC packet stats)
+- 1.8c Storage health verdicts — **DONE** (SMART/NVMe warning/failed status derivation)
 - 1.9 Mellanox/NVIDIA NIC enrichment — **DONE** (mstflint + ethtool firmware fallback)
 - 1.10 RAID controller enrichment — **DONE (initial multi-tool support)** (storcli + sas2/3ircu + arcconf + ssacli + VROC/mdstat)
+- 1.11 PSU SDR health — **DONE** (`ipmitool sdr` merged with FRU inventory)
 - 1.11 Output and export workflow — **DONE** (explicit file output + manual removable export via TUI)
 - 1.12 Integration test (local) — **DONE** (`scripts/test-local.sh`)
 
@@ -33,9 +35,14 @@ Fills the gaps where logpile/Redfish is blind: NVMe, DIMM serials, GPU serials,
 - Current implementation uses Debian 12 `live-build`, `systemd`, and OpenSSH.
 - Network bring-up on boot — **DONE**
 - Boot services (`bee-network`, `bee-nvidia`, `bee-audit`, `bee-sshsetup`) — **DONE**
+- Local console UX (`bee` autologin on `tty1`, `menu` auto-start, TUI privilege escalation via `sudo -n`) — **DONE**
+- VM/debug support (`qemu-guest-agent`, serial console, virtual GPU initramfs modules) — **DONE**
 - Vendor utilities in overlay — **DONE**
 - Build metadata + staged overlay injection — **DONE**
+- Builder container cache persisted outside container writable layer — **DONE**
+- ISO volume label `BEE` — **DONE**
 - Auto-update flow remains deferred; current focus is deterministic offline audit ISO behavior.
+- Real-hardware validation remains **PENDING**; current validation is limited to local/libvirt VM boot + service checks.
 
 ---
 
@@ -334,8 +341,14 @@ Planned code shape:
 ### 2.5 — Operator workflows
 
 - Automatic boot audit writes JSON to `/var/log/bee-audit.json`
+- `tty1` autologins into `bee` and auto-runs `menu`
+- `menu` launches the LiveCD wrapper `bee-tui`, which escalates to `root` via `sudo -n`
 - `bee tui` can rerun the audit manually
 - `bee tui` can export the latest audit JSON to removable media
+- `bee tui` can show health summary and run NVIDIA/memory/storage acceptance tests
+- NVIDIA SAT now includes a lightweight in-image GPU stress step via `bee-gpu-stress`
+- SAT summaries now expose `overall_status` plus per-job `OK/FAILED/UNSUPPORTED`
+- Memory/GPU SAT runtime defaults can be overridden via `BEE_MEMTESTER_*` and `BEE_GPU_STRESS_*`
 - removable export requires explicit target selection, mount, confirmation, copy, and cleanup
 
 ### 2.6 — Vendor utilities and optional assets
@@ -343,7 +356,9 @@ Planned code shape:
 Optional binaries live in `iso/vendor/` and are included when present:
 - `storcli64`
 - `sas2ircu`, `sas3ircu`
-- `mstflint`
+- `arcconf`
+- `ssacli`
+- `mstflint` (via Debian package set)
 
 Missing optional tools do not fail the build or boot.
 
@@ -358,6 +373,7 @@ Missing optional tools do not fail the build or boot.
 Current release model:
 - shipping a new ISO means a full rebuild
 - build metadata is embedded into `/etc/bee-release` and `motd`
+- current ISO label is `BEE`
 - binary self-update remains deferred; no automatic USB/network patching is part of the current runtime
 
 ---
@@ -374,7 +390,7 @@ No "works on my Mac" drift.
 1.2  board collector               → first real data
 1.3  CPU collector                 → +CPUs
 
---- BUILDER + DEBUG ISO (unblock real-hardware testing) ---
+--- BUILDER + BEE ISO (unblock real-hardware testing) ---
 
 2.1  builder setup                 → Debian host/VM or privileged container with build deps
 2.2  debug ISO profile             → minimal Debian ISO: `bee` binary + OpenSSH + all packages
@@ -397,7 +413,7 @@ No "works on my Mac" drift.
 2.4  NVIDIA driver build           → driver compiled into overlay
 2.5  network bring-up on boot      → DHCP on all interfaces
 2.6  systemd boot service          → audit runs on boot automatically
-2.7  vendor utilities              → storcli/sas2ircu/mstflint in image
+2.7  vendor utilities              → storcli/sas2ircu/arcconf/ssacli in image
 2.8  release workflow              → versioning + release notes
 2.9  operator export flow          → explicit TUI export to removable media
 ```

audit/cmd/bee/main.go

@@ -12,6 +12,7 @@ import (
 	"bee/audit/internal/platform"
 	"bee/audit/internal/runtimeenv"
 	"bee/audit/internal/tui"
+	"bee/audit/internal/webui"
 )
 
 var Version = "dev"
@@ -27,11 +28,14 @@ func run(args []string, stdout, stderr io.Writer) int {
 
 	if len(args) == 0 {
 		printRootUsage(stderr)
-		return 1
+		return 2
 	}
 
 	switch args[0] {
 	case "help", "--help", "-h":
+		if len(args) > 1 {
+			return runHelp(args[1:], stdout, stderr)
+		}
 		printRootUsage(stdout)
 		return 0
 	case "audit":
@@ -40,6 +44,8 @@ func run(args []string, stdout, stderr io.Writer) int {
 		return runTUI(args[1:], stdout, stderr)
 	case "export":
 		return runExport(args[1:], stdout, stderr)
+	case "web":
+		return runWeb(args[1:], stdout, stderr)
 	case "sat":
 		return runSAT(args[1:], stdout, stderr)
 	case "version", "--version", "-version":
@@ -48,7 +54,7 @@ func run(args []string, stdout, stderr io.Writer) int {
 	default:
 		fmt.Fprintf(stderr, "bee: unknown command %q\n\n", args[0])
 		printRootUsage(stderr)
-		return 1
+		return 2
 	}
 }
 
@@ -57,8 +63,32 @@ func printRootUsage(w io.Writer) {
   bee audit   --runtime auto|local|livecd --output stdout|file:<path>
   bee tui     --runtime auto|local|livecd
   bee export  --target <device>
-  bee sat nvidia
-  bee version`)
+  bee web     --listen :80 --audit-path /var/log/bee-audit.json
+  bee sat nvidia|memory|storage
+  bee version
+  bee help [command]`)
+}
+
+func runHelp(args []string, stdout, stderr io.Writer) int {
+	switch args[0] {
+	case "audit":
+		return runAudit([]string{"--help"}, stdout, stdout)
+	case "tui":
+		return runTUI([]string{"--help"}, stdout, stdout)
+	case "export":
+		return runExport([]string{"--help"}, stdout, stdout)
+	case "web":
+		return runWeb([]string{"--help"}, stdout, stdout)
+	case "sat":
+		return runSAT([]string{"--help"}, stdout, stderr)
+	case "version":
+		fmt.Fprintln(stdout, "usage: bee version")
+		return 0
+	default:
+		fmt.Fprintf(stderr, "bee help: unknown command %q\n\n", args[0])
+		printRootUsage(stderr)
+		return 2
+	}
 }
 
 func runAudit(args []string, stdout, stderr io.Writer) int {
@@ -72,6 +102,13 @@ func runAudit(args []string, stdout, stderr io.Writer) int {
 		fs.PrintDefaults()
 	}
 	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
 		return 2
 	}
 	if *showVersion {
@@ -107,6 +144,13 @@ func runTUI(args []string, stdout, stderr io.Writer) int {
 		fs.PrintDefaults()
 	}
 	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
 		return 2
 	}
 
@@ -116,6 +160,10 @@ func runTUI(args []string, stdout, stderr io.Writer) int {
 		return 1
 	}
 
+	slog.SetDefault(slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{
+		Level: slog.LevelInfo,
+	})))
+
 	application := app.New(platform.New())
 	if err := tui.Run(application, runtimeInfo.Mode); err != nil {
 		slog.Error("run tui", "err", err)
@@ -133,6 +181,13 @@ func runExport(args []string, stdout, stderr io.Writer) int {
 		fs.PrintDefaults()
 	}
 	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
 		return 2
 	}
 	if strings.TrimSpace(*targetDevice) == "" {
@@ -164,22 +219,77 @@ func runExport(args []string, stdout, stderr io.Writer) int {
 	return 1
 }
 
-func runSAT(args []string, stdout, stderr io.Writer) int {
-	if len(args) == 0 || args[0] == "help" || args[0] == "--help" || args[0] == "-h" {
-		fmt.Fprintln(stderr, "usage: bee sat nvidia")
+func runWeb(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("web", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	listenAddr := fs.String("listen", ":8080", "listen address, e.g. :80")
+	auditPath := fs.String("audit-path", app.DefaultAuditJSONPath, "path to the latest audit JSON snapshot")
+	title := fs.String("title", "Bee Hardware Audit", "page title")
+	fs.Usage = func() {
+		fmt.Fprintln(stderr, "usage: bee web [--listen :80] [--audit-path /var/log/bee-audit.json] [--title \"Bee Hardware Audit\"]")
+		fs.PrintDefaults()
+	}
+	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
 		return 2
 	}
-	if args[0] != "nvidia" {
+	if fs.NArg() != 0 {
+		fs.Usage()
+		return 2
+	}
+
+	slog.Info("starting bee web", "listen", *listenAddr, "audit_path", *auditPath)
+	if err := webui.ListenAndServe(*listenAddr, webui.HandlerOptions{
+		Title:     *title,
+		AuditPath: *auditPath,
+	}); err != nil {
+		slog.Error("run web", "err", err)
+		return 1
+	}
+	return 0
+}
+
+func runSAT(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage")
+		return 2
+	}
+	if args[0] == "help" || args[0] == "--help" || args[0] == "-h" {
+		fmt.Fprintln(stdout, "usage: bee sat nvidia|memory|storage")
+		return 0
+	}
+	if args[0] != "nvidia" && args[0] != "memory" && args[0] != "storage" {
 		fmt.Fprintf(stderr, "bee sat: unknown target %q\n", args[0])
-		fmt.Fprintln(stderr, "usage: bee sat nvidia")
+		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage")
+		return 2
+	}
+	if len(args) > 1 {
+		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage")
 		return 2
 	}
 	application := app.New(platform.New())
-	archive, err := application.RunNvidiaAcceptancePack("")
+	var (
+		archive string
+		err     error
+		label   string
+	)
+	switch args[0] {
+	case "nvidia":
+		label = "nvidia"
+		archive, err = application.RunNvidiaAcceptancePack("")
+	case "memory":
+		label = "memory"
+		archive, err = application.RunMemoryAcceptancePack("")
+	case "storage":
+		label = "storage"
+		archive, err = application.RunStorageAcceptancePack("")
+	}
 	if err != nil {
-		slog.Error("run nvidia sat", "err", err)
+		slog.Error("run sat", "target", label, "err", err)
 		return 1
 	}
-	slog.Info("nvidia sat archive written", "path", archive)
+	slog.Info("sat archive written", "target", label, "path", archive)
 	return 0
 }

audit/cmd/bee/main_test.go

@@ -24,8 +24,8 @@ func TestRunNoArgsPrintsUsage(t *testing.T) {
 
 	var stdout, stderr bytes.Buffer
 	rc := run(nil, &stdout, &stderr)
-	if rc != 1 {
-		t.Fatalf("rc=%d want 1", rc)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
 	}
 	if !strings.Contains(stderr.String(), "bee commands:") {
 		t.Fatalf("stderr missing root usage:\n%s", stderr.String())
@@ -37,8 +37,8 @@ func TestRunUnknownCommand(t *testing.T) {
 
 	var stdout, stderr bytes.Buffer
 	rc := run([]string{"wat"}, &stdout, &stderr)
-	if rc != 1 {
-		t.Fatalf("rc=%d want 1", rc)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
 	}
 	if !strings.Contains(stderr.String(), `unknown command "wat"`) {
 		t.Fatalf("stderr missing unknown command message:\n%s", stderr.String())
@@ -86,11 +86,37 @@ func TestRunSATUsage(t *testing.T) {
 	if rc != 2 {
 		t.Fatalf("rc=%d want 2", rc)
 	}
-	if !strings.Contains(stderr.String(), "usage: bee sat nvidia") {
+	if !strings.Contains(stderr.String(), "usage: bee sat nvidia|memory|storage") {
 		t.Fatalf("stderr missing sat usage:\n%s", stderr.String())
 	}
 }
 
+func TestRunHelpForSubcommand(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"help", "export"}, &stdout, &stderr)
+	if rc != 0 {
+		t.Fatalf("rc=%d want 0", rc)
+	}
+	if !strings.Contains(stdout.String(), "usage: bee export --target <device>") {
+		t.Fatalf("stdout missing export help:\n%s", stdout.String())
+	}
+}
+
+func TestRunHelpUnknownSubcommand(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"help", "wat"}, &stdout, &stderr)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
+	}
+	if !strings.Contains(stderr.String(), `bee help: unknown command "wat"`) {
+		t.Fatalf("stderr missing help error:\n%s", stderr.String())
+	}
+}
+
 func TestRunSATUnknownTarget(t *testing.T) {
 	t.Parallel()
 
@@ -104,6 +130,32 @@ func TestRunSATUnknownTarget(t *testing.T) {
 	}
 }
 
+func TestRunSATHelp(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"sat", "--help"}, &stdout, &stderr)
+	if rc != 0 {
+		t.Fatalf("rc=%d want 0", rc)
+	}
+	if !strings.Contains(stdout.String(), "usage: bee sat nvidia|memory|storage") {
+		t.Fatalf("stdout missing sat help:\n%s", stdout.String())
+	}
+}
+
+func TestRunSATRejectsExtraArgs(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"sat", "memory", "extra"}, &stdout, &stderr)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
+	}
+	if !strings.Contains(stderr.String(), "usage: bee sat nvidia|memory|storage") {
+		t.Fatalf("stderr missing sat usage:\n%s", stderr.String())
+	}
+}
+
 func TestRunAuditInvalidRuntime(t *testing.T) {
 	t.Parallel()
 
@@ -113,3 +165,29 @@ func TestRunAuditInvalidRuntime(t *testing.T) {
 		t.Fatalf("rc=%d want 1", rc)
 	}
 }
+
+func TestRunAuditRejectsExtraArgs(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"audit", "extra"}, &stdout, &stderr)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
+	}
+	if !strings.Contains(stderr.String(), "usage: bee audit") {
+		t.Fatalf("stderr missing audit usage:\n%s", stderr.String())
+	}
+}
+
+func TestRunExportRejectsExtraArgs(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"export", "--target", "/dev/sdb1", "extra"}, &stdout, &stderr)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
+	}
+	if !strings.Contains(stderr.String(), "usage: bee export --target <device>") {
+		t.Fatalf("stderr missing export usage:\n%s", stderr.String())
+	}
+}

audit/go.mod

@@ -1,8 +1,11 @@
 module bee/audit
 
-go 1.23
+go 1.24.0
+
+replace reanimator/chart => ../internal/chart
 
 require github.com/charmbracelet/bubbletea v1.3.4
+require reanimator/chart v0.0.0
 
 require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect

audit/internal/app/app.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -12,11 +13,13 @@ import (
 	"bee/audit/internal/collector"
 	"bee/audit/internal/platform"
 	"bee/audit/internal/runtimeenv"
+	"bee/audit/internal/schema"
 )
 
-const (
+var (
 	DefaultAuditJSONPath = "/var/log/bee-audit.json"
 	DefaultAuditLogPath  = "/var/log/bee-audit.log"
+	DefaultSATBaseDir    = "/var/log/bee-sat"
 )
 
 type App struct {
@@ -58,6 +61,8 @@ type toolManager interface {
 
 type satRunner interface {
 	RunNvidiaAcceptancePack(baseDir string) (string, error)
+	RunMemoryAcceptancePack(baseDir string) (string, error)
+	RunStorageAcceptancePack(baseDir string) (string, error)
 }
 
 func New(platform *platform.System) *App {
@@ -124,7 +129,11 @@ func (a *App) ExportLatestAudit(target platform.RemovableTarget) (string, error)
 
 func (a *App) ExportLatestAuditResult(target platform.RemovableTarget) (ActionResult, error) {
 	path, err := a.ExportLatestAudit(target)
-	return ActionResult{Title: "Export audit", Body: "Audit exported to " + path}, err
+	body := "Audit exported."
+	if path != "" {
+		body = "Audit exported to " + path
+	}
+	return ActionResult{Title: "Export audit", Body: body}, err
 }
 
 func (a *App) ListInterfaces() ([]platform.InterfaceInfo, error) {
@@ -141,7 +150,7 @@ func (a *App) DHCPOne(iface string) (string, error) {
 
 func (a *App) DHCPOneResult(iface string) (ActionResult, error) {
 	body, err := a.network.DHCPOne(iface)
-	return ActionResult{Title: "DHCP on " + iface, Body: body}, err
+	return ActionResult{Title: "DHCP: " + iface, Body: bodyOr(body, "DHCP completed.")}, err
 }
 
 func (a *App) DHCPAll() (string, error) {
@@ -150,7 +159,7 @@ func (a *App) DHCPAll() (string, error) {
 
 func (a *App) DHCPAllResult() (ActionResult, error) {
 	body, err := a.network.DHCPAll()
-	return ActionResult{Title: "DHCP all interfaces", Body: body}, err
+	return ActionResult{Title: "DHCP: all interfaces", Body: bodyOr(body, "DHCP completed.")}, err
 }
 
 func (a *App) SetStaticIPv4(cfg platform.StaticIPv4Config) (string, error) {
@@ -159,7 +168,7 @@ func (a *App) SetStaticIPv4(cfg platform.StaticIPv4Config) (string, error) {
 
 func (a *App) SetStaticIPv4Result(cfg platform.StaticIPv4Config) (ActionResult, error) {
 	body, err := a.network.SetStaticIPv4(cfg)
-	return ActionResult{Title: "Static IPv4 on " + cfg.Interface, Body: body}, err
+	return ActionResult{Title: "Static IPv4: " + cfg.Interface, Body: bodyOr(body, "Static IPv4 updated.")}, err
 }
 
 func (a *App) NetworkStatus() (ActionResult, error) {
@@ -167,6 +176,9 @@ func (a *App) NetworkStatus() (ActionResult, error) {
 	if err != nil {
 		return ActionResult{Title: "Network status"}, err
 	}
+	if len(ifaces) == 0 {
+		return ActionResult{Title: "Network status", Body: "No physical interfaces found."}, nil
+	}
 	var body strings.Builder
 	for _, iface := range ifaces {
 		ipv4 := "(no IPv4)"
@@ -216,7 +228,7 @@ func (a *App) ServiceStatus(name string) (string, error) {
 
 func (a *App) ServiceStatusResult(name string) (ActionResult, error) {
 	body, err := a.services.ServiceStatus(name)
-	return ActionResult{Title: "service: " + name, Body: body}, err
+	return ActionResult{Title: "service status: " + name, Body: bodyOr(body, "No status output.")}, err
 }
 
 func (a *App) ServiceDo(name string, action platform.ServiceAction) (string, error) {
@@ -225,7 +237,7 @@ func (a *App) ServiceDo(name string, action platform.ServiceAction) (string, err
 
 func (a *App) ServiceActionResult(name string, action platform.ServiceAction) (ActionResult, error) {
 	body, err := a.services.ServiceDo(name, action)
-	return ActionResult{Title: "service: " + name, Body: body}, err
+	return ActionResult{Title: "service " + string(action) + ": " + name, Body: bodyOr(body, "Action completed.")}, err
 }
 
 func (a *App) ListRemovableTargets() ([]platform.RemovableTarget, error) {
@@ -241,6 +253,9 @@ func (a *App) CheckTools(names []string) []platform.ToolStatus {
 }
 
 func (a *App) ToolCheckResult(names []string) ActionResult {
+	if len(names) == 0 {
+		return ActionResult{Title: "Required tools", Body: "No tools checked."}
+	}
 	var body strings.Builder
 	for _, tool := range a.tools.CheckTools(names) {
 		status := "MISSING"
@@ -253,7 +268,12 @@ func (a *App) ToolCheckResult(names []string) ActionResult {
 }
 
 func (a *App) AuditLogTailResult() ActionResult {
-	body := a.tools.TailFile(DefaultAuditLogPath, 40) + "\n\n" + a.tools.TailFile(DefaultAuditJSONPath, 20)
+	logTail := strings.TrimSpace(a.tools.TailFile(DefaultAuditLogPath, 40))
+	jsonTail := strings.TrimSpace(a.tools.TailFile(DefaultAuditJSONPath, 20))
+	body := strings.TrimSpace(logTail + "\n\n" + jsonTail)
+	if body == "" {
+		body = "No audit logs found."
+	}
 	return ActionResult{Title: "Audit log tail", Body: body}
 }
 
@@ -263,7 +283,104 @@ func (a *App) RunNvidiaAcceptancePack(baseDir string) (string, error) {
 
 func (a *App) RunNvidiaAcceptancePackResult(baseDir string) (ActionResult, error) {
 	path, err := a.sat.RunNvidiaAcceptancePack(baseDir)
-	return ActionResult{Title: "NVIDIA SAT", Body: "Archive written to " + path}, err
+	body := "Archive written."
+	if path != "" {
+		body = "Archive written to " + path
+	}
+	return ActionResult{Title: "NVIDIA SAT", Body: body}, err
+}
+
+func (a *App) RunMemoryAcceptancePack(baseDir string) (string, error) {
+	return a.sat.RunMemoryAcceptancePack(baseDir)
+}
+
+func (a *App) RunMemoryAcceptancePackResult(baseDir string) (ActionResult, error) {
+	path, err := a.sat.RunMemoryAcceptancePack(baseDir)
+	body := "Archive written."
+	if path != "" {
+		body = "Archive written to " + path
+	}
+	return ActionResult{Title: "Memory SAT", Body: body}, err
+}
+
+func (a *App) RunStorageAcceptancePack(baseDir string) (string, error) {
+	return a.sat.RunStorageAcceptancePack(baseDir)
+}
+
+func (a *App) RunStorageAcceptancePackResult(baseDir string) (ActionResult, error) {
+	path, err := a.sat.RunStorageAcceptancePack(baseDir)
+	body := "Archive written."
+	if path != "" {
+		body = "Archive written to " + path
+	}
+	return ActionResult{Title: "Storage SAT", Body: body}, err
+}
+
+func (a *App) HealthSummaryResult() ActionResult {
+	raw, err := os.ReadFile(DefaultAuditJSONPath)
+	if err != nil {
+		return ActionResult{Title: "Health summary", Body: "No audit JSON found."}
+	}
+	var snapshot schema.HardwareIngestRequest
+	if err := json.Unmarshal(raw, &snapshot); err != nil {
+		return ActionResult{Title: "Health summary", Body: "Audit JSON is unreadable."}
+	}
+
+	summary := collector.BuildHealthSummary(snapshot.Hardware)
+	var body strings.Builder
+	status := summary.Status
+	if status == "" {
+		status = "Unknown"
+	}
+	fmt.Fprintf(&body, "Overall: %s\n", status)
+	fmt.Fprintf(&body, "Storage: warn=%d fail=%d\n", summary.StorageWarn, summary.StorageFail)
+	fmt.Fprintf(&body, "PCIe: warn=%d fail=%d\n", summary.PCIeWarn, summary.PCIeFail)
+	fmt.Fprintf(&body, "PSU: warn=%d fail=%d\n", summary.PSUWarn, summary.PSUFail)
+	fmt.Fprintf(&body, "Memory: warn=%d fail=%d\n", summary.MemoryWarn, summary.MemoryFail)
+	for _, item := range latestSATSummaries() {
+		fmt.Fprintf(&body, "\n\n%s", item)
+	}
+	if len(summary.Failures) > 0 {
+		fmt.Fprintf(&body, "\n\nFailures:\n- %s", strings.Join(summary.Failures, "\n- "))
+	}
+	if len(summary.Warnings) > 0 {
+		fmt.Fprintf(&body, "\n\nWarnings:\n- %s", strings.Join(summary.Warnings, "\n- "))
+	}
+	return ActionResult{Title: "Health summary", Body: strings.TrimSpace(body.String())}
+}
+
+func (a *App) MainBanner() string {
+	raw, err := os.ReadFile(DefaultAuditJSONPath)
+	if err != nil {
+		return ""
+	}
+
+	var snapshot schema.HardwareIngestRequest
+	if err := json.Unmarshal(raw, &snapshot); err != nil {
+		return ""
+	}
+
+	var lines []string
+	if system := formatSystemLine(snapshot.Hardware.Board); system != "" {
+		lines = append(lines, system)
+	}
+	if cpu := formatCPULine(snapshot.Hardware.CPUs); cpu != "" {
+		lines = append(lines, cpu)
+	}
+	if memory := formatMemoryLine(snapshot.Hardware.Memory); memory != "" {
+		lines = append(lines, memory)
+	}
+	if storage := formatStorageLine(snapshot.Hardware.Storage); storage != "" {
+		lines = append(lines, storage)
+	}
+	if gpu := formatGPULine(snapshot.Hardware.PCIeDevices); gpu != "" {
+		lines = append(lines, gpu)
+	}
+	if ip := formatIPLine(a.network.ListInterfaces); ip != "" {
+		lines = append(lines, ip)
+	}
+
+	return strings.TrimSpace(strings.Join(lines, "\n"))
 }
 
 func (a *App) FormatToolStatuses(statuses []platform.ToolStatus) string {
@@ -309,3 +426,302 @@ func sanitizeFilename(v string) string {
 	}
 	return string(out)
 }
+
+func bodyOr(body, fallback string) string {
+	body = strings.TrimSpace(body)
+	if body == "" {
+		return fallback
+	}
+	return body
+}
+
+func latestSATSummaries() []string {
+	patterns := []struct {
+		label  string
+		prefix string
+	}{
+		{label: "NVIDIA SAT", prefix: "gpu-nvidia-"},
+		{label: "Memory SAT", prefix: "memory-"},
+		{label: "Storage SAT", prefix: "storage-"},
+	}
+	var out []string
+	for _, item := range patterns {
+		matches, err := filepath.Glob(filepath.Join(DefaultSATBaseDir, item.prefix+"*/summary.txt"))
+		if err != nil || len(matches) == 0 {
+			continue
+		}
+		sort.Strings(matches)
+		raw, err := os.ReadFile(matches[len(matches)-1])
+		if err != nil {
+			continue
+		}
+		out = append(out, formatSATSummary(item.label, string(raw)))
+	}
+	return out
+}
+
+func formatSATSummary(label, raw string) string {
+	values := parseKeyValueSummary(raw)
+	var body strings.Builder
+	fmt.Fprintf(&body, "%s:", label)
+	if overall := firstNonEmpty(values["overall_status"], "UNKNOWN"); overall != "" {
+		fmt.Fprintf(&body, " %s", overall)
+	}
+	if ok := firstNonEmpty(values["job_ok"], "0"); ok != "" {
+		fmt.Fprintf(&body, " ok=%s", ok)
+	}
+	if failed := firstNonEmpty(values["job_failed"], "0"); failed != "" {
+		fmt.Fprintf(&body, " failed=%s", failed)
+	}
+	if unsupported := firstNonEmpty(values["job_unsupported"], "0"); unsupported != "" && unsupported != "0" {
+		fmt.Fprintf(&body, " unsupported=%s", unsupported)
+	}
+	if devices := strings.TrimSpace(values["devices"]); devices != "" {
+		fmt.Fprintf(&body, "\nDevices: %s", devices)
+	}
+	return body.String()
+}
+
+func formatSystemLine(board schema.HardwareBoard) string {
+	model := strings.TrimSpace(strings.Join([]string{
+		trimPtr(board.Manufacturer),
+		trimPtr(board.ProductName),
+	}, " "))
+	serial := strings.TrimSpace(board.SerialNumber)
+	switch {
+	case model != "" && serial != "":
+		return fmt.Sprintf("System: %s | S/N %s", model, serial)
+	case model != "":
+		return "System: " + model
+	case serial != "":
+		return "System S/N: " + serial
+	default:
+		return ""
+	}
+}
+
+func formatCPULine(cpus []schema.HardwareCPU) string {
+	if len(cpus) == 0 {
+		return ""
+	}
+	modelCounts := map[string]int{}
+	unknown := 0
+	for _, cpu := range cpus {
+		model := trimPtr(cpu.Model)
+		if model == "" {
+			unknown++
+			continue
+		}
+		modelCounts[model]++
+	}
+	if len(modelCounts) == 1 && unknown == 0 {
+		for model, count := range modelCounts {
+			return fmt.Sprintf("CPU: %d x %s", count, model)
+		}
+	}
+	parts := make([]string, 0, len(modelCounts)+1)
+	if len(modelCounts) > 0 {
+		keys := make([]string, 0, len(modelCounts))
+		for key := range modelCounts {
+			keys = append(keys, key)
+		}
+		sort.Strings(keys)
+		for _, key := range keys {
+			parts = append(parts, fmt.Sprintf("%d x %s", modelCounts[key], key))
+		}
+	}
+	if unknown > 0 {
+		parts = append(parts, fmt.Sprintf("%d x unknown", unknown))
+	}
+	return "CPU: " + strings.Join(parts, ", ")
+}
+
+func formatMemoryLine(dimms []schema.HardwareMemory) string {
+	totalMB := 0
+	present := 0
+	types := map[string]struct{}{}
+	for _, dimm := range dimms {
+		if dimm.Present != nil && !*dimm.Present {
+			continue
+		}
+		if dimm.SizeMB == nil || *dimm.SizeMB <= 0 {
+			continue
+		}
+		present++
+		totalMB += *dimm.SizeMB
+		if value := trimPtr(dimm.Type); value != "" {
+			types[value] = struct{}{}
+		}
+	}
+	if totalMB == 0 {
+		return ""
+	}
+	typeText := joinSortedKeys(types)
+	line := fmt.Sprintf("Memory: %s", humanizeMB(totalMB))
+	if typeText != "" {
+		line += " " + typeText
+	}
+	if present > 0 {
+		line += fmt.Sprintf(" (%d DIMMs)", present)
+	}
+	return line
+}
+
+func formatStorageLine(disks []schema.HardwareStorage) string {
+	count := 0
+	totalGB := 0
+	for _, disk := range disks {
+		if disk.Present != nil && !*disk.Present {
+			continue
+		}
+		count++
+		if disk.SizeGB != nil && *disk.SizeGB > 0 {
+			totalGB += *disk.SizeGB
+		}
+	}
+	if count == 0 {
+		return ""
+	}
+	line := fmt.Sprintf("Storage: %d drives", count)
+	if totalGB > 0 {
+		line += fmt.Sprintf(" / %s", humanizeGB(totalGB))
+	}
+	return line
+}
+
+func formatGPULine(devices []schema.HardwarePCIeDevice) string {
+	gpus := map[string]int{}
+	for _, dev := range devices {
+		if !isGPUDevice(dev) {
+			continue
+		}
+		name := firstNonEmpty(trimPtr(dev.Model), trimPtr(dev.Manufacturer), "unknown")
+		gpus[name]++
+	}
+	if len(gpus) == 0 {
+		return ""
+	}
+	keys := make([]string, 0, len(gpus))
+	for key := range gpus {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	parts := make([]string, 0, len(keys))
+	for _, key := range keys {
+		parts = append(parts, fmt.Sprintf("%d x %s", gpus[key], key))
+	}
+	return "GPU: " + strings.Join(parts, ", ")
+}
+
+func formatIPLine(list func() ([]platform.InterfaceInfo, error)) string {
+	if list == nil {
+		return ""
+	}
+	ifaces, err := list()
+	if err != nil {
+		return ""
+	}
+	seen := map[string]struct{}{}
+	var ips []string
+	for _, iface := range ifaces {
+		for _, ip := range iface.IPv4 {
+			ip = strings.TrimSpace(ip)
+			if ip == "" {
+				continue
+			}
+			if _, ok := seen[ip]; ok {
+				continue
+			}
+			seen[ip] = struct{}{}
+			ips = append(ips, ip)
+		}
+	}
+	if len(ips) == 0 {
+		return ""
+	}
+	sort.Strings(ips)
+	return "IP: " + strings.Join(ips, ", ")
+}
+
+func isGPUDevice(dev schema.HardwarePCIeDevice) bool {
+	class := trimPtr(dev.DeviceClass)
+	model := strings.ToLower(trimPtr(dev.Model))
+	vendor := strings.ToLower(trimPtr(dev.Manufacturer))
+	return class == "VideoController" ||
+		class == "DisplayController" ||
+		class == "ProcessingAccelerator" ||
+		strings.Contains(model, "nvidia") ||
+		strings.Contains(vendor, "nvidia") ||
+		strings.Contains(vendor, "amd")
+}
+
+func trimPtr(value *string) string {
+	if value == nil {
+		return ""
+	}
+	return strings.TrimSpace(*value)
+}
+
+func joinSortedKeys(values map[string]struct{}) string {
+	if len(values) == 0 {
+		return ""
+	}
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return strings.Join(keys, "/")
+}
+
+func humanizeMB(totalMB int) string {
+	if totalMB <= 0 {
+		return ""
+	}
+	gb := float64(totalMB) / 1024.0
+	if gb >= 1024.0 {
+		tb := gb / 1024.0
+		return fmt.Sprintf("%.1f TB", tb)
+	}
+	if gb == float64(int64(gb)) {
+		return fmt.Sprintf("%.0f GB", gb)
+	}
+	return fmt.Sprintf("%.1f GB", gb)
+}
+
+func humanizeGB(totalGB int) string {
+	if totalGB <= 0 {
+		return ""
+	}
+	tb := float64(totalGB) / 1024.0
+	if tb >= 1.0 {
+		return fmt.Sprintf("%.1f TB", tb)
+	}
+	return fmt.Sprintf("%d GB", totalGB)
+}
+
+func parseKeyValueSummary(raw string) map[string]string {
+	out := map[string]string{}
+	for _, line := range strings.Split(raw, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		key, value, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		out[strings.TrimSpace(key)] = strings.TrimSpace(value)
+	}
+	return out
+}
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			return value
+		}
+	}
+	return ""
+}

audit/internal/app/app_test.go

@@ -1,10 +1,14 @@
 package app
 
 import (
+	"encoding/json"
 	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"bee/audit/internal/platform"
+	"bee/audit/internal/schema"
 )
 
 type fakeNetwork struct {
@@ -76,11 +80,21 @@ func (f fakeTools) CheckTools(names []string) []platform.ToolStatus {
 }
 
 type fakeSAT struct {
-	runFn func(string) (string, error)
+	runNvidiaFn  func(string) (string, error)
+	runMemoryFn  func(string) (string, error)
+	runStorageFn func(string) (string, error)
 }
 
 func (f fakeSAT) RunNvidiaAcceptancePack(baseDir string) (string, error) {
-	return f.runFn(baseDir)
+	return f.runNvidiaFn(baseDir)
+}
+
+func (f fakeSAT) RunMemoryAcceptancePack(baseDir string) (string, error) {
+	return f.runMemoryFn(baseDir)
+}
+
+func (f fakeSAT) RunStorageAcceptancePack(baseDir string) (string, error) {
+	return f.runStorageFn(baseDir)
 }
 
 func TestNetworkStatusFormatsInterfacesAndRoute(t *testing.T) {
@@ -116,6 +130,25 @@ func TestNetworkStatusFormatsInterfacesAndRoute(t *testing.T) {
 	}
 }
 
+func TestNetworkStatusHandlesNoInterfaces(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		network: fakeNetwork{
+			listInterfacesFn: func() ([]platform.InterfaceInfo, error) { return nil, nil },
+			defaultRouteFn:   func() string { return "" },
+		},
+	}
+
+	result, err := a.NetworkStatus()
+	if err != nil {
+		t.Fatalf("NetworkStatus error: %v", err)
+	}
+	if result.Body != "No physical interfaces found." {
+		t.Fatalf("body=%q want %q", result.Body, "No physical interfaces found.")
+	}
+}
+
 func TestNetworkStatusPropagatesListError(t *testing.T) {
 	t.Parallel()
 
@@ -192,7 +225,7 @@ func TestServiceActionResults(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ServiceStatusResult error: %v", err)
 	}
-	if statusResult.Title != "service: bee-audit" || statusResult.Body != "active" {
+	if statusResult.Title != "service status: bee-audit" || statusResult.Body != "active" {
 		t.Fatalf("unexpected status result: %#v", statusResult)
 	}
 
@@ -200,7 +233,7 @@ func TestServiceActionResults(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ServiceActionResult error: %v", err)
 	}
-	if actionResult.Title != "service: bee-audit" || actionResult.Body != "restart ok" {
+	if actionResult.Title != "service restart: bee-audit" || actionResult.Body != "restart ok" {
 		t.Fatalf("unexpected action result: %#v", actionResult)
 	}
 }
@@ -242,17 +275,79 @@ func TestToolCheckAndLogTailResults(t *testing.T) {
 	}
 }
 
+func TestActionResultsUseFallbackBody(t *testing.T) {
+	t.Parallel()
+
+	a := &App{
+		network: fakeNetwork{
+			dhcpOneFn:       func(string) (string, error) { return "   ", nil },
+			dhcpAllFn:       func() (string, error) { return "", nil },
+			setStaticIPv4Fn: func(platform.StaticIPv4Config) (string, error) { return "", nil },
+			listInterfacesFn: func() ([]platform.InterfaceInfo, error) {
+				return nil, nil
+			},
+			defaultRouteFn: func() string { return "" },
+		},
+		services: fakeServices{
+			serviceStatusFn: func(string) (string, error) { return "", nil },
+			serviceDoFn:     func(string, platform.ServiceAction) (string, error) { return "", nil },
+		},
+		tools: fakeTools{
+			tailFileFn:   func(string, int) string { return "   " },
+			checkToolsFn: func([]string) []platform.ToolStatus { return nil },
+		},
+		sat: fakeSAT{
+			runNvidiaFn:  func(string) (string, error) { return "", nil },
+			runMemoryFn:  func(string) (string, error) { return "", nil },
+			runStorageFn: func(string) (string, error) { return "", nil },
+		},
+	}
+
+	if got, _ := a.DHCPOneResult("eth0"); got.Body != "DHCP completed." {
+		t.Fatalf("dhcp one body=%q", got.Body)
+	}
+	if got, _ := a.DHCPAllResult(); got.Body != "DHCP completed." {
+		t.Fatalf("dhcp all body=%q", got.Body)
+	}
+	if got, _ := a.SetStaticIPv4Result(platform.StaticIPv4Config{Interface: "eth0"}); got.Body != "Static IPv4 updated." {
+		t.Fatalf("static body=%q", got.Body)
+	}
+	if got, _ := a.ServiceStatusResult("bee-audit"); got.Body != "No status output." {
+		t.Fatalf("status body=%q", got.Body)
+	}
+	if got, _ := a.ServiceActionResult("bee-audit", platform.ServiceRestart); got.Body != "Action completed." {
+		t.Fatalf("action body=%q", got.Body)
+	}
+	if got := a.ToolCheckResult(nil); got.Body != "No tools checked." {
+		t.Fatalf("tool body=%q", got.Body)
+	}
+	if got := a.AuditLogTailResult(); got.Body != "No audit logs found." {
+		t.Fatalf("log body=%q", got.Body)
+	}
+	if got, _ := a.RunNvidiaAcceptancePackResult(""); got.Body != "Archive written." {
+		t.Fatalf("sat body=%q", got.Body)
+	}
+	if got, _ := a.RunMemoryAcceptancePackResult(""); got.Body != "Archive written." {
+		t.Fatalf("memory sat body=%q", got.Body)
+	}
+	if got, _ := a.RunStorageAcceptancePackResult(""); got.Body != "Archive written." {
+		t.Fatalf("storage sat body=%q", got.Body)
+	}
+}
+
 func TestRunNvidiaAcceptancePackResult(t *testing.T) {
 	t.Parallel()
 
 	a := &App{
 		sat: fakeSAT{
-			runFn: func(baseDir string) (string, error) {
+			runNvidiaFn: func(baseDir string) (string, error) {
 				if baseDir != "/tmp/sat" {
 					t.Fatalf("baseDir=%q want %q", baseDir, "/tmp/sat")
 				}
 				return "/tmp/sat/out.tar.gz", nil
 			},
+			runMemoryFn:  func(string) (string, error) { return "", nil },
+			runStorageFn: func(string) (string, error) { return "", nil },
 		},
 	}
 
@@ -265,6 +360,120 @@ func TestRunNvidiaAcceptancePackResult(t *testing.T) {
 	}
 }
 
+func TestFormatSATSummary(t *testing.T) {
+	t.Parallel()
+
+	got := formatSATSummary("Memory SAT", "overall_status=PARTIAL\njob_ok=2\njob_failed=0\njob_unsupported=1\ndevices=3\n")
+	want := "Memory SAT: PARTIAL ok=2 failed=0 unsupported=1\nDevices: 3"
+	if got != want {
+		t.Fatalf("got %q want %q", got, want)
+	}
+}
+
+func TestHealthSummaryResultIncludesCompactSATSummary(t *testing.T) {
+	tmp := t.TempDir()
+	oldAuditPath := DefaultAuditJSONPath
+	oldSATBaseDir := DefaultSATBaseDir
+	DefaultAuditJSONPath = filepath.Join(tmp, "audit.json")
+	DefaultSATBaseDir = filepath.Join(tmp, "sat")
+	t.Cleanup(func() { DefaultAuditJSONPath = oldAuditPath })
+	t.Cleanup(func() { DefaultSATBaseDir = oldSATBaseDir })
+
+	satDir := filepath.Join(DefaultSATBaseDir, "memory-testcase")
+	if err := os.MkdirAll(satDir, 0755); err != nil {
+		t.Fatalf("mkdir sat dir: %v", err)
+	}
+
+	raw := `{"collected_at":"2026-03-15T10:00:00Z","hardware":{"board":{"serial_number":"SRV123"},"storage":[{"serial_number":"DISK1","status":"Warning"}]}}`
+	if err := os.WriteFile(DefaultAuditJSONPath, []byte(raw), 0644); err != nil {
+		t.Fatalf("write audit json: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(satDir, "summary.txt"), []byte("overall_status=OK\njob_ok=3\njob_failed=0\njob_unsupported=0\n"), 0644); err != nil {
+		t.Fatalf("write sat summary: %v", err)
+	}
+
+	result := (&App{}).HealthSummaryResult()
+	if !contains(result.Body, "Memory SAT: OK ok=3 failed=0") {
+		t.Fatalf("body missing compact sat summary:\n%s", result.Body)
+	}
+}
+
+func TestMainBanner(t *testing.T) {
+	tmp := t.TempDir()
+	oldAuditPath := DefaultAuditJSONPath
+	DefaultAuditJSONPath = filepath.Join(tmp, "audit.json")
+	t.Cleanup(func() { DefaultAuditJSONPath = oldAuditPath })
+
+	trueValue := true
+	manufacturer := "Dell"
+	product := "PowerEdge R760"
+	cpuModel := "Intel Xeon Gold 6430"
+	memoryType := "DDR5"
+	gpuClass := "VideoController"
+	gpuModel := "NVIDIA H100"
+
+	payload := schema.HardwareIngestRequest{
+		Hardware: schema.HardwareSnapshot{
+			Board: schema.HardwareBoard{
+				Manufacturer: &manufacturer,
+				ProductName:  &product,
+				SerialNumber: "SRV123",
+			},
+			CPUs: []schema.HardwareCPU{
+				{Model: &cpuModel},
+				{Model: &cpuModel},
+			},
+			Memory: []schema.HardwareMemory{
+				{Present: &trueValue, SizeMB: intPtr(524288), Type: &memoryType},
+				{Present: &trueValue, SizeMB: intPtr(524288), Type: &memoryType},
+			},
+			Storage: []schema.HardwareStorage{
+				{Present: &trueValue, SizeGB: intPtr(3840)},
+				{Present: &trueValue, SizeGB: intPtr(3840)},
+			},
+			PCIeDevices: []schema.HardwarePCIeDevice{
+				{DeviceClass: &gpuClass, Model: &gpuModel},
+				{DeviceClass: &gpuClass, Model: &gpuModel},
+			},
+		},
+	}
+
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if err := os.WriteFile(DefaultAuditJSONPath, raw, 0644); err != nil {
+		t.Fatalf("write audit json: %v", err)
+	}
+
+	a := &App{
+		network: fakeNetwork{
+			listInterfacesFn: func() ([]platform.InterfaceInfo, error) {
+				return []platform.InterfaceInfo{
+					{Name: "eth0", IPv4: []string{"10.0.0.10"}},
+					{Name: "eth1", IPv4: []string{"192.168.1.10"}},
+				}, nil
+			},
+		},
+	}
+
+	got := a.MainBanner()
+	for _, want := range []string{
+		"System: Dell PowerEdge R760 | S/N SRV123",
+		"CPU: 2 x Intel Xeon Gold 6430",
+		"Memory: 1.0 TB DDR5 (2 DIMMs)",
+		"Storage: 2 drives / 7.5 TB",
+		"GPU: 2 x NVIDIA H100",
+		"IP: 10.0.0.10, 192.168.1.10",
+	} {
+		if !contains(got, want) {
+			t.Fatalf("banner missing %q:\n%s", want, got)
+		}
+	}
+}
+
+func intPtr(v int) *int { return &v }
+
 func contains(haystack, needle string) bool {
 	return len(needle) == 0 || (len(haystack) >= len(needle) && (haystack == needle || containsAt(haystack, needle)))
 }

audit/internal/collector/board.go

@@ -8,6 +8,14 @@ import (
 	"strings"
 )
 
+var execDmidecode = func(typeNum string) (string, error) {
+	out, err := exec.Command("dmidecode", "-t", typeNum).Output()
+	if err != nil {
+		return "", err
+	}
+	return string(out), nil
+}
+
 // collectBoard runs dmidecode for types 0, 1, 2 and returns the board record
 // plus the BIOS firmware entry. Any failure is logged and returns zero values.
 func collectBoard() (schema.HardwareBoard, []schema.HardwareFirmwareRecord) {
@@ -141,9 +149,5 @@ func cleanDMIValue(v string) string {
 
 // runDmidecode executes dmidecode -t <typeNum> and returns its stdout.
 func runDmidecode(typeNum string) (string, error) {
-	out, err := exec.Command("dmidecode", "-t", typeNum).Output()
-	if err != nil {
-		return "", err
-	}
-	return string(out), nil
+	return execDmidecode(typeNum)
 }

audit/internal/collector/collector.go

@@ -7,13 +7,15 @@ import (
 	"bee/audit/internal/runtimeenv"
 	"bee/audit/internal/schema"
 	"log/slog"
+	"os"
 	"time"
 )
 
 // Run executes all collectors and returns the combined snapshot.
 // Partial failures are logged as warnings; collection always completes.
-func Run(runtimeMode runtimeenv.Mode) schema.HardwareIngestRequest {
+func Run(_ runtimeenv.Mode) schema.HardwareIngestRequest {
 	start := time.Now()
+	collectedAt := time.Now().UTC().Format(time.RFC3339)
 	slog.Info("audit started")
 
 	snap := schema.HardwareSnapshot{}
@@ -22,31 +24,41 @@ func Run(runtimeMode runtimeenv.Mode) schema.HardwareIngestRequest {
 	snap.Board = board
 	snap.Firmware = append(snap.Firmware, biosFW...)
 
-	cpus, cpuFW := collectCPUs(snap.Board.SerialNumber)
-	snap.CPUs = cpus
-	snap.Firmware = append(snap.Firmware, cpuFW...)
+	snap.CPUs = collectCPUs(snap.Board.SerialNumber)
 
 	snap.Memory = collectMemory()
+	sensorDoc, err := readSensorsJSONDoc()
+	if err != nil {
+		slog.Info("sensors: unavailable for enrichment", "err", err)
+	}
+	snap.CPUs = enrichCPUsWithTelemetry(snap.CPUs, sensorDoc)
+	snap.Memory = enrichMemoryWithTelemetry(snap.Memory, sensorDoc)
 	snap.Storage = collectStorage()
 	snap.PCIeDevices = collectPCIe()
 	snap.PCIeDevices = enrichPCIeWithNVIDIA(snap.PCIeDevices, snap.Board.SerialNumber)
 	snap.PCIeDevices = enrichPCIeWithMellanox(snap.PCIeDevices)
 	snap.PCIeDevices = enrichPCIeWithNICTelemetry(snap.PCIeDevices)
+	snap.PCIeDevices = enrichPCIeWithRAIDTelemetry(snap.PCIeDevices)
 	snap.Storage = enrichStorageWithVROC(snap.Storage, snap.PCIeDevices)
 	snap.Storage = appendUniqueStorage(snap.Storage, collectRAIDStorage(snap.PCIeDevices))
 	snap.PowerSupplies = collectPSUs()
+	snap.PowerSupplies = enrichPSUsWithTelemetry(snap.PowerSupplies, sensorDoc)
+	snap.Sensors = buildSensorsFromDoc(sensorDoc)
+	finalizeSnapshot(&snap, collectedAt)
 
 	// remaining collectors added in steps 1.8 – 1.10
 
 	slog.Info("audit completed", "duration", time.Since(start).Round(time.Millisecond))
 
-	sourceType := string(runtimeMode)
-	protocol := "os-direct"
-
+	sourceType := "manual"
+	var targetHost *string
+	if hostname, err := os.Hostname(); err == nil && hostname != "" {
+		targetHost = &hostname
+	}
 	return schema.HardwareIngestRequest{
 		SourceType:  &sourceType,
-		Protocol:    &protocol,
-		CollectedAt: time.Now().UTC().Format(time.RFC3339),
+		TargetHost:  targetHost,
+		CollectedAt: collectedAt,
 		Hardware:    snap,
 	}
 }

audit/internal/collector/contract.go

@@ -0,0 +1,64 @@
+package collector
+
+import "strings"
+
+const (
+	statusOK       = "OK"
+	statusWarning  = "Warning"
+	statusCritical = "Critical"
+	statusUnknown  = "Unknown"
+	statusEmpty    = "Empty"
+)
+
+func mapPCIeDeviceClass(raw string) string {
+	normalized := strings.ToLower(strings.TrimSpace(raw))
+	switch {
+	case normalized == "":
+		return ""
+	case strings.Contains(normalized, "ethernet controller"):
+		return "EthernetController"
+	case strings.Contains(normalized, "fibre channel"):
+		return "FibreChannelController"
+	case strings.Contains(normalized, "network controller"), strings.Contains(normalized, "infiniband controller"):
+		return "NetworkController"
+	case strings.Contains(normalized, "serial attached scsi"), strings.Contains(normalized, "storage controller"):
+		return "StorageController"
+	case strings.Contains(normalized, "raid"), strings.Contains(normalized, "mass storage"):
+		return "MassStorageController"
+	case strings.Contains(normalized, "display controller"):
+		return "DisplayController"
+	case strings.Contains(normalized, "vga"), strings.Contains(normalized, "3d controller"), strings.Contains(normalized, "video controller"):
+		return "VideoController"
+	case strings.Contains(normalized, "processing accelerators"), strings.Contains(normalized, "processing accelerator"):
+		return "ProcessingAccelerator"
+	default:
+		return raw
+	}
+}
+
+func isNICClass(class string) bool {
+	switch strings.TrimSpace(class) {
+	case "EthernetController", "NetworkController":
+		return true
+	default:
+		return false
+	}
+}
+
+func isGPUClass(class string) bool {
+	switch strings.TrimSpace(class) {
+	case "VideoController", "DisplayController", "ProcessingAccelerator":
+		return true
+	default:
+		return false
+	}
+}
+
+func isRAIDClass(class string) bool {
+	switch strings.TrimSpace(class) {
+	case "MassStorageController", "StorageController":
+		return true
+	default:
+		return false
+	}
+}

audit/internal/collector/cpu.go

@@ -6,30 +6,28 @@ import (
 	"fmt"
 	"log/slog"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 )
 
-// collectCPUs runs dmidecode -t 4 and reads microcode version from sysfs.
-func collectCPUs(boardSerial string) ([]schema.HardwareCPU, []schema.HardwareFirmwareRecord) {
+// collectCPUs runs dmidecode -t 4 and enriches CPUs with microcode from sysfs.
+func collectCPUs(boardSerial string) []schema.HardwareCPU {
 	out, err := runDmidecode("4")
 	if err != nil {
 		slog.Warn("cpu: dmidecode type 4 failed", "err", err)
-		return nil, nil
+		return nil
 	}
 
 	cpus := parseCPUs(out, boardSerial)
-
-	var firmware []schema.HardwareFirmwareRecord
 	if mc := readMicrocode(); mc != "" {
-		firmware = append(firmware, schema.HardwareFirmwareRecord{
-			DeviceName: "CPU Microcode",
-			Version:    mc,
-		})
+		for i := range cpus {
+			cpus[i].Firmware = &mc
+		}
 	}
 
 	slog.Info("cpu: collected", "count", len(cpus))
-	return cpus, firmware
+	return cpus
 }
 
 // parseCPUs splits dmidecode output into per-processor sections and parses each.
@@ -51,12 +49,14 @@ func parseCPUs(output, boardSerial string) []schema.HardwareCPU {
 // Returns false if the socket is unpopulated.
 func parseCPUSection(fields map[string]string, boardSerial string) (schema.HardwareCPU, bool) {
 	status := parseCPUStatus(fields["Status"])
-	if status == "EMPTY" {
+	if status == statusEmpty {
 		return schema.HardwareCPU{}, false
 	}
 
 	cpu := schema.HardwareCPU{}
 	cpu.Status = &status
+	present := true
+	cpu.Present = &present
 
 	if socket, ok := parseSocketIndex(fields["Socket Designation"]); ok {
 		cpu.Socket = &socket
@@ -99,15 +99,15 @@ func parseCPUStatus(raw string) string {
 	upper := strings.ToUpper(raw)
 	switch {
 	case upper == "" || upper == "UNKNOWN":
-		return "UNKNOWN"
+		return statusUnknown
 	case strings.Contains(upper, "UNPOPULATED") || strings.Contains(upper, "NOT POPULATED"):
-		return "EMPTY"
+		return statusEmpty
 	case strings.Contains(upper, "ENABLED"):
-		return "OK"
+		return statusOK
 	case strings.Contains(upper, "DISABLED"):
-		return "WARNING"
+		return statusWarning
 	default:
-		return "UNKNOWN"
+		return statusUnknown
 	}
 }
 
@@ -178,7 +178,7 @@ func parseInt(v string) int {
 // readMicrocode reads the CPU microcode revision from sysfs.
 // Returns empty string if unavailable.
 func readMicrocode() string {
-	data, err := os.ReadFile("/sys/devices/system/cpu/cpu0/microcode/version")
+	data, err := os.ReadFile(filepath.Join(cpuSysBaseDir, "cpu0", "microcode", "version"))
 	if err != nil {
 		return ""
 	}

audit/internal/collector/cpu_telemetry.go

@@ -0,0 +1,196 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+var (
+	cpuSysBaseDir = "/sys/devices/system/cpu"
+	socketIndexRe = regexp.MustCompile(`(?i)(?:package id|socket|cpu)\s*([0-9]+)`)
+)
+
+func enrichCPUsWithTelemetry(cpus []schema.HardwareCPU, doc sensorsDoc) []schema.HardwareCPU {
+	if len(cpus) == 0 {
+		return cpus
+	}
+
+	tempBySocket := cpuTempsFromSensors(doc, len(cpus))
+	powerBySocket := cpuPowerFromSensors(doc, len(cpus))
+	throttleBySocket := cpuThrottleBySocket()
+
+	for i := range cpus {
+		socket := 0
+		if cpus[i].Socket != nil {
+			socket = *cpus[i].Socket
+		}
+		if value, ok := tempBySocket[socket]; ok {
+			cpus[i].TemperatureC = &value
+		}
+		if value, ok := powerBySocket[socket]; ok {
+			cpus[i].PowerW = &value
+		}
+		if value, ok := throttleBySocket[socket]; ok {
+			cpus[i].Throttled = &value
+		}
+	}
+
+	return cpus
+}
+
+func cpuTempsFromSensors(doc sensorsDoc, cpuCount int) map[int]float64 {
+	out := map[int]float64{}
+	if len(doc) == 0 {
+		return out
+	}
+	var fallback []float64
+	for chip, features := range doc {
+		for featureName, raw := range features {
+			feature, ok := raw.(map[string]any)
+			if !ok {
+				continue
+			}
+			if classifySensorFeature(feature) != "temp" {
+				continue
+			}
+			temp, ok := firstFeatureFloat(feature, "_input")
+			if !ok {
+				continue
+			}
+			if socket, ok := detectCPUSocket(chip, featureName); ok {
+				if _, exists := out[socket]; !exists {
+					out[socket] = temp
+				}
+				continue
+			}
+			if isLikelyCPUTemp(chip, featureName) {
+				fallback = append(fallback, temp)
+			}
+		}
+	}
+	if len(out) == 0 && cpuCount == 1 && len(fallback) > 0 {
+		out[0] = fallback[0]
+	}
+	return out
+}
+
+func cpuPowerFromSensors(doc sensorsDoc, cpuCount int) map[int]float64 {
+	out := map[int]float64{}
+	if len(doc) == 0 {
+		return out
+	}
+	var fallback []float64
+	for chip, features := range doc {
+		for featureName, raw := range features {
+			feature, ok := raw.(map[string]any)
+			if !ok {
+				continue
+			}
+			if classifySensorFeature(feature) != "power" {
+				continue
+			}
+			power, ok := firstFeatureFloatWithContains(feature, []string{"power"})
+			if !ok {
+				continue
+			}
+			if socket, ok := detectCPUSocket(chip, featureName); ok {
+				if _, exists := out[socket]; !exists {
+					out[socket] = power
+				}
+				continue
+			}
+			if isLikelyCPUPower(chip, featureName) {
+				fallback = append(fallback, power)
+			}
+		}
+	}
+	if len(out) == 0 && cpuCount == 1 && len(fallback) > 0 {
+		out[0] = fallback[0]
+	}
+	return out
+}
+
+func detectCPUSocket(parts ...string) (int, bool) {
+	for _, part := range parts {
+		matches := socketIndexRe.FindStringSubmatch(strings.ToLower(part))
+		if len(matches) == 2 {
+			value, err := strconv.Atoi(matches[1])
+			if err == nil {
+				return value, true
+			}
+		}
+	}
+	return 0, false
+}
+
+func isLikelyCPUTemp(chip, feature string) bool {
+	value := strings.ToLower(chip + " " + feature)
+	return strings.Contains(value, "coretemp") ||
+		strings.Contains(value, "k10temp") ||
+		strings.Contains(value, "package id") ||
+		strings.Contains(value, "tdie") ||
+		strings.Contains(value, "tctl") ||
+		strings.Contains(value, "cpu temp")
+}
+
+func isLikelyCPUPower(chip, feature string) bool {
+	value := strings.ToLower(chip + " " + feature)
+	return strings.Contains(value, "intel-rapl") ||
+		strings.Contains(value, "package id") ||
+		strings.Contains(value, "package-") ||
+		strings.Contains(value, "cpu power")
+}
+
+func cpuThrottleBySocket() map[int]bool {
+	out := map[int]bool{}
+	cpuDirs, err := filepath.Glob(filepath.Join(cpuSysBaseDir, "cpu[0-9]*"))
+	if err != nil {
+		return out
+	}
+	sort.Strings(cpuDirs)
+	for _, cpuDir := range cpuDirs {
+		socket, ok := readSocketIndex(cpuDir)
+		if !ok {
+			continue
+		}
+		if cpuPackageThrottled(cpuDir) {
+			out[socket] = true
+		}
+	}
+	return out
+}
+
+func readSocketIndex(cpuDir string) (int, bool) {
+	raw, err := os.ReadFile(filepath.Join(cpuDir, "topology", "physical_package_id"))
+	if err != nil {
+		return 0, false
+	}
+	value, err := strconv.Atoi(strings.TrimSpace(string(raw)))
+	if err != nil || value < 0 {
+		return 0, false
+	}
+	return value, true
+}
+
+func cpuPackageThrottled(cpuDir string) bool {
+	paths := []string{
+		filepath.Join(cpuDir, "thermal_throttle", "package_throttle_count"),
+		filepath.Join(cpuDir, "thermal_throttle", "core_throttle_count"),
+	}
+	for _, path := range paths {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		value, err := strconv.ParseInt(strings.TrimSpace(string(raw)), 10, 64)
+		if err == nil && value > 0 {
+			return true
+		}
+	}
+	return false
+}

audit/internal/collector/cpu_telemetry_test.go

@@ -0,0 +1,71 @@
+package collector
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"bee/audit/internal/schema"
+)
+
+func TestEnrichCPUsWithTelemetry(t *testing.T) {
+	tmp := t.TempDir()
+	oldBase := cpuSysBaseDir
+	cpuSysBaseDir = tmp
+	t.Cleanup(func() { cpuSysBaseDir = oldBase })
+
+	mustWriteFile(t, filepath.Join(tmp, "cpu0", "topology", "physical_package_id"), "0\n")
+	mustWriteFile(t, filepath.Join(tmp, "cpu0", "thermal_throttle", "package_throttle_count"), "3\n")
+	mustWriteFile(t, filepath.Join(tmp, "cpu1", "topology", "physical_package_id"), "1\n")
+	mustWriteFile(t, filepath.Join(tmp, "cpu1", "thermal_throttle", "package_throttle_count"), "0\n")
+
+	doc := sensorsDoc{
+		"coretemp-isa-0000": {
+			"Package id 0": map[string]any{"temp1_input": 61.5},
+			"Package id 1": map[string]any{"temp2_input": 58.0},
+		},
+		"intel-rapl-mmio-0": {
+			"Package id 0": map[string]any{"power1_average": 180.0},
+			"Package id 1": map[string]any{"power2_average": 175.0},
+		},
+	}
+
+	socket0 := 0
+	socket1 := 1
+	status := statusOK
+	cpus := []schema.HardwareCPU{
+		{Socket: &socket0, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		{Socket: &socket1, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+	}
+
+	got := enrichCPUsWithTelemetry(cpus, doc)
+
+	if got[0].TemperatureC == nil || *got[0].TemperatureC != 61.5 {
+		t.Fatalf("cpu0 temperature mismatch: %#v", got[0].TemperatureC)
+	}
+	if got[0].PowerW == nil || *got[0].PowerW != 180.0 {
+		t.Fatalf("cpu0 power mismatch: %#v", got[0].PowerW)
+	}
+	if got[0].Throttled == nil || !*got[0].Throttled {
+		t.Fatalf("cpu0 throttled mismatch: %#v", got[0].Throttled)
+	}
+	if got[1].TemperatureC == nil || *got[1].TemperatureC != 58.0 {
+		t.Fatalf("cpu1 temperature mismatch: %#v", got[1].TemperatureC)
+	}
+	if got[1].PowerW == nil || *got[1].PowerW != 175.0 {
+		t.Fatalf("cpu1 power mismatch: %#v", got[1].PowerW)
+	}
+	if got[1].Throttled != nil && *got[1].Throttled {
+		t.Fatalf("cpu1 throttled mismatch: %#v", got[1].Throttled)
+	}
+}
+
+func mustWriteFile(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		t.Fatalf("mkdir %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+}

audit/internal/collector/cpu_test.go

@@ -1,6 +1,8 @@
 package collector
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 )
 
@@ -63,18 +65,51 @@ func TestParseCPUs_unpopulated_skipped(t *testing.T) {
 	}
 }
 
+func TestCollectCPUsSetsFirmwareFromMicrocode(t *testing.T) {
+	tmp := t.TempDir()
+	origBase := cpuSysBaseDir
+	cpuSysBaseDir = tmp
+	t.Cleanup(func() { cpuSysBaseDir = origBase })
+
+	if err := os.MkdirAll(filepath.Join(tmp, "cpu0", "microcode"), 0755); err != nil {
+		t.Fatalf("mkdir microcode dir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(tmp, "cpu0", "microcode", "version"), []byte("0x2b000643\n"), 0644); err != nil {
+		t.Fatalf("write microcode version: %v", err)
+	}
+
+	origRun := execDmidecode
+	execDmidecode = func(typeNum string) (string, error) {
+		if typeNum != "4" {
+			t.Fatalf("unexpected dmidecode type: %s", typeNum)
+		}
+		return mustReadFile(t, "testdata/dmidecode_type4.txt"), nil
+	}
+	t.Cleanup(func() { execDmidecode = origRun })
+
+	cpus := collectCPUs("CAR315KA0803B90")
+	if len(cpus) != 2 {
+		t.Fatalf("expected 2 CPUs, got %d", len(cpus))
+	}
+	for i, cpu := range cpus {
+		if cpu.Firmware == nil || *cpu.Firmware != "0x2b000643" {
+			t.Fatalf("cpu[%d] firmware=%v want microcode", i, cpu.Firmware)
+		}
+	}
+}
+
 func TestParseCPUStatus(t *testing.T) {
 	tests := []struct {
 		input string
 		want  string
 	}{
 		{"Populated, Enabled", "OK"},
-		{"Populated, Disabled By User", "WARNING"},
-		{"Populated, Disabled By BIOS", "WARNING"},
-		{"Unpopulated", "EMPTY"},
-		{"Not Populated", "EMPTY"},
-		{"Unknown", "UNKNOWN"},
-		{"", "UNKNOWN"},
+		{"Populated, Disabled By User", statusWarning},
+		{"Populated, Disabled By BIOS", statusWarning},
+		{"Unpopulated", statusEmpty},
+		{"Not Populated", statusEmpty},
+		{"Unknown", statusUnknown},
+		{"", statusUnknown},
 	}
 	for _, tt := range tests {
 		got := parseCPUStatus(tt.input)

audit/internal/collector/finalize.go

@@ -0,0 +1,179 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"fmt"
+)
+
+func finalizeSnapshot(snap *schema.HardwareSnapshot, collectedAt string) {
+	snap.Memory = filterMemory(snap.Memory)
+	snap.Storage = filterStorage(snap.Storage)
+	snap.PowerSupplies = filterPSUs(snap.PowerSupplies)
+
+	setComponentStatusMetadata(snap, collectedAt)
+	deduplicateComponentSerials(snap)
+}
+
+func filterMemory(dimms []schema.HardwareMemory) []schema.HardwareMemory {
+	out := make([]schema.HardwareMemory, 0, len(dimms))
+	for _, dimm := range dimms {
+		if dimm.Present != nil && !*dimm.Present {
+			continue
+		}
+		if dimm.Status != nil && *dimm.Status == statusEmpty {
+			continue
+		}
+		if dimm.SerialNumber == nil || *dimm.SerialNumber == "" {
+			continue
+		}
+		out = append(out, dimm)
+	}
+	return out
+}
+
+func filterStorage(disks []schema.HardwareStorage) []schema.HardwareStorage {
+	out := make([]schema.HardwareStorage, 0, len(disks))
+	for _, disk := range disks {
+		if disk.SerialNumber == nil || *disk.SerialNumber == "" {
+			continue
+		}
+		out = append(out, disk)
+	}
+	return out
+}
+
+func filterPSUs(psus []schema.HardwarePowerSupply) []schema.HardwarePowerSupply {
+	out := make([]schema.HardwarePowerSupply, 0, len(psus))
+	for _, psu := range psus {
+		if psu.SerialNumber == nil || *psu.SerialNumber == "" {
+			continue
+		}
+		out = append(out, psu)
+	}
+	return out
+}
+
+func setComponentStatusMetadata(snap *schema.HardwareSnapshot, collectedAt string) {
+	for i := range snap.CPUs {
+		setStatusCheckedAt(&snap.CPUs[i].HardwareComponentStatus, collectedAt)
+	}
+	for i := range snap.Memory {
+		setStatusCheckedAt(&snap.Memory[i].HardwareComponentStatus, collectedAt)
+	}
+	for i := range snap.Storage {
+		setStatusCheckedAt(&snap.Storage[i].HardwareComponentStatus, collectedAt)
+	}
+	for i := range snap.PCIeDevices {
+		setStatusCheckedAt(&snap.PCIeDevices[i].HardwareComponentStatus, collectedAt)
+	}
+	for i := range snap.PowerSupplies {
+		setStatusCheckedAt(&snap.PowerSupplies[i].HardwareComponentStatus, collectedAt)
+	}
+}
+
+func setStatusCheckedAt(status *schema.HardwareComponentStatus, collectedAt string) {
+	if status == nil || status.Status == nil || *status.Status == "" {
+		return
+	}
+	if status.StatusCheckedAt == nil {
+		status.StatusCheckedAt = &collectedAt
+	}
+}
+
+func deduplicateComponentSerials(snap *schema.HardwareSnapshot) {
+	deduplicateCPUSerials(snap.CPUs)
+	deduplicateMemorySerials(snap.Memory)
+	deduplicateStorageSerials(snap.Storage)
+	deduplicatePCIeSerials(snap.PCIeDevices)
+	deduplicatePSUSerials(snap.PowerSupplies)
+}
+
+func deduplicateCPUSerials(items []schema.HardwareCPU) {
+	seen := map[string]int{}
+	seq := 1
+	for i := range items {
+		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
+			continue
+		}
+		model := derefString(items[i].Model)
+		key := model + "\x00" + *items[i].SerialNumber
+		seen[key]++
+		if seen[key] > 1 {
+			repl := fmt.Sprintf("NO_SN-%08d", seq)
+			seq++
+			items[i].SerialNumber = &repl
+		}
+	}
+}
+
+func deduplicateMemorySerials(items []schema.HardwareMemory) {
+	seen := map[string]int{}
+	seq := 1
+	for i := range items {
+		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
+			continue
+		}
+		model := derefString(items[i].PartNumber)
+		key := model + "\x00" + *items[i].SerialNumber
+		seen[key]++
+		if seen[key] > 1 {
+			repl := fmt.Sprintf("NO_SN-%08d", seq)
+			seq++
+			items[i].SerialNumber = &repl
+		}
+	}
+}
+
+func deduplicateStorageSerials(items []schema.HardwareStorage) {
+	seen := map[string]int{}
+	seq := 1
+	for i := range items {
+		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
+			continue
+		}
+		model := derefString(items[i].Model)
+		key := model + "\x00" + *items[i].SerialNumber
+		seen[key]++
+		if seen[key] > 1 {
+			repl := fmt.Sprintf("NO_SN-%08d", seq)
+			seq++
+			items[i].SerialNumber = &repl
+		}
+	}
+}
+
+func deduplicatePCIeSerials(items []schema.HardwarePCIeDevice) {
+	seen := map[string]int{}
+	seq := 1
+	for i := range items {
+		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
+			continue
+		}
+		model := derefString(items[i].Model)
+		key := model + "\x00" + *items[i].SerialNumber
+		seen[key]++
+		if seen[key] > 1 {
+			repl := fmt.Sprintf("NO_SN-%08d", seq)
+			seq++
+			items[i].SerialNumber = &repl
+		}
+	}
+}
+
+func deduplicatePSUSerials(items []schema.HardwarePowerSupply) {
+	seen := map[string]int{}
+	seq := 1
+	for i := range items {
+		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
+			continue
+		}
+		model := derefString(items[i].Model)
+		key := model + "\x00" + *items[i].SerialNumber
+		seen[key]++
+		if seen[key] > 1 {
+			repl := fmt.Sprintf("NO_SN-%08d", seq)
+			seq++
+			items[i].SerialNumber = &repl
+		}
+	}
+}

audit/internal/collector/finalize_test.go

@@ -0,0 +1,63 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"testing"
+)
+
+func TestFinalizeSnapshotFiltersComponentsWithoutRequiredSerials(t *testing.T) {
+	collectedAt := "2026-03-15T12:00:00Z"
+	present := true
+	status := statusOK
+	serial := "SN-1"
+
+	snap := schema.HardwareSnapshot{
+		Memory: []schema.HardwareMemory{
+			{Present: &present, SerialNumber: &serial, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+			{Present: &present, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		},
+		Storage: []schema.HardwareStorage{
+			{SerialNumber: &serial, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+			{HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		},
+		PowerSupplies: []schema.HardwarePowerSupply{
+			{SerialNumber: &serial, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+			{HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		},
+	}
+
+	finalizeSnapshot(&snap, collectedAt)
+
+	if len(snap.Memory) != 1 || snap.Memory[0].StatusCheckedAt == nil || *snap.Memory[0].StatusCheckedAt != collectedAt {
+		t.Fatalf("memory finalize mismatch: %+v", snap.Memory)
+	}
+	if len(snap.Storage) != 1 || snap.Storage[0].StatusCheckedAt == nil || *snap.Storage[0].StatusCheckedAt != collectedAt {
+		t.Fatalf("storage finalize mismatch: %+v", snap.Storage)
+	}
+	if len(snap.PowerSupplies) != 1 || snap.PowerSupplies[0].StatusCheckedAt == nil || *snap.PowerSupplies[0].StatusCheckedAt != collectedAt {
+		t.Fatalf("psu finalize mismatch: %+v", snap.PowerSupplies)
+	}
+}
+
+func TestFinalizeSnapshotDeduplicatesSerials(t *testing.T) {
+	collectedAt := "2026-03-15T12:00:00Z"
+	status := statusOK
+	model := "Device"
+	serial := "DUPLICATE"
+
+	snap := schema.HardwareSnapshot{
+		Storage: []schema.HardwareStorage{
+			{Model: &model, SerialNumber: &serial, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+			{Model: &model, SerialNumber: &serial, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		},
+	}
+
+	finalizeSnapshot(&snap, collectedAt)
+
+	if got := *snap.Storage[0].SerialNumber; got != serial {
+		t.Fatalf("first serial changed: %q", got)
+	}
+	if got := *snap.Storage[1].SerialNumber; got != "NO_SN-00000001" {
+		t.Fatalf("duplicate serial mismatch: %q", got)
+	}
+}

audit/internal/collector/memory.go

@@ -47,12 +47,12 @@ func parseMemorySection(fields map[string]string) schema.HardwareMemory {
 	dimm.Present = &present
 
 	if !present {
-		status := "EMPTY"
+		status := statusEmpty
 		dimm.Status = &status
 		return dimm
 	}
 
-	status := "OK"
+	status := statusOK
 	dimm.Status = &status
 
 	if mb := parseMemorySizeMB(rawSize); mb > 0 {

audit/internal/collector/memory_telemetry.go

@@ -0,0 +1,203 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+var edacBaseDir = "/sys/devices/system/edac/mc"
+
+type edacDIMMStats struct {
+	Label   string
+	CECount *int64
+	UECount *int64
+}
+
+func enrichMemoryWithTelemetry(dimms []schema.HardwareMemory, doc sensorsDoc) []schema.HardwareMemory {
+	if len(dimms) == 0 {
+		return dimms
+	}
+
+	tempByLabel := memoryTempsFromSensors(doc)
+	stats := readEDACStats()
+
+	for i := range dimms {
+		labelKeys := dimmMatchKeys(dimms[i].Slot, dimms[i].Location)
+
+		for _, key := range labelKeys {
+			if temp, ok := tempByLabel[key]; ok {
+				dimms[i].TemperatureC = &temp
+				break
+			}
+		}
+
+		for _, key := range labelKeys {
+			if stat, ok := stats[key]; ok {
+				if stat.CECount != nil {
+					dimms[i].CorrectableECCErrorCount = stat.CECount
+				}
+				if stat.UECount != nil {
+					dimms[i].UncorrectableECCErrorCount = stat.UECount
+				}
+				if stat.UECount != nil && *stat.UECount > 0 {
+					dimms[i].DataLossDetected = boolPtr(true)
+					status := statusCritical
+					dimms[i].Status = &status
+					if dimms[i].ErrorDescription == nil {
+						dimms[i].ErrorDescription = stringPtr("EDAC reports uncorrectable ECC errors")
+					}
+				} else if stat.CECount != nil && *stat.CECount > 0 && (dimms[i].Status == nil || *dimms[i].Status == statusOK) {
+					status := statusWarning
+					dimms[i].Status = &status
+					if dimms[i].ErrorDescription == nil {
+						dimms[i].ErrorDescription = stringPtr("EDAC reports correctable ECC errors")
+					}
+				}
+				break
+			}
+		}
+	}
+
+	return dimms
+}
+
+func memoryTempsFromSensors(doc sensorsDoc) map[string]float64 {
+	out := map[string]float64{}
+	if len(doc) == 0 {
+		return out
+	}
+	for chip, features := range doc {
+		for featureName, raw := range features {
+			feature, ok := raw.(map[string]any)
+			if !ok || classifySensorFeature(feature) != "temp" {
+				continue
+			}
+			if !isLikelyMemoryTemp(chip, featureName) {
+				continue
+			}
+			temp, ok := firstFeatureFloat(feature, "_input")
+			if !ok {
+				continue
+			}
+			key := canonicalLabel(featureName)
+			if key == "" {
+				continue
+			}
+			if _, exists := out[key]; !exists {
+				out[key] = temp
+			}
+		}
+	}
+	return out
+}
+
+func readEDACStats() map[string]edacDIMMStats {
+	out := map[string]edacDIMMStats{}
+	mcDirs, err := filepath.Glob(filepath.Join(edacBaseDir, "mc*"))
+	if err != nil {
+		return out
+	}
+	sort.Strings(mcDirs)
+	for _, mcDir := range mcDirs {
+		dimmDirs, err := filepath.Glob(filepath.Join(mcDir, "dimm*"))
+		if err != nil {
+			continue
+		}
+		sort.Strings(dimmDirs)
+		for _, dimmDir := range dimmDirs {
+			stat, ok := readEDACDIMMStats(dimmDir)
+			if !ok {
+				continue
+			}
+			key := canonicalLabel(stat.Label)
+			if key == "" {
+				continue
+			}
+			out[key] = stat
+		}
+	}
+	return out
+}
+
+func readEDACDIMMStats(dimmDir string) (edacDIMMStats, bool) {
+	labelBytes, err := os.ReadFile(filepath.Join(dimmDir, "dimm_label"))
+	if err != nil {
+		labelBytes, err = os.ReadFile(filepath.Join(dimmDir, "label"))
+		if err != nil {
+			return edacDIMMStats{}, false
+		}
+	}
+	label := strings.TrimSpace(string(labelBytes))
+	if label == "" {
+		return edacDIMMStats{}, false
+	}
+
+	stat := edacDIMMStats{Label: label}
+	if value, ok := readEDACCount(dimmDir, []string{"dimm_ce_count", "ce_count"}); ok {
+		stat.CECount = &value
+	}
+	if value, ok := readEDACCount(dimmDir, []string{"dimm_ue_count", "ue_count"}); ok {
+		stat.UECount = &value
+	}
+	return stat, true
+}
+
+func readEDACCount(dir string, names []string) (int64, bool) {
+	for _, name := range names {
+		raw, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil {
+			continue
+		}
+		value, err := strconv.ParseInt(strings.TrimSpace(string(raw)), 10, 64)
+		if err == nil && value >= 0 {
+			return value, true
+		}
+	}
+	return 0, false
+}
+
+func dimmMatchKeys(slot, location *string) []string {
+	var out []string
+	add := func(value *string) {
+		key := canonicalLabel(derefString(value))
+		if key == "" {
+			return
+		}
+		for _, existing := range out {
+			if existing == key {
+				return
+			}
+		}
+		out = append(out, key)
+	}
+	add(slot)
+	add(location)
+	return out
+}
+
+func canonicalLabel(value string) string {
+	value = strings.ToUpper(strings.TrimSpace(value))
+	if value == "" {
+		return ""
+	}
+	var b strings.Builder
+	for _, r := range value {
+		if (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') {
+			b.WriteRune(r)
+		}
+	}
+	return b.String()
+}
+
+func isLikelyMemoryTemp(chip, feature string) bool {
+	value := strings.ToLower(chip + " " + feature)
+	return strings.Contains(value, "dimm") || strings.Contains(value, "sodimm")
+}
+
+func boolPtr(value bool) *bool {
+	return &value
+}

audit/internal/collector/memory_telemetry_test.go

@@ -0,0 +1,61 @@
+package collector
+
+import (
+	"path/filepath"
+	"testing"
+
+	"bee/audit/internal/schema"
+)
+
+func TestEnrichMemoryWithTelemetry(t *testing.T) {
+	tmp := t.TempDir()
+	oldBase := edacBaseDir
+	edacBaseDir = tmp
+	t.Cleanup(func() { edacBaseDir = oldBase })
+
+	mustWriteFile(t, filepath.Join(tmp, "mc0", "dimm0", "dimm_label"), "CPU0_DIMM_A1\n")
+	mustWriteFile(t, filepath.Join(tmp, "mc0", "dimm0", "dimm_ce_count"), "7\n")
+	mustWriteFile(t, filepath.Join(tmp, "mc0", "dimm0", "dimm_ue_count"), "0\n")
+	mustWriteFile(t, filepath.Join(tmp, "mc0", "dimm1", "dimm_label"), "CPU1_DIMM_B2\n")
+	mustWriteFile(t, filepath.Join(tmp, "mc0", "dimm1", "dimm_ce_count"), "0\n")
+	mustWriteFile(t, filepath.Join(tmp, "mc0", "dimm1", "dimm_ue_count"), "2\n")
+
+	doc := sensorsDoc{
+		"jc42-i2c-0-18": {
+			"CPU0 DIMM A1": map[string]any{"temp1_input": 43.0},
+			"CPU1 DIMM B2": map[string]any{"temp2_input": 46.0},
+		},
+	}
+
+	status := statusOK
+	slotA := "CPU0_DIMM_A1"
+	slotB := "CPU1_DIMM_B2"
+	dimms := []schema.HardwareMemory{
+		{Slot: &slotA, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		{Slot: &slotB, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+	}
+
+	got := enrichMemoryWithTelemetry(dimms, doc)
+
+	if got[0].TemperatureC == nil || *got[0].TemperatureC != 43.0 {
+		t.Fatalf("dimm0 temperature mismatch: %#v", got[0].TemperatureC)
+	}
+	if got[0].CorrectableECCErrorCount == nil || *got[0].CorrectableECCErrorCount != 7 {
+		t.Fatalf("dimm0 ce mismatch: %#v", got[0].CorrectableECCErrorCount)
+	}
+	if got[0].Status == nil || *got[0].Status != statusWarning {
+		t.Fatalf("dimm0 status mismatch: %#v", got[0].Status)
+	}
+	if got[1].TemperatureC == nil || *got[1].TemperatureC != 46.0 {
+		t.Fatalf("dimm1 temperature mismatch: %#v", got[1].TemperatureC)
+	}
+	if got[1].UncorrectableECCErrorCount == nil || *got[1].UncorrectableECCErrorCount != 2 {
+		t.Fatalf("dimm1 ue mismatch: %#v", got[1].UncorrectableECCErrorCount)
+	}
+	if got[1].Status == nil || *got[1].Status != statusCritical {
+		t.Fatalf("dimm1 status mismatch: %#v", got[1].Status)
+	}
+	if got[1].DataLossDetected == nil || !*got[1].DataLossDetected {
+		t.Fatalf("dimm1 data_loss_detected mismatch: %#v", got[1].DataLossDetected)
+	}
+}

audit/internal/collector/nic_telemetry.go

@@ -18,17 +18,13 @@ var (
 		}
 		return string(out), nil
 	}
-	readNetStatFile = func(iface, key string) (int64, error) {
-		path := filepath.Join("/sys/class/net", iface, "statistics", key)
+	readNetAddressFile = func(iface string) (string, error) {
+		path := filepath.Join("/sys/class/net", iface, "address")
 		raw, err := os.ReadFile(path)
 		if err != nil {
-			return 0, err
+			return "", err
 		}
-		v, err := strconv.ParseInt(strings.TrimSpace(string(raw)), 10, 64)
-		if err != nil {
-			return 0, err
-		}
-		return v, nil
+		return strings.TrimSpace(string(raw)), nil
 	}
 )
 
@@ -47,6 +43,7 @@ func enrichPCIeWithNICTelemetry(devs []schema.HardwarePCIeDevice) []schema.Hardw
 			continue
 		}
 		iface := ifaces[0]
+		devs[i].MacAddresses = collectInterfaceMACs(ifaces)
 
 		if devs[i].Firmware == nil {
 			if out, err := ethtoolInfoQuery(iface); err == nil {
@@ -56,16 +53,13 @@ func enrichPCIeWithNICTelemetry(devs []schema.HardwarePCIeDevice) []schema.Hardw
 			}
 		}
 
-		if devs[i].Telemetry == nil {
-			devs[i].Telemetry = map[string]any{}
-		}
-		injectNICPacketStats(devs[i].Telemetry, iface)
 		if out, err := ethtoolModuleQuery(iface); err == nil {
-			injectSFPDOMTelemetry(devs[i].Telemetry, out)
+			if injectSFPDOMTelemetry(&devs[i], out) {
+				enriched++
+				continue
+			}
 		}
-		if len(devs[i].Telemetry) == 0 {
-			devs[i].Telemetry = nil
-		} else {
+		if len(devs[i].MacAddresses) > 0 || devs[i].Firmware != nil {
 			enriched++
 		}
 	}
@@ -77,31 +71,32 @@ func isNICDevice(dev schema.HardwarePCIeDevice) bool {
 	if dev.DeviceClass == nil {
 		return false
 	}
-	c := strings.ToLower(strings.TrimSpace(*dev.DeviceClass))
-	return strings.Contains(c, "ethernet controller") ||
-		strings.Contains(c, "network controller") ||
-		strings.Contains(c, "infiniband controller")
+	c := strings.TrimSpace(*dev.DeviceClass)
+	return isNICClass(c) || strings.EqualFold(c, "FibreChannelController")
 }
 
-func injectNICPacketStats(dst map[string]any, iface string) {
-	for _, key := range []string{"rx_packets", "tx_packets", "rx_errors", "tx_errors"} {
-		if v, err := readNetStatFile(iface, key); err == nil {
-			dst[key] = v
+func collectInterfaceMACs(ifaces []string) []string {
+	seen := map[string]struct{}{}
+	var out []string
+	for _, iface := range ifaces {
+		mac, err := readNetAddressFile(iface)
+		if err != nil || mac == "" {
+			continue
 		}
+		mac = strings.ToLower(strings.TrimSpace(mac))
+		if _, ok := seen[mac]; ok {
+			continue
+		}
+		seen[mac] = struct{}{}
+		out = append(out, mac)
 	}
-}
-
-func injectSFPDOMTelemetry(dst map[string]any, raw string) {
-	parsed := parseSFPDOM(raw)
-	for k, v := range parsed {
-		dst[k] = v
-	}
+	return out
 }
 
 var floatRe = regexp.MustCompile(`[-+]?[0-9]*\.?[0-9]+`)
 
-func parseSFPDOM(raw string) map[string]any {
-	out := map[string]any{}
+func injectSFPDOMTelemetry(dev *schema.HardwarePCIeDevice, raw string) bool {
+	var changed bool
 	for _, line := range strings.Split(raw, "\n") {
 		trimmed := strings.TrimSpace(line)
 		if trimmed == "" {
@@ -117,26 +112,55 @@ func parseSFPDOM(raw string) map[string]any {
 		switch {
 		case strings.Contains(key, "module temperature"):
 			if f, ok := firstFloat(val); ok {
-				out["sfp_temperature_c"] = f
+				dev.SFPTemperatureC = &f
+				changed = true
 			}
 		case strings.Contains(key, "laser output power"):
 			if f, ok := dbmValue(val); ok {
-				out["sfp_tx_power_dbm"] = f
+				dev.SFPTXPowerDBM = &f
+				changed = true
 			}
 		case strings.Contains(key, "receiver signal"):
 			if f, ok := dbmValue(val); ok {
-				out["sfp_rx_power_dbm"] = f
+				dev.SFPRXPowerDBM = &f
+				changed = true
 			}
 		case strings.Contains(key, "module voltage"):
 			if f, ok := firstFloat(val); ok {
-				out["sfp_voltage_v"] = f
+				dev.SFPVoltageV = &f
+				changed = true
 			}
 		case strings.Contains(key, "laser bias current"):
 			if f, ok := firstFloat(val); ok {
-				out["sfp_bias_ma"] = f
+				dev.SFPBiasMA = &f
+				changed = true
 			}
 		}
 	}
+	return changed
+}
+
+func parseSFPDOM(raw string) map[string]any {
+	dev := schema.HardwarePCIeDevice{}
+	if !injectSFPDOMTelemetry(&dev, raw) {
+		return map[string]any{}
+	}
+	out := map[string]any{}
+	if dev.SFPTemperatureC != nil {
+		out["sfp_temperature_c"] = *dev.SFPTemperatureC
+	}
+	if dev.SFPTXPowerDBM != nil {
+		out["sfp_tx_power_dbm"] = *dev.SFPTXPowerDBM
+	}
+	if dev.SFPRXPowerDBM != nil {
+		out["sfp_rx_power_dbm"] = *dev.SFPRXPowerDBM
+	}
+	if dev.SFPVoltageV != nil {
+		out["sfp_voltage_v"] = *dev.SFPVoltageV
+	}
+	if dev.SFPBiasMA != nil {
+		out["sfp_bias_ma"] = *dev.SFPBiasMA
+	}
 	return out
 }
 

audit/internal/collector/nvidia.go

@@ -24,7 +24,7 @@ type nvidiaGPUInfo struct {
 }
 
 // enrichPCIeWithNVIDIA enriches NVIDIA PCIe devices with data from nvidia-smi.
-// If the driver/tool is unavailable, NVIDIA devices get UNKNOWN status and
+// If the driver/tool is unavailable, NVIDIA devices get Unknown status and
 // a stable serial fallback based on board serial + slot.
 func enrichPCIeWithNVIDIA(devs []schema.HardwarePCIeDevice, boardSerial string) []schema.HardwarePCIeDevice {
 	if !hasNVIDIADevices(devs) {
@@ -78,9 +78,10 @@ func enrichPCIeWithNVIDIAData(devs []schema.HardwarePCIeDevice, gpuByBDF map[str
 			devs[i].Firmware = &v
 		}
 
-		status := "OK"
+		status := statusOK
 		if info.ECCUncorrected != nil && *info.ECCUncorrected > 0 {
-			status = "WARNING"
+			status = statusWarning
+			devs[i].ErrorDescription = stringPtr("GPU reports uncorrected ECC errors")
 		}
 		devs[i].Status = &status
 		injectNVIDIATelemetry(&devs[i], info)
@@ -214,7 +215,7 @@ func isNVIDIADevice(dev schema.HardwarePCIeDevice) bool {
 
 func setPCIeFallback(dev *schema.HardwarePCIeDevice, boardSerial string) {
 	setPCIeFallbackSerial(dev, boardSerial)
-	status := "UNKNOWN"
+	status := statusUnknown
 	dev.Status = &status
 }
 
@@ -233,25 +234,19 @@ func setPCIeFallbackSerial(dev *schema.HardwarePCIeDevice, boardSerial string) {
 }
 
 func injectNVIDIATelemetry(dev *schema.HardwarePCIeDevice, info nvidiaGPUInfo) {
-	if dev.Telemetry == nil {
-		dev.Telemetry = map[string]any{}
-	}
 	if info.TemperatureC != nil {
-		dev.Telemetry["temperature_c"] = *info.TemperatureC
+		dev.TemperatureC = info.TemperatureC
 	}
 	if info.PowerW != nil {
-		dev.Telemetry["power_w"] = *info.PowerW
+		dev.PowerW = info.PowerW
 	}
 	if info.ECCUncorrected != nil {
-		dev.Telemetry["ecc_uncorrected_total"] = *info.ECCUncorrected
+		dev.ECCUncorrectedTotal = info.ECCUncorrected
 	}
 	if info.ECCCorrected != nil {
-		dev.Telemetry["ecc_corrected_total"] = *info.ECCCorrected
+		dev.ECCCorrectedTotal = info.ECCCorrected
 	}
 	if info.HWSlowdown != nil {
-		dev.Telemetry["hw_slowdown_active"] = *info.HWSlowdown
-	}
-	if len(dev.Telemetry) == 0 {
-		dev.Telemetry = nil
+		dev.HWSlowdown = info.HWSlowdown
 	}
 }

audit/internal/collector/nvidia_test.go

@@ -54,10 +54,10 @@ func TestEnrichPCIeWithNVIDIAData_driverLoaded(t *testing.T) {
 	status := "OK"
 	devices := []schema.HardwarePCIeDevice{
 		{
-			VendorID:     &vendorID,
-			BDF:          &bdf,
-			Manufacturer: &manufacturer,
-			Status:       &status,
+			HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+			VendorID:                &vendorID,
+			BDF:                     &bdf,
+			Manufacturer:            &manufacturer,
 		},
 	}
 
@@ -80,14 +80,14 @@ func TestEnrichPCIeWithNVIDIAData_driverLoaded(t *testing.T) {
 	if out[0].Firmware == nil || *out[0].Firmware != "96.00.1F.00.02" {
 		t.Fatalf("firmware: got %v", out[0].Firmware)
 	}
-	if out[0].Status == nil || *out[0].Status != "WARNING" {
+	if out[0].Status == nil || *out[0].Status != statusWarning {
 		t.Fatalf("status: got %v", out[0].Status)
 	}
-	if out[0].Telemetry == nil {
-		t.Fatal("expected telemetry")
+	if out[0].ECCUncorrectedTotal == nil || *out[0].ECCUncorrectedTotal != 2 {
+		t.Fatalf("ecc_uncorrected_total: got %#v", out[0].ECCUncorrectedTotal)
 	}
-	if got, ok := out[0].Telemetry["ecc_uncorrected_total"].(int64); !ok || got != 2 {
-		t.Fatalf("ecc_uncorrected_total: got %#v", out[0].Telemetry["ecc_uncorrected_total"])
+	if out[0].TemperatureC == nil || *out[0].TemperatureC != 55.5 {
+		t.Fatalf("temperature_c: got %#v", out[0].TemperatureC)
 	}
 }
 
@@ -107,7 +107,7 @@ func TestEnrichPCIeWithNVIDIAData_driverMissingFallback(t *testing.T) {
 	if out[0].SerialNumber == nil || *out[0].SerialNumber != "BOARD-123-PCIE-0000:17:00.0" {
 		t.Fatalf("fallback serial: got %v", out[0].SerialNumber)
 	}
-	if out[0].Status == nil || *out[0].Status != "UNKNOWN" {
+	if out[0].Status == nil || *out[0].Status != statusUnknown {
 		t.Fatalf("fallback status: got %v", out[0].Status)
 	}
 }

audit/internal/collector/pcie.go

@@ -79,7 +79,7 @@ func parseLspciDevice(fields map[string]string) schema.HardwarePCIeDevice {
 	dev := schema.HardwarePCIeDevice{}
 	present := true
 	dev.Present = &present
-	status := "OK"
+	status := statusOK
 	dev.Status = &status
 
 	// Slot is the BDF: "0000:00:02.0"
@@ -93,10 +93,32 @@ func parseLspciDevice(fields map[string]string) schema.HardwarePCIeDevice {
 		if deviceID != 0 {
 			dev.DeviceID = &deviceID
 		}
+		if numaNode, ok := readPCINumaNode(bdf); ok {
+			dev.NUMANode = &numaNode
+		}
+		if width, ok := readPCIIntAttribute(bdf, "current_link_width"); ok {
+			dev.LinkWidth = &width
+		}
+		if width, ok := readPCIIntAttribute(bdf, "max_link_width"); ok {
+			dev.MaxLinkWidth = &width
+		}
+		if speed, ok := readPCIStringAttribute(bdf, "current_link_speed"); ok {
+			linkSpeed := normalizePCILinkSpeed(speed)
+			if linkSpeed != "" {
+				dev.LinkSpeed = &linkSpeed
+			}
+		}
+		if speed, ok := readPCIStringAttribute(bdf, "max_link_speed"); ok {
+			linkSpeed := normalizePCILinkSpeed(speed)
+			if linkSpeed != "" {
+				dev.MaxLinkSpeed = &linkSpeed
+			}
+		}
 	}
 
 	if v := fields["Class"]; v != "" {
-		dev.DeviceClass = &v
+		class := mapPCIeDeviceClass(v)
+		dev.DeviceClass = &class
 	}
 	if v := fields["Vendor"]; v != "" {
 		dev.Manufacturer = &v
@@ -131,3 +153,55 @@ func readHexFile(path string) (int, error) {
 	n, err := strconv.ParseInt(s, 16, 64)
 	return int(n), err
 }
+
+func readPCINumaNode(bdf string) (int, bool) {
+	value, ok := readPCIIntAttribute(bdf, "numa_node")
+	if !ok || value < 0 {
+		return 0, false
+	}
+	return value, true
+}
+
+func readPCIIntAttribute(bdf, attribute string) (int, bool) {
+	out, err := exec.Command("cat", "/sys/bus/pci/devices/"+bdf+"/"+attribute).Output()
+	if err != nil {
+		return 0, false
+	}
+	value, err := strconv.Atoi(strings.TrimSpace(string(out)))
+	if err != nil || value < 0 {
+		return 0, false
+	}
+	return value, true
+}
+
+func readPCIStringAttribute(bdf, attribute string) (string, bool) {
+	out, err := exec.Command("cat", "/sys/bus/pci/devices/"+bdf+"/"+attribute).Output()
+	if err != nil {
+		return "", false
+	}
+	value := strings.TrimSpace(string(out))
+	if value == "" {
+		return "", false
+	}
+	return value, true
+}
+
+func normalizePCILinkSpeed(raw string) string {
+	raw = strings.TrimSpace(strings.ToLower(raw))
+	switch {
+	case strings.Contains(raw, "2.5"):
+		return "Gen1"
+	case strings.Contains(raw, "5.0"):
+		return "Gen2"
+	case strings.Contains(raw, "8.0"):
+		return "Gen3"
+	case strings.Contains(raw, "16.0"):
+		return "Gen4"
+	case strings.Contains(raw, "32.0"):
+		return "Gen5"
+	case strings.Contains(raw, "64.0"):
+		return "Gen6"
+	default:
+		return ""
+	}
+}

audit/internal/collector/pcie_filter_test.go

@@ -35,7 +35,27 @@ func TestParseLspci_filtersExcludedClasses(t *testing.T) {
 	if len(devs) != 1 {
 		t.Fatalf("expected 1 filtered device, got %d", len(devs))
 	}
-	if devs[0].DeviceClass == nil || *devs[0].DeviceClass != "VGA compatible controller" {
+	if devs[0].DeviceClass == nil || *devs[0].DeviceClass != "VideoController" {
 		t.Fatalf("unexpected remaining class: %v", devs[0].DeviceClass)
 	}
 }
+
+func TestNormalizePCILinkSpeed(t *testing.T) {
+	tests := []struct {
+		raw  string
+		want string
+	}{
+		{"2.5 GT/s PCIe", "Gen1"},
+		{"5.0 GT/s PCIe", "Gen2"},
+		{"8.0 GT/s PCIe", "Gen3"},
+		{"16.0 GT/s PCIe", "Gen4"},
+		{"32.0 GT/s PCIe", "Gen5"},
+		{"64.0 GT/s PCIe", "Gen6"},
+		{"unknown", ""},
+	}
+	for _, tt := range tests {
+		if got := normalizePCILinkSpeed(tt.raw); got != tt.want {
+			t.Fatalf("normalizePCILinkSpeed(%q)=%q want %q", tt.raw, got, tt.want)
+		}
+	}
+}

audit/internal/collector/psu.go

@@ -4,6 +4,7 @@ import (
 	"bee/audit/internal/schema"
 	"log/slog"
 	"os/exec"
+	"regexp"
 	"strconv"
 	"strings"
 )
@@ -16,6 +17,9 @@ func collectPSUs() []schema.HardwarePowerSupply {
 		return nil
 	}
 	psus := parseFRU(string(out))
+	if sdrOut, err := exec.Command("ipmitool", "sdr").Output(); err == nil {
+		mergePSUSDR(psus, parsePSUSDR(string(sdrOut)))
+	}
 	slog.Info("psu: collected", "count", len(psus))
 	return psus
 }
@@ -110,12 +114,160 @@ func parseFRUBlock(block string, slotIdx int) (schema.HardwarePowerSupply, bool)
 		}
 	}
 
-	status := "OK"
+	status := statusOK
 	psu.Status = &status
 
 	return psu, true
 }
 
+type psuSDR struct {
+	slot         int
+	status       string
+	reason       string
+	inputPowerW  *float64
+	outputPowerW *float64
+	inputVoltage *float64
+	temperatureC *float64
+	healthPct    *float64
+}
+
+var psuSlotRe = regexp.MustCompile(`(?i)\bpsu?\s*([0-9]+)\b|\bps\s*([0-9]+)\b`)
+
+func parsePSUSDR(raw string) map[int]psuSDR {
+	out := map[int]psuSDR{}
+	for _, line := range strings.Split(raw, "\n") {
+		fields := splitSDRFields(line)
+		if len(fields) < 3 {
+			continue
+		}
+		name := fields[0]
+		value := fields[1]
+		state := strings.ToLower(fields[2])
+		slot, ok := parsePSUSlot(name)
+		if !ok {
+			continue
+		}
+
+		entry := out[slot]
+		entry.slot = slot
+		if entry.status == "" {
+			entry.status = statusOK
+		}
+		if state != "" && state != "ok" && state != "ns" {
+			entry.status = statusCritical
+			entry.reason = "PSU sensor reported non-OK state: " + state
+		}
+
+		lowerName := strings.ToLower(name)
+		switch {
+		case strings.Contains(lowerName, "input power"):
+			entry.inputPowerW = parseFloatPtr(value)
+		case strings.Contains(lowerName, "output power"):
+			entry.outputPowerW = parseFloatPtr(value)
+		case strings.Contains(lowerName, "input voltage"), strings.Contains(lowerName, "ac input"):
+			entry.inputVoltage = parseFloatPtr(value)
+		case strings.Contains(lowerName, "temp"):
+			entry.temperatureC = parseFloatPtr(value)
+		case strings.Contains(lowerName, "health"), strings.Contains(lowerName, "remaining life"), strings.Contains(lowerName, "life remaining"):
+			entry.healthPct = parsePercentPtr(value)
+		}
+		out[slot] = entry
+	}
+	return out
+}
+
+func mergePSUSDR(psus []schema.HardwarePowerSupply, sdr map[int]psuSDR) {
+	for i := range psus {
+		slotIdx, err := strconv.Atoi(derefPSUSlot(psus[i].Slot))
+		if err != nil {
+			continue
+		}
+		entry, ok := sdr[slotIdx+1]
+		if !ok {
+			continue
+		}
+		if entry.inputPowerW != nil {
+			psus[i].InputPowerW = entry.inputPowerW
+		}
+		if entry.outputPowerW != nil {
+			psus[i].OutputPowerW = entry.outputPowerW
+		}
+		if entry.inputVoltage != nil {
+			psus[i].InputVoltage = entry.inputVoltage
+		}
+		if entry.temperatureC != nil {
+			psus[i].TemperatureC = entry.temperatureC
+		}
+		if entry.healthPct != nil {
+			psus[i].LifeRemainingPct = entry.healthPct
+			lifeUsed := 100 - *entry.healthPct
+			psus[i].LifeUsedPct = &lifeUsed
+		}
+		if entry.status != "" {
+			psus[i].Status = &entry.status
+		}
+		if entry.reason != "" {
+			psus[i].ErrorDescription = &entry.reason
+		}
+		if psus[i].Status != nil && *psus[i].Status == statusOK {
+			if (entry.inputPowerW == nil && entry.outputPowerW == nil && entry.inputVoltage == nil) && entry.status == "" {
+				unknown := statusUnknown
+				psus[i].Status = &unknown
+			}
+		}
+	}
+}
+
+func splitSDRFields(line string) []string {
+	parts := strings.Split(line, "|")
+	out := make([]string, 0, len(parts))
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part != "" {
+			out = append(out, part)
+		}
+	}
+	return out
+}
+
+func parsePSUSlot(name string) (int, bool) {
+	m := psuSlotRe.FindStringSubmatch(strings.ToLower(name))
+	if len(m) == 0 {
+		return 0, false
+	}
+	for _, group := range m[1:] {
+		if group == "" {
+			continue
+		}
+		n, err := strconv.Atoi(group)
+		if err == nil && n > 0 {
+			return n, true
+		}
+	}
+	return 0, false
+}
+
+func parseFloatPtr(raw string) *float64 {
+	raw = strings.TrimSpace(raw)
+	if raw == "" || strings.EqualFold(raw, "na") {
+		return nil
+	}
+	for _, field := range strings.Fields(raw) {
+		n, err := strconv.ParseFloat(strings.TrimSpace(field), 64)
+		if err == nil {
+			return &n
+		}
+	}
+	return nil
+}
+
+func derefPSUSlot(slot *string) string {
+	if slot == nil {
+		return ""
+	}
+	return *slot
+}
+
 // parseWattage extracts wattage from strings like "PSU 800W", "1200W PLATINUM".
 func parseWattage(s string) int {
 	s = strings.ToUpper(s)

audit/internal/collector/psu_sdr_test.go

@@ -0,0 +1,40 @@
+package collector
+
+import "testing"
+
+func TestParsePSUSDR(t *testing.T) {
+	raw := `
+PS1 Input Power   | 215 Watts | ok
+PS1 Output Power  | 198 Watts | ok
+PS1 Input Voltage | 229 Volts | ok
+PS1 Temp         | 39 C      | ok
+PS1 Health       | 97 %      | ok
+PS2 Input Power   | 0 Watts   | cr
+`
+
+	got := parsePSUSDR(raw)
+	if len(got) != 2 {
+		t.Fatalf("len(got)=%d want 2", len(got))
+	}
+	if got[1].status != statusOK {
+		t.Fatalf("ps1 status=%q", got[1].status)
+	}
+	if got[1].inputPowerW == nil || *got[1].inputPowerW != 215 {
+		t.Fatalf("ps1 input power=%v", got[1].inputPowerW)
+	}
+	if got[1].outputPowerW == nil || *got[1].outputPowerW != 198 {
+		t.Fatalf("ps1 output power=%v", got[1].outputPowerW)
+	}
+	if got[1].inputVoltage == nil || *got[1].inputVoltage != 229 {
+		t.Fatalf("ps1 input voltage=%v", got[1].inputVoltage)
+	}
+	if got[1].temperatureC == nil || *got[1].temperatureC != 39 {
+		t.Fatalf("ps1 temperature=%v", got[1].temperatureC)
+	}
+	if got[1].healthPct == nil || *got[1].healthPct != 97 {
+		t.Fatalf("ps1 health=%v", got[1].healthPct)
+	}
+	if got[2].status != statusCritical {
+		t.Fatalf("ps2 status=%q", got[2].status)
+	}
+}

audit/internal/collector/psu_telemetry.go

@@ -0,0 +1,132 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"strconv"
+	"strings"
+)
+
+func enrichPSUsWithTelemetry(psus []schema.HardwarePowerSupply, doc sensorsDoc) []schema.HardwarePowerSupply {
+	if len(psus) == 0 || len(doc) == 0 {
+		return psus
+	}
+
+	tempBySlot := psuTempsFromSensors(doc)
+	healthBySlot := psuHealthFromSensors(doc)
+	for i := range psus {
+		slot := derefPSUSlot(psus[i].Slot)
+		if slot == "" {
+			continue
+		}
+		if psus[i].TemperatureC == nil {
+			if value, ok := tempBySlot[slot]; ok {
+				psus[i].TemperatureC = &value
+			}
+		}
+		if psus[i].LifeRemainingPct == nil {
+			if value, ok := healthBySlot[slot]; ok {
+				psus[i].LifeRemainingPct = &value
+				used := 100 - value
+				psus[i].LifeUsedPct = &used
+			}
+		}
+	}
+	return psus
+}
+
+func psuHealthFromSensors(doc sensorsDoc) map[string]float64 {
+	out := map[string]float64{}
+	for chip, features := range doc {
+		for featureName, raw := range features {
+			feature, ok := raw.(map[string]any)
+			if !ok {
+				continue
+			}
+			if !isLikelyPSUHealth(chip, featureName) {
+				continue
+			}
+			value, ok := firstFeaturePercent(feature)
+			if !ok {
+				continue
+			}
+			if slot, ok := detectPSUSlot(chip, featureName); ok {
+				if _, exists := out[slot]; !exists {
+					out[slot] = value
+				}
+			}
+		}
+	}
+	return out
+}
+
+func firstFeaturePercent(feature map[string]any) (float64, bool) {
+	keys := sortedFeatureKeys(feature)
+	for _, key := range keys {
+		lower := strings.ToLower(key)
+		if strings.HasSuffix(lower, "_alarm") {
+			continue
+		}
+		if strings.Contains(lower, "health") || strings.Contains(lower, "life") || strings.Contains(lower, "remain") {
+			if value, ok := floatFromAny(feature[key]); ok {
+				return value, true
+			}
+		}
+	}
+	return 0, false
+}
+
+func isLikelyPSUHealth(chip, feature string) bool {
+	value := strings.ToLower(chip + " " + feature)
+	return (strings.Contains(value, "psu") || strings.Contains(value, "power supply")) &&
+		(strings.Contains(value, "health") || strings.Contains(value, "life") || strings.Contains(value, "remain"))
+}
+
+func psuTempsFromSensors(doc sensorsDoc) map[string]float64 {
+	out := map[string]float64{}
+	for chip, features := range doc {
+		for featureName, raw := range features {
+			feature, ok := raw.(map[string]any)
+			if !ok || classifySensorFeature(feature) != "temp" {
+				continue
+			}
+			if !isLikelyPSUTemp(chip, featureName) {
+				continue
+			}
+			temp, ok := firstFeatureFloat(feature, "_input")
+			if !ok {
+				continue
+			}
+			if slot, ok := detectPSUSlot(chip, featureName); ok {
+				if _, exists := out[slot]; !exists {
+					out[slot] = temp
+				}
+			}
+		}
+	}
+	return out
+}
+
+func isLikelyPSUTemp(chip, feature string) bool {
+	value := strings.ToLower(chip + " " + feature)
+	return strings.Contains(value, "psu") || strings.Contains(value, "power supply")
+}
+
+func detectPSUSlot(parts ...string) (string, bool) {
+	for _, part := range parts {
+		lower := strings.ToLower(part)
+		matches := psuSlotRe.FindStringSubmatch(lower)
+		if len(matches) == 0 {
+			continue
+		}
+		for _, group := range matches[1:] {
+			if group == "" {
+				continue
+			}
+			value, err := strconv.Atoi(group)
+			if err == nil && value > 0 {
+				return strconv.Itoa(value - 1), true
+			}
+		}
+	}
+	return "", false
+}

audit/internal/collector/psu_telemetry_test.go

@@ -0,0 +1,42 @@
+package collector
+
+import (
+	"testing"
+
+	"bee/audit/internal/schema"
+)
+
+func TestEnrichPSUsWithTelemetry(t *testing.T) {
+	slot0 := "0"
+	slot1 := "1"
+	psus := []schema.HardwarePowerSupply{
+		{Slot: &slot0},
+		{Slot: &slot1},
+	}
+
+	doc := sensorsDoc{
+		"psu-hwmon-0": {
+			"PSU1 Temp":           map[string]any{"temp1_input": 39.5},
+			"PSU2 Temp":           map[string]any{"temp2_input": 41.0},
+			"PSU1 Health":         map[string]any{"health1_input": 98.0},
+			"PSU2 Remaining Life": map[string]any{"life2_input": 95.0},
+		},
+	}
+
+	got := enrichPSUsWithTelemetry(psus, doc)
+	if got[0].TemperatureC == nil || *got[0].TemperatureC != 39.5 {
+		t.Fatalf("psu0 temperature mismatch: %#v", got[0].TemperatureC)
+	}
+	if got[1].TemperatureC == nil || *got[1].TemperatureC != 41.0 {
+		t.Fatalf("psu1 temperature mismatch: %#v", got[1].TemperatureC)
+	}
+	if got[0].LifeRemainingPct == nil || *got[0].LifeRemainingPct != 98.0 {
+		t.Fatalf("psu0 life remaining mismatch: %#v", got[0].LifeRemainingPct)
+	}
+	if got[0].LifeUsedPct == nil || *got[0].LifeUsedPct != 2.0 {
+		t.Fatalf("psu0 life used mismatch: %#v", got[0].LifeUsedPct)
+	}
+	if got[1].LifeRemainingPct == nil || *got[1].LifeRemainingPct != 95.0 {
+		t.Fatalf("psu1 life remaining mismatch: %#v", got[1].LifeRemainingPct)
+	}
+}

audit/internal/collector/raid.go

@@ -83,11 +83,7 @@ func isLikelyRAIDController(dev schema.HardwarePCIeDevice) bool {
 	if dev.DeviceClass == nil {
 		return false
 	}
-	c := strings.ToLower(*dev.DeviceClass)
-	return strings.Contains(c, "raid") ||
-		strings.Contains(c, "sas") ||
-		strings.Contains(c, "mass storage") ||
-		strings.Contains(c, "serial attached scsi")
+	return isRAIDClass(*dev.DeviceClass)
 }
 
 func collectStorcliDrives() []schema.HardwareStorage {
@@ -182,7 +178,10 @@ func parseSASIrcuDisplay(raw string) []schema.HardwareStorage {
 
 		present := true
 		status := mapRAIDDriveStatus(b["State"])
-		s := schema.HardwareStorage{Present: &present, Status: &status}
+		s := schema.HardwareStorage{
+			HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+			Present:                 &present,
+		}
 
 		enclosure := strings.TrimSpace(b["Enclosure #"])
 		slot := strings.TrimSpace(b["Slot #"])
@@ -281,7 +280,10 @@ func parseArcconfPhysicalDrives(raw string) []schema.HardwareStorage {
 	for _, b := range blocks {
 		present := true
 		status := mapRAIDDriveStatus(b["State"])
-		s := schema.HardwareStorage{Present: &present, Status: &status}
+		s := schema.HardwareStorage{
+			HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+			Present:                 &present,
+		}
 
 		if v := strings.TrimSpace(b["Reported Location"]); v != "" {
 			s.Slot = &v
@@ -362,8 +364,11 @@ func parseSSACLIPhysicalDrives(raw string) []schema.HardwareStorage {
 		if m := ssacliPhysicalDriveLine.FindStringSubmatch(trimmed); len(m) == 3 {
 			flush()
 			present := true
-			status := "UNKNOWN"
-			s := schema.HardwareStorage{Present: &present, Status: &status}
+			status := statusUnknown
+			s := schema.HardwareStorage{
+				HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+				Present:                 &present,
+			}
 			slot := m[1]
 			s.Slot = &slot
 
@@ -475,8 +480,8 @@ func storcliDriveToStorage(d struct {
 	present := true
 	status := mapRAIDDriveStatus(d.State)
 	s := schema.HardwareStorage{
-		Present: &present,
-		Status:  &status,
+		HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+		Present:                 &present,
 	}
 
 	if v := strings.TrimSpace(d.EIDSlt); v != "" {
@@ -527,15 +532,15 @@ func mapRAIDDriveStatus(raw string) string {
 	u := strings.ToUpper(strings.TrimSpace(raw))
 	switch {
 	case strings.Contains(u, "OK"), strings.Contains(u, "OPTIMAL"), strings.Contains(u, "READY"):
-		return "OK"
+		return statusOK
 	case strings.Contains(u, "ONLN"), strings.Contains(u, "ONLINE"):
-		return "OK"
+		return statusOK
 	case strings.Contains(u, "RBLD"), strings.Contains(u, "REBUILD"):
-		return "WARNING"
+		return statusWarning
 	case strings.Contains(u, "FAIL"), strings.Contains(u, "OFFLINE"):
-		return "CRITICAL"
+		return statusCritical
 	default:
-		return "UNKNOWN"
+		return statusUnknown
 	}
 }
 
@@ -641,8 +646,9 @@ func enrichStorageWithVROC(storage []schema.HardwareStorage, pcie []schema.Hardw
 		storage[i].Telemetry["vroc_array"] = arr.Name
 		storage[i].Telemetry["vroc_degraded"] = arr.Degraded
 		if arr.Degraded {
-			status := "WARNING"
+			status := statusWarning
 			storage[i].Status = &status
+			storage[i].ErrorDescription = stringPtr("VROC array is degraded")
 		}
 		updated++
 	}
@@ -659,14 +665,14 @@ func hasVROCController(pcie []schema.HardwarePCIeDevice) bool {
 
 		class := ""
 		if dev.DeviceClass != nil {
-			class = strings.ToLower(*dev.DeviceClass)
+			class = strings.TrimSpace(*dev.DeviceClass)
 		}
 		model := ""
 		if dev.Model != nil {
 			model = strings.ToLower(*dev.Model)
 		}
 
-		if strings.Contains(class, "raid") ||
+		if isRAIDClass(class) ||
 			strings.Contains(model, "vroc") ||
 			strings.Contains(model, "volume management device") ||
 			strings.Contains(model, "vmd") {

audit/internal/collector/raid_controller_telemetry.go

@@ -0,0 +1,334 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"encoding/json"
+	"log/slog"
+	"strconv"
+	"strings"
+)
+
+type raidControllerTelemetry struct {
+	BatteryChargePct       *float64
+	BatteryHealthPct       *float64
+	BatteryTemperatureC    *float64
+	BatteryVoltageV        *float64
+	BatteryReplaceRequired *bool
+	ErrorDescription       *string
+}
+
+func enrichPCIeWithRAIDTelemetry(devs []schema.HardwarePCIeDevice) []schema.HardwarePCIeDevice {
+	byVendor := collectRAIDControllerTelemetry()
+	if len(byVendor) == 0 {
+		return devs
+	}
+
+	positions := map[int]int{}
+	for i := range devs {
+		if devs[i].VendorID == nil || !isLikelyRAIDController(devs[i]) {
+			continue
+		}
+		vendor := *devs[i].VendorID
+		list := byVendor[vendor]
+		if len(list) == 0 {
+			continue
+		}
+		index := positions[vendor]
+		if index >= len(list) {
+			continue
+		}
+		positions[vendor] = index + 1
+		applyRAIDControllerTelemetry(&devs[i], list[index])
+	}
+
+	return devs
+}
+
+func applyRAIDControllerTelemetry(dev *schema.HardwarePCIeDevice, tel raidControllerTelemetry) {
+	if tel.BatteryChargePct != nil {
+		dev.BatteryChargePct = tel.BatteryChargePct
+	}
+	if tel.BatteryHealthPct != nil {
+		dev.BatteryHealthPct = tel.BatteryHealthPct
+	}
+	if tel.BatteryTemperatureC != nil {
+		dev.BatteryTemperatureC = tel.BatteryTemperatureC
+	}
+	if tel.BatteryVoltageV != nil {
+		dev.BatteryVoltageV = tel.BatteryVoltageV
+	}
+	if tel.BatteryReplaceRequired != nil {
+		dev.BatteryReplaceRequired = tel.BatteryReplaceRequired
+	}
+	if tel.ErrorDescription != nil {
+		dev.ErrorDescription = tel.ErrorDescription
+		if dev.Status == nil || *dev.Status == statusOK {
+			status := statusWarning
+			dev.Status = &status
+		}
+	}
+}
+
+func collectRAIDControllerTelemetry() map[int][]raidControllerTelemetry {
+	out := map[int][]raidControllerTelemetry{}
+
+	if raw, err := raidToolQuery("storcli64", "/call", "show", "all", "J"); err == nil {
+		list := parseStorcliControllerTelemetry(raw)
+		if len(list) > 0 {
+			out[vendorBroadcomLSI] = append(out[vendorBroadcomLSI], list...)
+			slog.Info("raid: storcli controller telemetry", "count", len(list))
+		}
+	}
+
+	if raw, err := raidToolQuery("ssacli", "ctrl", "all", "show", "config", "detail"); err == nil {
+		list := parseSSACLIControllerTelemetry(string(raw))
+		if len(list) > 0 {
+			out[vendorHPE] = append(out[vendorHPE], list...)
+			slog.Info("raid: ssacli controller telemetry", "count", len(list))
+		}
+	}
+
+	if raw, err := raidToolQuery("arcconf", "getconfig", "1", "ad"); err == nil {
+		list := parseArcconfControllerTelemetry(string(raw))
+		if len(list) > 0 {
+			out[vendorAdaptec] = append(out[vendorAdaptec], list...)
+			slog.Info("raid: arcconf controller telemetry", "count", len(list))
+		}
+	}
+
+	return out
+}
+
+func parseStorcliControllerTelemetry(raw []byte) []raidControllerTelemetry {
+	var doc struct {
+		Controllers []struct {
+			ResponseData map[string]any `json:"Response Data"`
+		} `json:"Controllers"`
+	}
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		slog.Warn("raid: parse storcli controller telemetry failed", "err", err)
+		return nil
+	}
+
+	var out []raidControllerTelemetry
+	for _, ctl := range doc.Controllers {
+		tel := raidControllerTelemetry{}
+		mergeStorcliBatteryMap(&tel, nestedStringMap(ctl.ResponseData["BBU_Info"]))
+		mergeStorcliBatteryMap(&tel, nestedStringMap(ctl.ResponseData["BBU_Info_Details"]))
+		mergeStorcliBatteryMap(&tel, nestedStringMap(ctl.ResponseData["CV_Info"]))
+		mergeStorcliBatteryMap(&tel, nestedStringMap(ctl.ResponseData["CV_Info_Details"]))
+		if hasRAIDControllerTelemetry(tel) {
+			out = append(out, tel)
+		}
+	}
+	return out
+}
+
+func nestedStringMap(raw any) map[string]string {
+	switch value := raw.(type) {
+	case map[string]any:
+		out := map[string]string{}
+		flattenStringMap("", value, out)
+		return out
+	case []any:
+		out := map[string]string{}
+		for _, item := range value {
+			if m, ok := item.(map[string]any); ok {
+				flattenStringMap("", m, out)
+			}
+		}
+		return out
+	default:
+		return nil
+	}
+}
+
+func flattenStringMap(prefix string, in map[string]any, out map[string]string) {
+	for key, raw := range in {
+		fullKey := strings.TrimSpace(strings.ToLower(strings.Trim(prefix+" "+key, " ")))
+		switch value := raw.(type) {
+		case map[string]any:
+			flattenStringMap(fullKey, value, out)
+		case []any:
+			for _, item := range value {
+				if m, ok := item.(map[string]any); ok {
+					flattenStringMap(fullKey, m, out)
+				}
+			}
+		case string:
+			out[fullKey] = value
+		case json.Number:
+			out[fullKey] = value.String()
+		case float64:
+			out[fullKey] = strconv.FormatFloat(value, 'f', -1, 64)
+		case bool:
+			if value {
+				out[fullKey] = "true"
+			} else {
+				out[fullKey] = "false"
+			}
+		}
+	}
+}
+
+func mergeStorcliBatteryMap(tel *raidControllerTelemetry, fields map[string]string) {
+	if len(fields) == 0 {
+		return
+	}
+	for key, raw := range fields {
+		lower := strings.ToLower(strings.TrimSpace(key))
+		switch {
+		case strings.Contains(lower, "relative state of charge"), strings.Contains(lower, "remaining capacity"), strings.Contains(lower, "charge"):
+			if tel.BatteryChargePct == nil {
+				tel.BatteryChargePct = parsePercentPtr(raw)
+			}
+		case strings.Contains(lower, "state of health"), strings.Contains(lower, "health"):
+			if tel.BatteryHealthPct == nil {
+				tel.BatteryHealthPct = parsePercentPtr(raw)
+			}
+		case strings.Contains(lower, "temperature"):
+			if tel.BatteryTemperatureC == nil {
+				tel.BatteryTemperatureC = parseFloatPtr(raw)
+			}
+		case strings.Contains(lower, "voltage"):
+			if tel.BatteryVoltageV == nil {
+				tel.BatteryVoltageV = parseFloatPtr(raw)
+			}
+		case strings.Contains(lower, "replace"), strings.Contains(lower, "replacement required"):
+			if tel.BatteryReplaceRequired == nil {
+				tel.BatteryReplaceRequired = parseReplaceRequired(raw)
+			}
+		case strings.Contains(lower, "learn cycle requested"), strings.Contains(lower, "battery state"), strings.Contains(lower, "capacitance state"):
+			if desc := batteryStateDescription(raw); desc != nil && tel.ErrorDescription == nil {
+				tel.ErrorDescription = desc
+			}
+		}
+	}
+}
+
+func parseSSACLIControllerTelemetry(raw string) []raidControllerTelemetry {
+	lines := strings.Split(raw, "\n")
+	var out []raidControllerTelemetry
+	var current *raidControllerTelemetry
+
+	flush := func() {
+		if current != nil && hasRAIDControllerTelemetry(*current) {
+			out = append(out, *current)
+		}
+		current = nil
+	}
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			continue
+		}
+		if strings.HasPrefix(strings.ToLower(trimmed), "smart array") || strings.HasPrefix(strings.ToLower(trimmed), "controller ") {
+			flush()
+			current = &raidControllerTelemetry{}
+			continue
+		}
+		if current == nil {
+			continue
+		}
+		if idx := strings.Index(trimmed, ":"); idx > 0 {
+			key := strings.ToLower(strings.TrimSpace(trimmed[:idx]))
+			val := strings.TrimSpace(trimmed[idx+1:])
+			switch {
+			case strings.Contains(key, "capacitor temperature"), strings.Contains(key, "battery temperature"):
+				current.BatteryTemperatureC = parseFloatPtr(val)
+			case strings.Contains(key, "capacitor voltage"), strings.Contains(key, "battery voltage"):
+				current.BatteryVoltageV = parseFloatPtr(val)
+			case strings.Contains(key, "capacitor charge"), strings.Contains(key, "battery charge"):
+				current.BatteryChargePct = parsePercentPtr(val)
+			case strings.Contains(key, "capacitor health"), strings.Contains(key, "battery health"):
+				current.BatteryHealthPct = parsePercentPtr(val)
+			case strings.Contains(key, "replace") || strings.Contains(key, "failed"):
+				if current.BatteryReplaceRequired == nil {
+					current.BatteryReplaceRequired = parseReplaceRequired(val)
+				}
+				if desc := batteryStateDescription(val); desc != nil && current.ErrorDescription == nil {
+					current.ErrorDescription = desc
+				}
+			}
+		}
+	}
+	flush()
+	return out
+}
+
+func parseArcconfControllerTelemetry(raw string) []raidControllerTelemetry {
+	lines := strings.Split(raw, "\n")
+	tel := raidControllerTelemetry{}
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if idx := strings.Index(trimmed, ":"); idx > 0 {
+			key := strings.ToLower(strings.TrimSpace(trimmed[:idx]))
+			val := strings.TrimSpace(trimmed[idx+1:])
+			switch {
+			case strings.Contains(key, "battery temperature"), strings.Contains(key, "capacitor temperature"):
+				tel.BatteryTemperatureC = parseFloatPtr(val)
+			case strings.Contains(key, "battery voltage"), strings.Contains(key, "capacitor voltage"):
+				tel.BatteryVoltageV = parseFloatPtr(val)
+			case strings.Contains(key, "battery charge"), strings.Contains(key, "capacitor charge"):
+				tel.BatteryChargePct = parsePercentPtr(val)
+			case strings.Contains(key, "battery health"), strings.Contains(key, "capacitor health"):
+				tel.BatteryHealthPct = parsePercentPtr(val)
+			case strings.Contains(key, "replace"), strings.Contains(key, "failed"):
+				if tel.BatteryReplaceRequired == nil {
+					tel.BatteryReplaceRequired = parseReplaceRequired(val)
+				}
+				if desc := batteryStateDescription(val); desc != nil && tel.ErrorDescription == nil {
+					tel.ErrorDescription = desc
+				}
+			}
+		}
+	}
+	if hasRAIDControllerTelemetry(tel) {
+		return []raidControllerTelemetry{tel}
+	}
+	return nil
+}
+
+func hasRAIDControllerTelemetry(tel raidControllerTelemetry) bool {
+	return tel.BatteryChargePct != nil ||
+		tel.BatteryHealthPct != nil ||
+		tel.BatteryTemperatureC != nil ||
+		tel.BatteryVoltageV != nil ||
+		tel.BatteryReplaceRequired != nil ||
+		tel.ErrorDescription != nil
+}
+
+func parsePercentPtr(raw string) *float64 {
+	raw = strings.ReplaceAll(strings.TrimSpace(raw), "%", "")
+	return parseFloatPtr(raw)
+}
+
+func parseReplaceRequired(raw string) *bool {
+	lower := strings.ToLower(strings.TrimSpace(raw))
+	switch {
+	case lower == "":
+		return nil
+	case strings.Contains(lower, "replace"), strings.Contains(lower, "failed"), strings.Contains(lower, "yes"), strings.Contains(lower, "required"):
+		value := true
+		return &value
+	case strings.Contains(lower, "no"), strings.Contains(lower, "ok"), strings.Contains(lower, "good"), strings.Contains(lower, "optimal"):
+		value := false
+		return &value
+	default:
+		return nil
+	}
+}
+
+func batteryStateDescription(raw string) *string {
+	lower := strings.ToLower(strings.TrimSpace(raw))
+	if lower == "" {
+		return nil
+	}
+	switch {
+	case strings.Contains(lower, "failed"), strings.Contains(lower, "fault"), strings.Contains(lower, "replace"), strings.Contains(lower, "warning"), strings.Contains(lower, "degraded"):
+		return &raw
+	default:
+		return nil
+	}
+}

audit/internal/collector/raid_parsers_test.go

@@ -1,6 +1,10 @@
 package collector
 
-import "testing"
+import (
+	"bee/audit/internal/schema"
+	"errors"
+	"testing"
+)
 
 func TestParseSASIrcuControllerIDs(t *testing.T) {
 	raw := `LSI Corporation SAS2 IR Configuration Utility.
@@ -90,7 +94,111 @@ physicaldrive 1I:1:2 (894 GB, SAS HDD, Failed)
 	if drives[0].Status == nil || *drives[0].Status != "OK" {
 		t.Fatalf("drive0 status: %v", drives[0].Status)
 	}
-	if drives[1].Status == nil || *drives[1].Status != "CRITICAL" {
+	if drives[1].Status == nil || *drives[1].Status != statusCritical {
 		t.Fatalf("drive1 status: %v", drives[1].Status)
 	}
 }
+
+func TestParseStorcliControllerTelemetry(t *testing.T) {
+	raw := []byte(`{
+  "Controllers": [
+    {
+      "Response Data": {
+        "BBU_Info": {
+          "State of Health": "98 %",
+          "Relative State of Charge": "76 %",
+          "Temperature": "41 C",
+          "Voltage": "12.3 V",
+          "Replacement required": "No"
+        }
+      }
+    }
+  ]
+}`)
+	got := parseStorcliControllerTelemetry(raw)
+	if len(got) != 1 {
+		t.Fatalf("len(got)=%d want 1", len(got))
+	}
+	if got[0].BatteryHealthPct == nil || *got[0].BatteryHealthPct != 98 {
+		t.Fatalf("battery health=%v", got[0].BatteryHealthPct)
+	}
+	if got[0].BatteryChargePct == nil || *got[0].BatteryChargePct != 76 {
+		t.Fatalf("battery charge=%v", got[0].BatteryChargePct)
+	}
+	if got[0].BatteryTemperatureC == nil || *got[0].BatteryTemperatureC != 41 {
+		t.Fatalf("battery temperature=%v", got[0].BatteryTemperatureC)
+	}
+	if got[0].BatteryVoltageV == nil || *got[0].BatteryVoltageV != 12.3 {
+		t.Fatalf("battery voltage=%v", got[0].BatteryVoltageV)
+	}
+	if got[0].BatteryReplaceRequired == nil || *got[0].BatteryReplaceRequired {
+		t.Fatalf("battery replace=%v", got[0].BatteryReplaceRequired)
+	}
+}
+
+func TestParseSSACLIControllerTelemetry(t *testing.T) {
+	raw := `Smart Array P440ar in Slot 0
+   Battery/Capacitor Count: 1
+   Capacitor Temperature  (C): 37
+   Capacitor Charge (%): 94
+   Capacitor Health (%): 96
+   Capacitor Voltage (V): 9.8
+   Capacitor Failed: No
+`
+	got := parseSSACLIControllerTelemetry(raw)
+	if len(got) != 1 {
+		t.Fatalf("len(got)=%d want 1", len(got))
+	}
+	if got[0].BatteryTemperatureC == nil || *got[0].BatteryTemperatureC != 37 {
+		t.Fatalf("battery temperature=%v", got[0].BatteryTemperatureC)
+	}
+	if got[0].BatteryChargePct == nil || *got[0].BatteryChargePct != 94 {
+		t.Fatalf("battery charge=%v", got[0].BatteryChargePct)
+	}
+}
+
+func TestEnrichPCIeWithRAIDTelemetry(t *testing.T) {
+	orig := raidToolQuery
+	t.Cleanup(func() { raidToolQuery = orig })
+	raidToolQuery = func(name string, args ...string) ([]byte, error) {
+		switch name {
+		case "storcli64":
+			return []byte(`{
+  "Controllers": [
+    {
+      "Response Data": {
+        "CV_Info": {
+          "State of Health": "99 %",
+          "Relative State of Charge": "81 %",
+          "Temperature": "38 C",
+          "Voltage": "12.1 V",
+          "Replacement required": "No"
+        }
+      }
+    }
+  ]
+}`), nil
+		default:
+			return nil, errors.New("skip")
+		}
+	}
+
+	vendor := vendorBroadcomLSI
+	class := "MassStorageController"
+	status := statusOK
+	devs := []schema.HardwarePCIeDevice{{
+		VendorID:                &vendor,
+		DeviceClass:             &class,
+		HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+	}}
+	out := enrichPCIeWithRAIDTelemetry(devs)
+	if out[0].BatteryHealthPct == nil || *out[0].BatteryHealthPct != 99 {
+		t.Fatalf("battery health=%v", out[0].BatteryHealthPct)
+	}
+	if out[0].BatteryChargePct == nil || *out[0].BatteryChargePct != 81 {
+		t.Fatalf("battery charge=%v", out[0].BatteryChargePct)
+	}
+	if out[0].BatteryVoltageV == nil || *out[0].BatteryVoltageV != 12.1 {
+		t.Fatalf("battery voltage=%v", out[0].BatteryVoltageV)
+	}
+}

audit/internal/collector/sensors.go

@@ -0,0 +1,373 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"encoding/json"
+	"log/slog"
+	"os/exec"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+type sensorsDoc map[string]map[string]any
+
+func collectSensors() *schema.HardwareSensors {
+	doc, err := readSensorsJSONDoc()
+	if err != nil {
+		slog.Info("sensors: unavailable, skipping", "err", err)
+		return nil
+	}
+	sensors := buildSensorsFromDoc(doc)
+	if sensors == nil || (len(sensors.Fans) == 0 && len(sensors.Power) == 0 && len(sensors.Temperatures) == 0 && len(sensors.Other) == 0) {
+		return nil
+	}
+	slog.Info("sensors: collected",
+		"fans", len(sensors.Fans),
+		"power", len(sensors.Power),
+		"temperatures", len(sensors.Temperatures),
+		"other", len(sensors.Other),
+	)
+	return sensors
+}
+
+func readSensorsJSONDoc() (sensorsDoc, error) {
+	out, err := exec.Command("sensors", "-j").Output()
+	if err != nil {
+		return nil, err
+	}
+	var doc sensorsDoc
+	if err := json.Unmarshal(out, &doc); err != nil {
+		return nil, err
+	}
+	return doc, nil
+}
+
+func buildSensorsFromDoc(doc sensorsDoc) *schema.HardwareSensors {
+	if len(doc) == 0 {
+		return nil
+	}
+	result := &schema.HardwareSensors{}
+	seen := map[string]struct{}{}
+
+	chips := make([]string, 0, len(doc))
+	for chip := range doc {
+		chips = append(chips, chip)
+	}
+	sort.Strings(chips)
+
+	for _, chip := range chips {
+		features := doc[chip]
+		location := sensorLocation(chip)
+
+		keys := make([]string, 0, len(features))
+		for key := range features {
+			keys = append(keys, key)
+		}
+		sort.Strings(keys)
+
+		for _, key := range keys {
+			if strings.EqualFold(key, "Adapter") {
+				continue
+			}
+			feature, ok := features[key].(map[string]any)
+			if !ok {
+				continue
+			}
+			name := strings.TrimSpace(key)
+			if name == "" {
+				continue
+			}
+			switch classifySensorFeature(feature) {
+			case "fan":
+				item := buildFanSensor(name, location, feature)
+				if item == nil || duplicateSensor(seen, "fan", item.Name) {
+					continue
+				}
+				result.Fans = append(result.Fans, *item)
+			case "temp":
+				item := buildTempSensor(name, location, feature)
+				if item == nil || duplicateSensor(seen, "temp", item.Name) {
+					continue
+				}
+				result.Temperatures = append(result.Temperatures, *item)
+			case "power":
+				item := buildPowerSensor(name, location, feature)
+				if item == nil || duplicateSensor(seen, "power", item.Name) {
+					continue
+				}
+				result.Power = append(result.Power, *item)
+			default:
+				item := buildOtherSensor(name, location, feature)
+				if item == nil || duplicateSensor(seen, "other", item.Name) {
+					continue
+				}
+				result.Other = append(result.Other, *item)
+			}
+		}
+	}
+
+	return result
+}
+
+func parseSensorsJSON(raw []byte) (*schema.HardwareSensors, error) {
+	var doc sensorsDoc
+	err := json.Unmarshal(raw, &doc)
+	if err != nil {
+		return nil, err
+	}
+	return buildSensorsFromDoc(doc), nil
+}
+
+func duplicateSensor(seen map[string]struct{}, sensorType, name string) bool {
+	key := sensorType + "\x00" + name
+	if _, ok := seen[key]; ok {
+		return true
+	}
+	seen[key] = struct{}{}
+	return false
+}
+
+func sensorLocation(chip string) *string {
+	chip = strings.TrimSpace(chip)
+	if chip == "" {
+		return nil
+	}
+	return &chip
+}
+
+func classifySensorFeature(feature map[string]any) string {
+	for key := range feature {
+		switch {
+		case strings.Contains(key, "fan") && strings.HasSuffix(key, "_input"):
+			return "fan"
+		case strings.Contains(key, "temp") && strings.HasSuffix(key, "_input"):
+			return "temp"
+		case strings.Contains(key, "power") && (strings.HasSuffix(key, "_input") || strings.HasSuffix(key, "_average")):
+			return "power"
+		case strings.Contains(key, "curr") && strings.HasSuffix(key, "_input"):
+			return "power"
+		case strings.HasPrefix(key, "in") && strings.HasSuffix(key, "_input"):
+			return "power"
+		}
+	}
+	return "other"
+}
+
+func buildFanSensor(name string, location *string, feature map[string]any) *schema.HardwareFanSensor {
+	rpm, ok := firstFeatureInt(feature, "_input")
+	if !ok {
+		return nil
+	}
+	item := &schema.HardwareFanSensor{Name: name, Location: location, RPM: &rpm}
+	if status := sensorStatusFromFeature(feature); status != nil {
+		item.Status = status
+	}
+	return item
+}
+
+func buildTempSensor(name string, location *string, feature map[string]any) *schema.HardwareTemperatureSensor {
+	celsius, ok := firstFeatureFloat(feature, "_input")
+	if !ok {
+		return nil
+	}
+	item := &schema.HardwareTemperatureSensor{Name: name, Location: location, Celsius: &celsius}
+	if warning, ok := firstFeatureFloatWithSuffixes(feature, []string{"_max", "_high"}); ok {
+		item.ThresholdWarningCelsius = &warning
+	}
+	if critical, ok := firstFeatureFloatWithSuffixes(feature, []string{"_crit", "_emergency"}); ok {
+		item.ThresholdCriticalCelsius = &critical
+	}
+	if status := sensorStatusFromFeature(feature); status != nil {
+		item.Status = status
+	} else {
+		item.Status = deriveTemperatureStatus(item.Celsius, item.ThresholdWarningCelsius, item.ThresholdCriticalCelsius)
+	}
+	return item
+}
+
+func buildPowerSensor(name string, location *string, feature map[string]any) *schema.HardwarePowerSensor {
+	item := &schema.HardwarePowerSensor{Name: name, Location: location}
+	if v, ok := firstFeatureFloatWithContains(feature, []string{"power"}); ok {
+		item.PowerW = &v
+	}
+	if v, ok := firstFeatureFloatWithPrefix(feature, "curr"); ok {
+		item.CurrentA = &v
+	}
+	if v, ok := firstFeatureFloatWithPrefix(feature, "in"); ok {
+		item.VoltageV = &v
+	}
+	if item.PowerW == nil && item.CurrentA == nil && item.VoltageV == nil {
+		return nil
+	}
+	if status := sensorStatusFromFeature(feature); status != nil {
+		item.Status = status
+	}
+	return item
+}
+
+func buildOtherSensor(name string, location *string, feature map[string]any) *schema.HardwareOtherSensor {
+	value, unit, ok := firstGenericSensorValue(feature)
+	if !ok {
+		return nil
+	}
+	item := &schema.HardwareOtherSensor{Name: name, Location: location, Value: &value}
+	if unit != "" {
+		item.Unit = &unit
+	}
+	if status := sensorStatusFromFeature(feature); status != nil {
+		item.Status = status
+	}
+	return item
+}
+
+func sensorStatusFromFeature(feature map[string]any) *string {
+	for key, raw := range feature {
+		if !strings.HasSuffix(key, "_alarm") {
+			continue
+		}
+		if number, ok := floatFromAny(raw); ok && number > 0 {
+			status := statusWarning
+			return &status
+		}
+	}
+	return nil
+}
+
+func deriveTemperatureStatus(current, warning, critical *float64) *string {
+	if current == nil {
+		return nil
+	}
+	switch {
+	case critical != nil && *current >= *critical:
+		status := statusCritical
+		return &status
+	case warning != nil && *current >= *warning:
+		status := statusWarning
+		return &status
+	default:
+		status := statusOK
+		return &status
+	}
+}
+
+func firstFeatureInt(feature map[string]any, suffix string) (int, bool) {
+	for key, raw := range feature {
+		if strings.HasSuffix(key, suffix) {
+			if value, ok := floatFromAny(raw); ok {
+				return int(value), true
+			}
+		}
+	}
+	return 0, false
+}
+
+func firstFeatureFloat(feature map[string]any, suffix string) (float64, bool) {
+	return firstFeatureFloatWithSuffixes(feature, []string{suffix})
+}
+
+func firstFeatureFloatWithSuffixes(feature map[string]any, suffixes []string) (float64, bool) {
+	keys := sortedFeatureKeys(feature)
+	for _, key := range keys {
+		for _, suffix := range suffixes {
+			if strings.HasSuffix(key, suffix) {
+				if value, ok := floatFromAny(feature[key]); ok {
+					return value, true
+				}
+			}
+		}
+	}
+	return 0, false
+}
+
+func firstFeatureFloatWithContains(feature map[string]any, parts []string) (float64, bool) {
+	keys := sortedFeatureKeys(feature)
+	for _, key := range keys {
+		matched := true
+		for _, part := range parts {
+			if !strings.Contains(key, part) {
+				matched = false
+				break
+			}
+		}
+		if matched {
+			if value, ok := floatFromAny(feature[key]); ok {
+				return value, true
+			}
+		}
+	}
+	return 0, false
+}
+
+func firstFeatureFloatWithPrefix(feature map[string]any, prefix string) (float64, bool) {
+	keys := sortedFeatureKeys(feature)
+	for _, key := range keys {
+		if strings.HasPrefix(key, prefix) && strings.HasSuffix(key, "_input") {
+			if value, ok := floatFromAny(feature[key]); ok {
+				return value, true
+			}
+		}
+	}
+	return 0, false
+}
+
+func firstGenericSensorValue(feature map[string]any) (float64, string, bool) {
+	keys := sortedFeatureKeys(feature)
+	for _, key := range keys {
+		if strings.HasSuffix(key, "_alarm") {
+			continue
+		}
+		value, ok := floatFromAny(feature[key])
+		if !ok {
+			continue
+		}
+		unit := inferSensorUnit(key)
+		return value, unit, true
+	}
+	return 0, "", false
+}
+
+func inferSensorUnit(key string) string {
+	switch {
+	case strings.Contains(key, "humidity"):
+		return "%"
+	case strings.Contains(key, "intrusion"):
+		return ""
+	default:
+		return ""
+	}
+}
+
+func sortedFeatureKeys(feature map[string]any) []string {
+	keys := make([]string, 0, len(feature))
+	for key := range feature {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func floatFromAny(raw any) (float64, bool) {
+	switch value := raw.(type) {
+	case float64:
+		return value, true
+	case float32:
+		return float64(value), true
+	case int:
+		return float64(value), true
+	case int64:
+		return float64(value), true
+	case json.Number:
+		if f, err := value.Float64(); err == nil {
+			return f, true
+		}
+	case string:
+		if value == "" {
+			return 0, false
+		}
+		if f, err := strconv.ParseFloat(value, 64); err == nil {
+			return f, true
+		}
+	}
+	return 0, false
+}

audit/internal/collector/sensors_test.go

@@ -0,0 +1,54 @@
+package collector
+
+import "testing"
+
+func TestParseSensorsJSON(t *testing.T) {
+	raw := []byte(`{
+  "coretemp-isa-0000": {
+    "Adapter": "ISA adapter",
+    "Package id 0": {
+      "temp1_input": 61.5,
+      "temp1_max": 80.0,
+      "temp1_crit": 95.0
+    },
+    "fan1": {
+      "fan1_input": 4200
+    }
+  },
+  "acpitz-acpi-0": {
+    "Adapter": "ACPI interface",
+    "in0": {
+      "in0_input": 12.06
+    },
+    "curr1": {
+      "curr1_input": 0.64
+    },
+    "power1": {
+      "power1_average": 137.0
+    },
+    "humidity1": {
+      "humidity1_input": 38.5
+    }
+  }
+}`)
+
+	got, err := parseSensorsJSON(raw)
+	if err != nil {
+		t.Fatalf("parseSensorsJSON error: %v", err)
+	}
+	if got == nil {
+		t.Fatal("expected sensors")
+	}
+	if len(got.Temperatures) != 1 || got.Temperatures[0].Celsius == nil || *got.Temperatures[0].Celsius != 61.5 {
+		t.Fatalf("temperatures mismatch: %#v", got.Temperatures)
+	}
+	if len(got.Fans) != 1 || got.Fans[0].RPM == nil || *got.Fans[0].RPM != 4200 {
+		t.Fatalf("fans mismatch: %#v", got.Fans)
+	}
+	if len(got.Power) != 3 {
+		t.Fatalf("power sensors mismatch: %#v", got.Power)
+	}
+	if len(got.Other) != 1 || got.Other[0].Unit == nil || *got.Other[0].Unit != "%" {
+		t.Fatalf("other sensors mismatch: %#v", got.Other)
+	}
+}

audit/internal/collector/storage.go

@@ -26,13 +26,13 @@ func collectStorage() []schema.HardwareStorage {
 
 // lsblkDevice is a minimal lsblk JSON record.
 type lsblkDevice struct {
-	Name     string `json:"name"`
-	Type     string `json:"type"`
-	Size     string `json:"size"`
-	Serial   string `json:"serial"`
-	Model    string `json:"model"`
-	Tran     string `json:"tran"`
-	Hctl     string `json:"hctl"`
+	Name   string `json:"name"`
+	Type   string `json:"type"`
+	Size   string `json:"size"`
+	Serial string `json:"serial"`
+	Model  string `json:"model"`
+	Tran   string `json:"tran"`
+	Hctl   string `json:"hctl"`
 }
 
 type lsblkRoot struct {
@@ -67,14 +67,22 @@ type smartctlInfo struct {
 	SerialNumber string `json:"serial_number"`
 	FirmwareVer  string `json:"firmware_version"`
 	RotationRate int    `json:"rotation_rate"`
+	Temperature  struct {
+		Current int `json:"current"`
+	} `json:"temperature"`
+	SmartStatus struct {
+		Passed bool `json:"passed"`
+	} `json:"smart_status"`
 	UserCapacity struct {
 		Bytes int64 `json:"bytes"`
 	} `json:"user_capacity"`
 	AtaSmartAttributes struct {
 		Table []struct {
-			ID    int    `json:"id"`
-			Name  string `json:"name"`
-			Raw   struct{ Value int64 `json:"value"` } `json:"raw"`
+			ID   int    `json:"id"`
+			Name string `json:"name"`
+			Raw  struct {
+				Value int64 `json:"value"`
+			} `json:"raw"`
 		} `json:"table"`
 	} `json:"ata_smart_attributes"`
 	PowerOnTime struct {
@@ -149,66 +157,101 @@ func enrichWithSmartctl(dev lsblkDevice) schema.HardwareStorage {
 		} else if info.RotationRate > 0 {
 			devType = "HDD"
 		}
+		s.Type = &devType
 
-		// telemetry
-		tel := map[string]any{}
+		if info.Temperature.Current > 0 {
+			t := float64(info.Temperature.Current)
+			s.TemperatureC = &t
+		}
 		if info.PowerOnTime.Hours > 0 {
-			tel["power_on_hours"] = info.PowerOnTime.Hours
+			v := int64(info.PowerOnTime.Hours)
+			s.PowerOnHours = &v
 		}
 		if info.PowerCycleCount > 0 {
-			tel["power_cycles"] = info.PowerCycleCount
+			v := int64(info.PowerCycleCount)
+			s.PowerCycles = &v
 		}
+		reallocated := int64(0)
+		pending := int64(0)
+		uncorrectable := int64(0)
+		lifeRemaining := int64(0)
 		for _, attr := range info.AtaSmartAttributes.Table {
 			switch attr.ID {
 			case 5:
-				tel["reallocated_sectors"] = attr.Raw.Value
+				reallocated = attr.Raw.Value
+				s.ReallocatedSectors = &reallocated
 			case 177:
-				tel["wear_leveling_pct"] = attr.Raw.Value
+				value := float64(attr.Raw.Value)
+				s.LifeUsedPct = &value
 			case 231:
-				tel["life_remaining_pct"] = attr.Raw.Value
+				lifeRemaining = attr.Raw.Value
+				value := float64(attr.Raw.Value)
+				s.LifeRemainingPct = &value
 			case 241:
-				tel["total_lba_written"] = attr.Raw.Value
+				value := attr.Raw.Value
+				s.WrittenBytes = &value
+			case 197:
+				pending = attr.Raw.Value
+				s.CurrentPendingSectors = &pending
+			case 198:
+				uncorrectable = attr.Raw.Value
+				s.OfflineUncorrectable = &uncorrectable
 			}
 		}
-		if len(tel) > 0 {
-			s.Telemetry = tel
+
+		status := storageHealthStatus{
+			overallPassed:        info.SmartStatus.Passed,
+			hasOverall:           true,
+			reallocatedSectors:   reallocated,
+			pendingSectors:       pending,
+			offlineUncorrectable: uncorrectable,
+			lifeRemainingPct:     lifeRemaining,
 		}
+		setStorageHealthStatus(&s, status)
+		return s
 	}
 
 	s.Type = &devType
-	status := "OK"
+	status := statusUnknown
 	s.Status = &status
 	return s
 }
 
 // nvmeSmartLog is the subset of `nvme smart-log -o json` output we care about.
 type nvmeSmartLog struct {
+	CriticalWarning  int   `json:"critical_warning"`
 	PercentageUsed   int   `json:"percentage_used"`
+	AvailableSpare   int   `json:"available_spare"`
+	SpareThreshold   int   `json:"spare_thresh"`
+	Temperature      int64 `json:"temperature"`
 	PowerOnHours     int64 `json:"power_on_hours"`
 	PowerCycles      int64 `json:"power_cycles"`
 	UnsafeShutdowns  int64 `json:"unsafe_shutdowns"`
+	DataUnitsRead    int64 `json:"data_units_read"`
 	DataUnitsWritten int64 `json:"data_units_written"`
 	ControllerBusy   int64 `json:"controller_busy_time"`
+	MediaErrors      int64 `json:"media_errors"`
+	NumErrLogEntries int64 `json:"num_err_log_entries"`
 }
 
 // nvmeIDCtrl is the subset of `nvme id-ctrl -o json` output.
 type nvmeIDCtrl struct {
-	ModelNumber    string `json:"mn"`
-	SerialNumber   string `json:"sn"`
-	FirmwareRev    string `json:"fr"`
-	TotalCapacity  int64  `json:"tnvmcap"`
+	ModelNumber   string `json:"mn"`
+	SerialNumber  string `json:"sn"`
+	FirmwareRev   string `json:"fr"`
+	TotalCapacity int64  `json:"tnvmcap"`
 }
 
 func enrichWithNVMe(dev lsblkDevice) schema.HardwareStorage {
 	present := true
 	devType := "NVMe"
 	iface := "NVMe"
-	status := "OK"
+	status := statusOK
 	s := schema.HardwareStorage{
-		Present:   &present,
-		Type:      &devType,
-		Interface: &iface,
-		Status:    &status,
+		HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+		Present:                 &present,
+		Type:                    &devType,
+		Interface:               &iface,
 	}
 
 	devPath := "/dev/" + dev.Name
@@ -237,30 +280,123 @@ func enrichWithNVMe(dev lsblkDevice) schema.HardwareStorage {
 	if out, err := exec.Command("nvme", "smart-log", devPath, "-o", "json").Output(); err == nil {
 		var log nvmeSmartLog
 		if json.Unmarshal(out, &log) == nil {
-			tel := map[string]any{}
 			if log.PowerOnHours > 0 {
-				tel["power_on_hours"] = log.PowerOnHours
+				s.PowerOnHours = &log.PowerOnHours
 			}
 			if log.PowerCycles > 0 {
-				tel["power_cycles"] = log.PowerCycles
+				s.PowerCycles = &log.PowerCycles
 			}
 			if log.UnsafeShutdowns > 0 {
-				tel["unsafe_shutdowns"] = log.UnsafeShutdowns
+				s.UnsafeShutdowns = &log.UnsafeShutdowns
 			}
 			if log.PercentageUsed > 0 {
-				tel["percentage_used"] = log.PercentageUsed
+				v := float64(log.PercentageUsed)
+				s.LifeUsedPct = &v
+				remaining := 100 - v
+				s.LifeRemainingPct = &remaining
 			}
 			if log.DataUnitsWritten > 0 {
-				tel["data_units_written"] = log.DataUnitsWritten
+				v := nvmeDataUnitsToBytes(log.DataUnitsWritten)
+				s.WrittenBytes = &v
 			}
-			if log.ControllerBusy > 0 {
-				tel["controller_busy_time"] = log.ControllerBusy
+			if log.DataUnitsRead > 0 {
+				v := nvmeDataUnitsToBytes(log.DataUnitsRead)
+				s.ReadBytes = &v
 			}
-			if len(tel) > 0 {
-				s.Telemetry = tel
+			if log.AvailableSpare > 0 {
+				v := float64(log.AvailableSpare)
+				s.AvailableSparePct = &v
 			}
+			if log.MediaErrors > 0 {
+				s.MediaErrors = &log.MediaErrors
+			}
+			if log.NumErrLogEntries > 0 {
+				s.ErrorLogEntries = &log.NumErrLogEntries
+			}
+			if log.Temperature > 0 {
+				v := float64(log.Temperature - 273)
+				s.TemperatureC = &v
+			}
+			setStorageHealthStatus(&s, storageHealthStatus{
+				criticalWarning: log.CriticalWarning,
+				percentageUsed:  int64(log.PercentageUsed),
+				availableSpare:  int64(log.AvailableSpare),
+				spareThreshold:  int64(log.SpareThreshold),
+				unsafeShutdowns: log.UnsafeShutdowns,
+				mediaErrors:     log.MediaErrors,
+				errorLogEntries: log.NumErrLogEntries,
+			})
+			return s
 		}
 	}
 
+	status = statusUnknown
+	s.Status = &status
 	return s
 }
+
+func nvmeDataUnitsToBytes(units int64) int64 {
+	if units <= 0 {
+		return 0
+	}
+	return units * 512000
+}
+
+type storageHealthStatus struct {
+	hasOverall           bool
+	overallPassed        bool
+	reallocatedSectors   int64
+	pendingSectors       int64
+	offlineUncorrectable int64
+	lifeRemainingPct     int64
+	criticalWarning      int
+	percentageUsed       int64
+	availableSpare       int64
+	spareThreshold       int64
+	unsafeShutdowns      int64
+	mediaErrors          int64
+	errorLogEntries      int64
+}
+
+func setStorageHealthStatus(s *schema.HardwareStorage, health storageHealthStatus) {
+	status := statusOK
+	var description *string
+	switch {
+	case health.hasOverall && !health.overallPassed:
+		status = statusCritical
+		description = stringPtr("SMART overall self-assessment failed")
+	case health.criticalWarning > 0:
+		status = statusCritical
+		description = stringPtr("NVMe critical warning is set")
+	case health.pendingSectors > 0 || health.offlineUncorrectable > 0:
+		status = statusCritical
+		description = stringPtr("Pending or offline uncorrectable sectors detected")
+	case health.mediaErrors > 0:
+		status = statusWarning
+		description = stringPtr("Media errors reported")
+	case health.reallocatedSectors > 0:
+		status = statusWarning
+		description = stringPtr("Reallocated sectors detected")
+	case health.errorLogEntries > 0:
+		status = statusWarning
+		description = stringPtr("Device error log contains entries")
+	case health.lifeRemainingPct > 0 && health.lifeRemainingPct <= 10:
+		status = statusWarning
+		description = stringPtr("Life remaining is low")
+	case health.percentageUsed >= 95:
+		status = statusWarning
+		description = stringPtr("Drive wear level is high")
+	case health.availableSpare > 0 && health.spareThreshold > 0 && health.availableSpare <= health.spareThreshold:
+		status = statusWarning
+		description = stringPtr("Available spare is at or below threshold")
+	case health.unsafeShutdowns > 100:
+		status = statusWarning
+		description = stringPtr("Unsafe shutdown count is high")
+	}
+	s.Status = &status
+	s.ErrorDescription = description
+}
+
+func stringPtr(value string) *string {
+	return &value
+}

audit/internal/collector/storage_health_test.go

@@ -0,0 +1,63 @@
+package collector
+
+import (
+	"testing"
+
+	"bee/audit/internal/schema"
+)
+
+func TestSetStorageHealthStatus(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		health storageHealthStatus
+		want   string
+	}{
+		{
+			name:   "smart overall failed",
+			health: storageHealthStatus{hasOverall: true, overallPassed: false},
+			want:   statusCritical,
+		},
+		{
+			name:   "nvme critical warning",
+			health: storageHealthStatus{criticalWarning: 1},
+			want:   statusCritical,
+		},
+		{
+			name:   "pending sectors",
+			health: storageHealthStatus{pendingSectors: 1},
+			want:   statusCritical,
+		},
+		{
+			name:   "media errors warning",
+			health: storageHealthStatus{mediaErrors: 2},
+			want:   statusWarning,
+		},
+		{
+			name:   "reallocated warning",
+			health: storageHealthStatus{reallocatedSectors: 1},
+			want:   statusWarning,
+		},
+		{
+			name:   "life remaining low",
+			health: storageHealthStatus{lifeRemainingPct: 8},
+			want:   statusWarning,
+		},
+		{
+			name:   "healthy",
+			health: storageHealthStatus{},
+			want:   statusOK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var disk schema.HardwareStorage
+			setStorageHealthStatus(&disk, tt.health)
+			if disk.Status == nil || *disk.Status != tt.want {
+				t.Fatalf("status=%v want %q", disk.Status, tt.want)
+			}
+		})
+	}
+}

audit/internal/collector/summary.go

@@ -0,0 +1,114 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"fmt"
+	"time"
+)
+
+func BuildHealthSummary(snap schema.HardwareSnapshot) *schema.HardwareHealthSummary {
+	summary := &schema.HardwareHealthSummary{
+		Status:      statusOK,
+		CollectedAt: time.Now().UTC().Format(time.RFC3339),
+	}
+
+	for _, dimm := range snap.Memory {
+		switch derefString(dimm.Status) {
+		case statusWarning:
+			summary.MemoryWarn++
+			summary.Warnings = append(summary.Warnings, formatMemorySummary(dimm))
+		case statusCritical:
+			summary.MemoryFail++
+			summary.Failures = append(summary.Failures, formatMemorySummary(dimm))
+		case statusEmpty:
+			summary.EmptyDIMMs++
+		}
+	}
+
+	for _, disk := range snap.Storage {
+		switch derefString(disk.Status) {
+		case statusWarning:
+			summary.StorageWarn++
+			summary.Warnings = append(summary.Warnings, formatStorageSummary(disk))
+		case statusCritical:
+			summary.StorageFail++
+			summary.Failures = append(summary.Failures, formatStorageSummary(disk))
+		}
+	}
+
+	for _, dev := range snap.PCIeDevices {
+		switch derefString(dev.Status) {
+		case statusWarning:
+			summary.PCIeWarn++
+			summary.Warnings = append(summary.Warnings, formatPCIeSummary(dev))
+		case statusCritical:
+			summary.PCIeFail++
+			summary.Failures = append(summary.Failures, formatPCIeSummary(dev))
+		}
+	}
+
+	for _, psu := range snap.PowerSupplies {
+		if psu.Present != nil && !*psu.Present {
+			summary.MissingPSUs++
+		}
+		switch derefString(psu.Status) {
+		case statusWarning:
+			summary.PSUWarn++
+			summary.Warnings = append(summary.Warnings, formatPSUSummary(psu))
+		case statusCritical:
+			summary.PSUFail++
+			summary.Failures = append(summary.Failures, formatPSUSummary(psu))
+		}
+	}
+
+	if len(summary.Failures) > 0 || summary.StorageFail > 0 || summary.PCIeFail > 0 || summary.PSUFail > 0 || summary.MemoryFail > 0 {
+		summary.Status = statusCritical
+	} else if len(summary.Warnings) > 0 || summary.StorageWarn > 0 || summary.PCIeWarn > 0 || summary.PSUWarn > 0 || summary.MemoryWarn > 0 {
+		summary.Status = statusWarning
+	}
+
+	if len(summary.Warnings) == 0 {
+		summary.Warnings = nil
+	}
+	if len(summary.Failures) == 0 {
+		summary.Failures = nil
+	}
+
+	return summary
+}
+
+func derefString(value *string) string {
+	if value == nil {
+		return ""
+	}
+	return *value
+}
+
+func preferredName(model, serial, slot *string) string {
+	switch {
+	case model != nil && *model != "":
+		return *model
+	case serial != nil && *serial != "":
+		return *serial
+	case slot != nil && *slot != "":
+		return *slot
+	default:
+		return "unknown"
+	}
+}
+
+func formatStorageSummary(disk schema.HardwareStorage) string {
+	return fmt.Sprintf("storage %s status=%s", preferredName(disk.Model, disk.SerialNumber, disk.Slot), derefString(disk.Status))
+}
+
+func formatPCIeSummary(dev schema.HardwarePCIeDevice) string {
+	return fmt.Sprintf("pcie %s status=%s", preferredName(dev.Model, dev.SerialNumber, dev.BDF), derefString(dev.Status))
+}
+
+func formatPSUSummary(psu schema.HardwarePowerSupply) string {
+	return fmt.Sprintf("psu %s status=%s", preferredName(psu.Model, psu.SerialNumber, psu.Slot), derefString(psu.Status))
+}
+
+func formatMemorySummary(dimm schema.HardwareMemory) string {
+	return fmt.Sprintf("memory %s status=%s", preferredName(dimm.PartNumber, dimm.SerialNumber, dimm.Slot), derefString(dimm.Status))
+}

audit/internal/collector/vroc_test.go

@@ -31,7 +31,7 @@ md125 : active raid1 nvme2n1[0] nvme3n1[1]
 func TestHasVROCController(t *testing.T) {
 	intel := vendorIntel
 	model := "Volume Management Device NVMe RAID Controller"
-	class := "RAID bus controller"
+	class := "MassStorageController"
 	tests := []struct {
 		name string
 		pcie []schema.HardwarePCIeDevice

audit/internal/platform/sat.go

@@ -8,55 +8,236 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"sort"
+	"strconv"
 	"strings"
 	"time"
 )
 
 func (s *System) RunNvidiaAcceptancePack(baseDir string) (string, error) {
+	return runAcceptancePack(baseDir, "gpu-nvidia", nvidiaSATJobs())
+}
+
+func (s *System) RunMemoryAcceptancePack(baseDir string) (string, error) {
+	sizeMB := envInt("BEE_MEMTESTER_SIZE_MB", 128)
+	passes := envInt("BEE_MEMTESTER_PASSES", 1)
+	return runAcceptancePack(baseDir, "memory", []satJob{
+		{name: "01-free-before.log", cmd: []string{"free", "-h"}},
+		{name: "02-memtester.log", cmd: []string{"memtester", fmt.Sprintf("%dM", sizeMB), fmt.Sprintf("%d", passes)}},
+		{name: "03-free-after.log", cmd: []string{"free", "-h"}},
+	})
+}
+
+func (s *System) RunStorageAcceptancePack(baseDir string) (string, error) {
 	if baseDir == "" {
 		baseDir = "/var/log/bee-sat"
 	}
 	ts := time.Now().UTC().Format("20060102-150405")
-	runDir := filepath.Join(baseDir, "gpu-nvidia-"+ts)
+	runDir := filepath.Join(baseDir, "storage-"+ts)
 	if err := os.MkdirAll(runDir, 0755); err != nil {
 		return "", err
 	}
 
-	type job struct {
-		name string
-		cmd  []string
-	}
-	jobs := []job{
-		{name: "01-nvidia-smi-q.log", cmd: []string{"nvidia-smi", "-q"}},
-		{name: "02-dmidecode-baseboard.log", cmd: []string{"dmidecode", "-t", "baseboard"}},
-		{name: "03-dmidecode-system.log", cmd: []string{"dmidecode", "-t", "system"}},
-		{name: "04-nvidia-bug-report.log", cmd: []string{"nvidia-bug-report.sh", "--output", filepath.Join(runDir, "nvidia-bug-report.log")}},
+	devices, err := listStorageDevices()
+	if err != nil {
+		return "", err
 	}
+	sort.Strings(devices)
 
 	var summary strings.Builder
+	stats := satStats{}
 	fmt.Fprintf(&summary, "run_at_utc=%s\n", time.Now().UTC().Format(time.RFC3339))
-	for _, job := range jobs {
-		out, err := exec.Command(job.cmd[0], job.cmd[1:]...).CombinedOutput()
-		if writeErr := os.WriteFile(filepath.Join(runDir, job.name), out, 0644); writeErr != nil {
-			return "", writeErr
-		}
-		rc := 0
-		if err != nil {
-			rc = 1
-		}
-		fmt.Fprintf(&summary, "%s_rc=%d\n", strings.TrimSuffix(strings.TrimPrefix(job.name, "0"), ".log"), rc)
+	if len(devices) == 0 {
+		fmt.Fprintln(&summary, "devices=0")
+		stats.Unsupported++
+	} else {
+		fmt.Fprintf(&summary, "devices=%d\n", len(devices))
 	}
+
+	for index, devPath := range devices {
+		prefix := fmt.Sprintf("%02d-%s", index+1, filepath.Base(devPath))
+		commands := storageSATCommands(devPath)
+		for cmdIndex, job := range commands {
+			name := fmt.Sprintf("%s-%02d-%s.log", prefix, cmdIndex+1, job.name)
+			out, err := exec.Command(job.cmd[0], job.cmd[1:]...).CombinedOutput()
+			if writeErr := os.WriteFile(filepath.Join(runDir, name), out, 0644); writeErr != nil {
+				return "", writeErr
+			}
+			status, rc := classifySATResult(job.name, out, err)
+			stats.Add(status)
+			key := filepath.Base(devPath) + "_" + strings.ReplaceAll(job.name, "-", "_")
+			fmt.Fprintf(&summary, "%s_rc=%d\n", key, rc)
+			fmt.Fprintf(&summary, "%s_status=%s\n", key, status)
+		}
+	}
+
+	writeSATStats(&summary, stats)
 	if err := os.WriteFile(filepath.Join(runDir, "summary.txt"), []byte(summary.String()), 0644); err != nil {
 		return "", err
 	}
-
-	archive := filepath.Join(baseDir, "gpu-nvidia-"+ts+".tar.gz")
+	archive := filepath.Join(baseDir, "storage-"+ts+".tar.gz")
 	if err := createTarGz(archive, runDir); err != nil {
 		return "", err
 	}
 	return archive, nil
 }
 
+type satJob struct {
+	name string
+	cmd  []string
+}
+
+type satStats struct {
+	OK          int
+	Failed      int
+	Unsupported int
+}
+
+func nvidiaSATJobs() []satJob {
+	seconds := envInt("BEE_GPU_STRESS_SECONDS", 5)
+	sizeMB := envInt("BEE_GPU_STRESS_SIZE_MB", 64)
+	return []satJob{
+		{name: "01-nvidia-smi-q.log", cmd: []string{"nvidia-smi", "-q"}},
+		{name: "02-dmidecode-baseboard.log", cmd: []string{"dmidecode", "-t", "baseboard"}},
+		{name: "03-dmidecode-system.log", cmd: []string{"dmidecode", "-t", "system"}},
+		{name: "04-nvidia-bug-report.log", cmd: []string{"nvidia-bug-report.sh", "--output", "{{run_dir}}/nvidia-bug-report.log"}},
+		{name: "05-bee-gpu-stress.log", cmd: []string{"bee-gpu-stress", "--seconds", fmt.Sprintf("%d", seconds), "--size-mb", fmt.Sprintf("%d", sizeMB)}},
+	}
+}
+
+func runAcceptancePack(baseDir, prefix string, jobs []satJob) (string, error) {
+	if baseDir == "" {
+		baseDir = "/var/log/bee-sat"
+	}
+	ts := time.Now().UTC().Format("20060102-150405")
+	runDir := filepath.Join(baseDir, prefix+"-"+ts)
+	if err := os.MkdirAll(runDir, 0755); err != nil {
+		return "", err
+	}
+
+	var summary strings.Builder
+	stats := satStats{}
+	fmt.Fprintf(&summary, "run_at_utc=%s\n", time.Now().UTC().Format(time.RFC3339))
+	for _, job := range jobs {
+		cmd := make([]string, 0, len(job.cmd))
+		for _, arg := range job.cmd {
+			cmd = append(cmd, strings.ReplaceAll(arg, "{{run_dir}}", runDir))
+		}
+		out, err := exec.Command(cmd[0], cmd[1:]...).CombinedOutput()
+		if writeErr := os.WriteFile(filepath.Join(runDir, job.name), out, 0644); writeErr != nil {
+			return "", writeErr
+		}
+		status, rc := classifySATResult(job.name, out, err)
+		stats.Add(status)
+		key := strings.TrimSuffix(strings.TrimPrefix(job.name, "0"), ".log")
+		fmt.Fprintf(&summary, "%s_rc=%d\n", key, rc)
+		fmt.Fprintf(&summary, "%s_status=%s\n", key, status)
+	}
+	writeSATStats(&summary, stats)
+	if err := os.WriteFile(filepath.Join(runDir, "summary.txt"), []byte(summary.String()), 0644); err != nil {
+		return "", err
+	}
+
+	archive := filepath.Join(baseDir, prefix+"-"+ts+".tar.gz")
+	if err := createTarGz(archive, runDir); err != nil {
+		return "", err
+	}
+	return archive, nil
+}
+
+func listStorageDevices() ([]string, error) {
+	out, err := exec.Command("lsblk", "-dn", "-o", "NAME,TYPE").Output()
+	if err != nil {
+		return nil, err
+	}
+	var devices []string
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		fields := strings.Fields(strings.TrimSpace(line))
+		if len(fields) != 2 || fields[1] != "disk" {
+			continue
+		}
+		devices = append(devices, "/dev/"+fields[0])
+	}
+	return devices, nil
+}
+
+func storageSATCommands(devPath string) []satJob {
+	if strings.Contains(filepath.Base(devPath), "nvme") {
+		return []satJob{
+			{name: "nvme-id-ctrl", cmd: []string{"nvme", "id-ctrl", devPath, "-o", "json"}},
+			{name: "nvme-smart-log", cmd: []string{"nvme", "smart-log", devPath, "-o", "json"}},
+			{name: "nvme-device-self-test", cmd: []string{"nvme", "device-self-test", devPath, "--start", "1"}},
+		}
+	}
+	return []satJob{
+		{name: "smartctl-health", cmd: []string{"smartctl", "-H", "-A", devPath}},
+		{name: "smartctl-self-test-short", cmd: []string{"smartctl", "-t", "short", devPath}},
+	}
+}
+
+func (s *satStats) Add(status string) {
+	switch status {
+	case "OK":
+		s.OK++
+	case "UNSUPPORTED":
+		s.Unsupported++
+	default:
+		s.Failed++
+	}
+}
+
+func (s satStats) Overall() string {
+	if s.Failed > 0 {
+		return "FAILED"
+	}
+	if s.Unsupported > 0 {
+		return "PARTIAL"
+	}
+	return "OK"
+}
+
+func writeSATStats(summary *strings.Builder, stats satStats) {
+	fmt.Fprintf(summary, "overall_status=%s\n", stats.Overall())
+	fmt.Fprintf(summary, "job_ok=%d\n", stats.OK)
+	fmt.Fprintf(summary, "job_failed=%d\n", stats.Failed)
+	fmt.Fprintf(summary, "job_unsupported=%d\n", stats.Unsupported)
+}
+
+func classifySATResult(name string, out []byte, err error) (string, int) {
+	rc := 0
+	if err != nil {
+		rc = 1
+	}
+	if err == nil {
+		return "OK", rc
+	}
+
+	text := strings.ToLower(string(out))
+	if strings.Contains(text, "unsupported") ||
+		strings.Contains(text, "not supported") ||
+		strings.Contains(text, "invalid opcode") ||
+		strings.Contains(text, "unknown command") ||
+		strings.Contains(text, "not implemented") ||
+		strings.Contains(text, "not available") ||
+		strings.Contains(text, "no such device") ||
+		(strings.Contains(name, "self-test") && strings.Contains(text, "aborted")) {
+		return "UNSUPPORTED", rc
+	}
+	return "FAILED", rc
+}
+
+func envInt(name string, fallback int) int {
+	raw := strings.TrimSpace(os.Getenv(name))
+	if raw == "" {
+		return fallback
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil || value <= 0 {
+		return fallback
+	}
+	return value
+}
+
 func createTarGz(dst, srcDir string) error {
 	file, err := os.Create(dst)
 	if err != nil {

audit/internal/platform/sat_test.go

@@ -0,0 +1,89 @@
+package platform
+
+import (
+	"errors"
+	"os"
+	"testing"
+)
+
+func TestStorageSATCommands(t *testing.T) {
+	t.Parallel()
+
+	nvme := storageSATCommands("/dev/nvme0n1")
+	if len(nvme) != 3 || nvme[2].cmd[0] != "nvme" {
+		t.Fatalf("unexpected nvme commands: %#v", nvme)
+	}
+
+	sata := storageSATCommands("/dev/sda")
+	if len(sata) != 2 || sata[0].cmd[0] != "smartctl" {
+		t.Fatalf("unexpected sata commands: %#v", sata)
+	}
+}
+
+func TestRunNvidiaAcceptancePackIncludesGPUStress(t *testing.T) {
+	t.Parallel()
+
+	jobs := nvidiaSATJobs()
+
+	if len(jobs) != 5 {
+		t.Fatalf("jobs=%d want 5", len(jobs))
+	}
+	if got := jobs[4].cmd[0]; got != "bee-gpu-stress" {
+		t.Fatalf("gpu stress command=%q want bee-gpu-stress", got)
+	}
+}
+
+func TestNvidiaSATJobsUseEnvOverrides(t *testing.T) {
+	t.Setenv("BEE_GPU_STRESS_SECONDS", "9")
+	t.Setenv("BEE_GPU_STRESS_SIZE_MB", "96")
+
+	jobs := nvidiaSATJobs()
+	got := jobs[4].cmd
+	want := []string{"bee-gpu-stress", "--seconds", "9", "--size-mb", "96"}
+	if len(got) != len(want) {
+		t.Fatalf("cmd len=%d want %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("cmd[%d]=%q want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestEnvIntFallback(t *testing.T) {
+	os.Unsetenv("BEE_MEMTESTER_SIZE_MB")
+	if got := envInt("BEE_MEMTESTER_SIZE_MB", 123); got != 123 {
+		t.Fatalf("got %d want 123", got)
+	}
+	t.Setenv("BEE_MEMTESTER_SIZE_MB", "bad")
+	if got := envInt("BEE_MEMTESTER_SIZE_MB", 123); got != 123 {
+		t.Fatalf("got %d want 123", got)
+	}
+	t.Setenv("BEE_MEMTESTER_SIZE_MB", "256")
+	if got := envInt("BEE_MEMTESTER_SIZE_MB", 123); got != 256 {
+		t.Fatalf("got %d want 256", got)
+	}
+}
+
+func TestClassifySATResult(t *testing.T) {
+	tests := []struct {
+		name   string
+		job    string
+		out    string
+		err    error
+		status string
+	}{
+		{name: "ok", job: "memtester", out: "done", err: nil, status: "OK"},
+		{name: "unsupported", job: "smartctl-self-test-short", out: "Self-test not supported", err: errors.New("rc 1"), status: "UNSUPPORTED"},
+		{name: "failed", job: "bee-gpu-stress", out: "cuda error", err: errors.New("rc 1"), status: "FAILED"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, _ := classifySATResult(tt.job, []byte(tt.out), tt.err)
+			if got != tt.status {
+				t.Fatalf("status=%q want %q", got, tt.status)
+			}
+		})
+	}
+}

audit/internal/schema/hardware.go

@@ -5,10 +5,10 @@ package schema
 // HardwareIngestRequest is the top-level output document produced by `bee audit`.
 // It is accepted as-is by the core /api/ingest/hardware endpoint.
 type HardwareIngestRequest struct {
-	Filename    *string          `json:"filename"`
-	SourceType  *string          `json:"source_type"`
-	Protocol    *string          `json:"protocol"`
-	TargetHost  string           `json:"target_host"`
+	Filename    *string          `json:"filename,omitempty"`
+	SourceType  *string          `json:"source_type,omitempty"`
+	Protocol    *string          `json:"protocol,omitempty"`
+	TargetHost  *string          `json:"target_host,omitempty"`
 	CollectedAt string           `json:"collected_at"`
 	Hardware    HardwareSnapshot `json:"hardware"`
 }
@@ -21,14 +21,32 @@ type HardwareSnapshot struct {
 	Storage       []HardwareStorage        `json:"storage,omitempty"`
 	PCIeDevices   []HardwarePCIeDevice     `json:"pcie_devices,omitempty"`
 	PowerSupplies []HardwarePowerSupply    `json:"power_supplies,omitempty"`
+	Sensors       *HardwareSensors         `json:"sensors,omitempty"`
+}
+
+type HardwareHealthSummary struct {
+	Status      string   `json:"status"`
+	Warnings    []string `json:"warnings,omitempty"`
+	Failures    []string `json:"failures,omitempty"`
+	StorageWarn int      `json:"storage_warn,omitempty"`
+	StorageFail int      `json:"storage_fail,omitempty"`
+	PCIeWarn    int      `json:"pcie_warn,omitempty"`
+	PCIeFail    int      `json:"pcie_fail,omitempty"`
+	PSUWarn     int      `json:"psu_warn,omitempty"`
+	PSUFail     int      `json:"psu_fail,omitempty"`
+	MemoryWarn  int      `json:"memory_warn,omitempty"`
+	MemoryFail  int      `json:"memory_fail,omitempty"`
+	EmptyDIMMs  int      `json:"empty_dimms,omitempty"`
+	MissingPSUs int      `json:"missing_psus,omitempty"`
+	CollectedAt string   `json:"collected_at,omitempty"`
 }
 
 type HardwareBoard struct {
-	Manufacturer *string `json:"manufacturer"`
-	ProductName  *string `json:"product_name"`
+	Manufacturer *string `json:"manufacturer,omitempty"`
+	ProductName  *string `json:"product_name,omitempty"`
 	SerialNumber string  `json:"serial_number"`
-	PartNumber   *string `json:"part_number"`
-	UUID         *string `json:"uuid"`
+	PartNumber   *string `json:"part_number,omitempty"`
+	UUID         *string `json:"uuid,omitempty"`
 }
 
 type HardwareFirmwareRecord struct {
@@ -37,77 +55,183 @@ type HardwareFirmwareRecord struct {
 }
 
 type HardwareCPU struct {
-	Socket          *int    `json:"socket"`
-	Model           *string `json:"model"`
-	Manufacturer    *string `json:"manufacturer"`
-	Status          *string `json:"status"`
-	SerialNumber    *string `json:"serial_number"`
-	Firmware        *string `json:"firmware"`
-	Cores           *int    `json:"cores"`
-	Threads         *int    `json:"threads"`
-	FrequencyMHz    *int    `json:"frequency_mhz"`
-	MaxFrequencyMHz *int    `json:"max_frequency_mhz"`
+	HardwareComponentStatus
+	Socket                  *int     `json:"socket,omitempty"`
+	Model                   *string  `json:"model,omitempty"`
+	Manufacturer            *string  `json:"manufacturer,omitempty"`
+	SerialNumber            *string  `json:"serial_number,omitempty"`
+	Firmware                *string  `json:"firmware,omitempty"`
+	Cores                   *int     `json:"cores,omitempty"`
+	Threads                 *int     `json:"threads,omitempty"`
+	FrequencyMHz            *int     `json:"frequency_mhz,omitempty"`
+	MaxFrequencyMHz         *int     `json:"max_frequency_mhz,omitempty"`
+	TemperatureC            *float64 `json:"temperature_c,omitempty"`
+	PowerW                  *float64 `json:"power_w,omitempty"`
+	Throttled               *bool    `json:"throttled,omitempty"`
+	CorrectableErrorCount   *int64   `json:"correctable_error_count,omitempty"`
+	UncorrectableErrorCount *int64   `json:"uncorrectable_error_count,omitempty"`
+	LifeRemainingPct        *float64 `json:"life_remaining_pct,omitempty"`
+	LifeUsedPct             *float64 `json:"life_used_pct,omitempty"`
+	Present                 *bool    `json:"present,omitempty"`
 }
 
 type HardwareMemory struct {
-	Slot            *string `json:"slot"`
-	Location        *string `json:"location"`
-	Present         *bool   `json:"present"`
-	SizeMB          *int    `json:"size_mb"`
-	Type            *string `json:"type"`
-	MaxSpeedMHz     *int    `json:"max_speed_mhz"`
-	CurrentSpeedMHz *int    `json:"current_speed_mhz"`
-	Manufacturer    *string `json:"manufacturer"`
-	SerialNumber    *string `json:"serial_number"`
-	PartNumber      *string `json:"part_number"`
-	Status          *string `json:"status"`
+	HardwareComponentStatus
+	Slot                       *string  `json:"slot,omitempty"`
+	Location                   *string  `json:"location,omitempty"`
+	Present                    *bool    `json:"present,omitempty"`
+	SizeMB                     *int     `json:"size_mb,omitempty"`
+	Type                       *string  `json:"type,omitempty"`
+	MaxSpeedMHz                *int     `json:"max_speed_mhz,omitempty"`
+	CurrentSpeedMHz            *int     `json:"current_speed_mhz,omitempty"`
+	Manufacturer               *string  `json:"manufacturer,omitempty"`
+	SerialNumber               *string  `json:"serial_number,omitempty"`
+	PartNumber                 *string  `json:"part_number,omitempty"`
+	TemperatureC               *float64 `json:"temperature_c,omitempty"`
+	CorrectableECCErrorCount   *int64   `json:"correctable_ecc_error_count,omitempty"`
+	UncorrectableECCErrorCount *int64   `json:"uncorrectable_ecc_error_count,omitempty"`
+	LifeRemainingPct           *float64 `json:"life_remaining_pct,omitempty"`
+	LifeUsedPct                *float64 `json:"life_used_pct,omitempty"`
+	SpareBlocksRemainingPct    *float64 `json:"spare_blocks_remaining_pct,omitempty"`
+	PerformanceDegraded        *bool    `json:"performance_degraded,omitempty"`
+	DataLossDetected           *bool    `json:"data_loss_detected,omitempty"`
 }
 
 type HardwareStorage struct {
-	Slot         *string        `json:"slot"`
-	Type         *string        `json:"type"`
-	Model        *string        `json:"model"`
-	SizeGB       *int           `json:"size_gb"`
-	SerialNumber *string        `json:"serial_number"`
-	Manufacturer *string        `json:"manufacturer"`
-	Firmware     *string        `json:"firmware"`
-	Interface    *string        `json:"interface"`
-	Present      *bool          `json:"present"`
-	Status       *string        `json:"status"`
-	Telemetry    map[string]any `json:"telemetry,omitempty"`
+	HardwareComponentStatus
+	Slot                  *string        `json:"slot,omitempty"`
+	Type                  *string        `json:"type,omitempty"`
+	Model                 *string        `json:"model,omitempty"`
+	SizeGB                *int           `json:"size_gb,omitempty"`
+	SerialNumber          *string        `json:"serial_number,omitempty"`
+	Manufacturer          *string        `json:"manufacturer,omitempty"`
+	Firmware              *string        `json:"firmware,omitempty"`
+	Interface             *string        `json:"interface,omitempty"`
+	Present               *bool          `json:"present,omitempty"`
+	TemperatureC          *float64       `json:"temperature_c,omitempty"`
+	PowerOnHours          *int64         `json:"power_on_hours,omitempty"`
+	PowerCycles           *int64         `json:"power_cycles,omitempty"`
+	UnsafeShutdowns       *int64         `json:"unsafe_shutdowns,omitempty"`
+	MediaErrors           *int64         `json:"media_errors,omitempty"`
+	ErrorLogEntries       *int64         `json:"error_log_entries,omitempty"`
+	WrittenBytes          *int64         `json:"written_bytes,omitempty"`
+	ReadBytes             *int64         `json:"read_bytes,omitempty"`
+	LifeUsedPct           *float64       `json:"life_used_pct,omitempty"`
+	LifeRemainingPct      *float64       `json:"life_remaining_pct,omitempty"`
+	AvailableSparePct     *float64       `json:"available_spare_pct,omitempty"`
+	ReallocatedSectors    *int64         `json:"reallocated_sectors,omitempty"`
+	CurrentPendingSectors *int64         `json:"current_pending_sectors,omitempty"`
+	OfflineUncorrectable  *int64         `json:"offline_uncorrectable,omitempty"`
+	Telemetry             map[string]any `json:"-"`
 }
 
 type HardwarePCIeDevice struct {
-	Slot         *string        `json:"slot"`
-	VendorID     *int           `json:"vendor_id"`
-	DeviceID     *int           `json:"device_id"`
-	BDF          *string        `json:"bdf"`
-	DeviceClass  *string        `json:"device_class"`
-	Manufacturer *string        `json:"manufacturer"`
-	Model        *string        `json:"model"`
-	LinkWidth    *int           `json:"link_width"`
-	LinkSpeed    *string        `json:"link_speed"`
-	MaxLinkWidth *int           `json:"max_link_width"`
-	MaxLinkSpeed *string        `json:"max_link_speed"`
-	SerialNumber *string        `json:"serial_number"`
-	Firmware     *string        `json:"firmware"`
-	Present      *bool          `json:"present"`
-	Status       *string        `json:"status"`
-	Telemetry    map[string]any `json:"telemetry,omitempty"`
+	HardwareComponentStatus
+	Slot                   *string        `json:"slot,omitempty"`
+	VendorID               *int           `json:"vendor_id,omitempty"`
+	DeviceID               *int           `json:"device_id,omitempty"`
+	NUMANode               *int           `json:"numa_node,omitempty"`
+	TemperatureC           *float64       `json:"temperature_c,omitempty"`
+	PowerW                 *float64       `json:"power_w,omitempty"`
+	LifeRemainingPct       *float64       `json:"life_remaining_pct,omitempty"`
+	LifeUsedPct            *float64       `json:"life_used_pct,omitempty"`
+	ECCCorrectedTotal      *int64         `json:"ecc_corrected_total,omitempty"`
+	ECCUncorrectedTotal    *int64         `json:"ecc_uncorrected_total,omitempty"`
+	HWSlowdown             *bool          `json:"hw_slowdown,omitempty"`
+	BatteryChargePct       *float64       `json:"battery_charge_pct,omitempty"`
+	BatteryHealthPct       *float64       `json:"battery_health_pct,omitempty"`
+	BatteryTemperatureC    *float64       `json:"battery_temperature_c,omitempty"`
+	BatteryVoltageV        *float64       `json:"battery_voltage_v,omitempty"`
+	BatteryReplaceRequired *bool          `json:"battery_replace_required,omitempty"`
+	SFPTemperatureC        *float64       `json:"sfp_temperature_c,omitempty"`
+	SFPTXPowerDBM          *float64       `json:"sfp_tx_power_dbm,omitempty"`
+	SFPRXPowerDBM          *float64       `json:"sfp_rx_power_dbm,omitempty"`
+	SFPVoltageV            *float64       `json:"sfp_voltage_v,omitempty"`
+	SFPBiasMA              *float64       `json:"sfp_bias_ma,omitempty"`
+	BDF                    *string        `json:"bdf,omitempty"`
+	DeviceClass            *string        `json:"device_class,omitempty"`
+	Manufacturer           *string        `json:"manufacturer,omitempty"`
+	Model                  *string        `json:"model,omitempty"`
+	LinkWidth              *int           `json:"link_width,omitempty"`
+	LinkSpeed              *string        `json:"link_speed,omitempty"`
+	MaxLinkWidth           *int           `json:"max_link_width,omitempty"`
+	MaxLinkSpeed           *string        `json:"max_link_speed,omitempty"`
+	SerialNumber           *string        `json:"serial_number,omitempty"`
+	Firmware               *string        `json:"firmware,omitempty"`
+	MacAddresses           []string       `json:"mac_addresses,omitempty"`
+	Present                *bool          `json:"present,omitempty"`
+	Telemetry              map[string]any `json:"-"`
 }
 
 type HardwarePowerSupply struct {
-	Slot         *string  `json:"slot"`
-	Present      *bool    `json:"present"`
-	Model        *string  `json:"model"`
-	Vendor       *string  `json:"vendor"`
-	WattageW     *int     `json:"wattage_w"`
-	SerialNumber *string  `json:"serial_number"`
-	PartNumber   *string  `json:"part_number"`
-	Firmware     *string  `json:"firmware"`
-	Status       *string  `json:"status"`
-	InputType    *string  `json:"input_type"`
-	InputPowerW  *float64 `json:"input_power_w"`
-	OutputPowerW *float64 `json:"output_power_w"`
-	InputVoltage *float64 `json:"input_voltage"`
+	HardwareComponentStatus
+	Slot             *string  `json:"slot,omitempty"`
+	Present          *bool    `json:"present,omitempty"`
+	Model            *string  `json:"model,omitempty"`
+	Vendor           *string  `json:"vendor,omitempty"`
+	WattageW         *int     `json:"wattage_w,omitempty"`
+	SerialNumber     *string  `json:"serial_number,omitempty"`
+	PartNumber       *string  `json:"part_number,omitempty"`
+	Firmware         *string  `json:"firmware,omitempty"`
+	InputType        *string  `json:"input_type,omitempty"`
+	InputPowerW      *float64 `json:"input_power_w,omitempty"`
+	OutputPowerW     *float64 `json:"output_power_w,omitempty"`
+	InputVoltage     *float64 `json:"input_voltage,omitempty"`
+	TemperatureC     *float64 `json:"temperature_c,omitempty"`
+	LifeRemainingPct *float64 `json:"life_remaining_pct,omitempty"`
+	LifeUsedPct      *float64 `json:"life_used_pct,omitempty"`
+}
+
+type HardwareComponentStatus struct {
+	Status           *string                 `json:"status,omitempty"`
+	StatusCheckedAt  *string                 `json:"status_checked_at,omitempty"`
+	StatusChangedAt  *string                 `json:"status_changed_at,omitempty"`
+	StatusHistory    []HardwareStatusHistory `json:"status_history,omitempty"`
+	ErrorDescription *string                 `json:"error_description,omitempty"`
+}
+
+type HardwareStatusHistory struct {
+	Status    string  `json:"status"`
+	ChangedAt string  `json:"changed_at"`
+	Details   *string `json:"details,omitempty"`
+}
+
+type HardwareSensors struct {
+	Fans         []HardwareFanSensor         `json:"fans,omitempty"`
+	Power        []HardwarePowerSensor       `json:"power,omitempty"`
+	Temperatures []HardwareTemperatureSensor `json:"temperatures,omitempty"`
+	Other        []HardwareOtherSensor       `json:"other,omitempty"`
+}
+
+type HardwareFanSensor struct {
+	Name     string  `json:"name"`
+	Location *string `json:"location,omitempty"`
+	RPM      *int    `json:"rpm,omitempty"`
+	Status   *string `json:"status,omitempty"`
+}
+
+type HardwarePowerSensor struct {
+	Name     string   `json:"name"`
+	Location *string  `json:"location,omitempty"`
+	VoltageV *float64 `json:"voltage_v,omitempty"`
+	CurrentA *float64 `json:"current_a,omitempty"`
+	PowerW   *float64 `json:"power_w,omitempty"`
+	Status   *string  `json:"status,omitempty"`
+}
+
+type HardwareTemperatureSensor struct {
+	Name                     string   `json:"name"`
+	Location                 *string  `json:"location,omitempty"`
+	Celsius                  *float64 `json:"celsius,omitempty"`
+	ThresholdWarningCelsius  *float64 `json:"threshold_warning_celsius,omitempty"`
+	ThresholdCriticalCelsius *float64 `json:"threshold_critical_celsius,omitempty"`
+	Status                   *string  `json:"status,omitempty"`
+}
+
+type HardwareOtherSensor struct {
+	Name     string   `json:"name"`
+	Location *string  `json:"location,omitempty"`
+	Value    *float64 `json:"value,omitempty"`
+	Unit     *string  `json:"unit,omitempty"`
+	Status   *string  `json:"status,omitempty"`
 }

audit/internal/tui/forms.go

@@ -29,6 +29,7 @@ func (m model) updateStaticForm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 			m.formFields[3].Value,
 		})
 		m.busy = true
+		m.busyTitle = "Static IPv4: " + m.selectedIface
 		return m, func() tea.Msg {
 			result, err := m.app.SetStaticIPv4Result(cfg)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
@@ -59,26 +60,42 @@ func (m model) updateConfirm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	case "esc":
 		m.screen = m.confirmCancelTarget()
 		m.cursor = 0
+		m.pendingAction = actionNone
 		return m, nil
 	case "enter":
 		if m.cursor == 1 {
 			m.screen = m.confirmCancelTarget()
 			m.cursor = 0
+			m.pendingAction = actionNone
 			return m, nil
 		}
 		m.busy = true
 		switch m.pendingAction {
 		case actionExportAudit:
+			m.busyTitle = "Export audit"
 			target := *m.selectedTarget
 			return m, func() tea.Msg {
 				result, err := m.app.ExportLatestAuditResult(target)
 				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenMain}
 			}
 		case actionRunNvidiaSAT:
+			m.busyTitle = "NVIDIA SAT"
 			return m, func() tea.Msg {
 				result, err := m.app.RunNvidiaAcceptancePackResult("")
 				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
 			}
+		case actionRunMemorySAT:
+			m.busyTitle = "Memory SAT"
+			return m, func() tea.Msg {
+				result, err := m.app.RunMemoryAcceptancePackResult("")
+				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
+			}
+		case actionRunStorageSAT:
+			m.busyTitle = "Storage SAT"
+			return m, func() tea.Msg {
+				result, err := m.app.RunStorageAcceptancePackResult("")
+				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
+			}
 		}
 	case "ctrl+c":
 		return m, tea.Quit
@@ -91,6 +108,10 @@ func (m model) confirmCancelTarget() screen {
 	case actionExportAudit:
 		return screenExportTargets
 	case actionRunNvidiaSAT:
+		fallthrough
+	case actionRunMemorySAT:
+		fallthrough
+	case actionRunStorageSAT:
 		return screenAcceptance
 	default:
 		return screenMain

audit/internal/tui/messages.go

@@ -23,3 +23,7 @@ type exportTargetsMsg struct {
 	targets []platform.RemovableTarget
 	err     error
 }
+
+type bannerMsg struct {
+	text string
+}

audit/internal/tui/screen_acceptance.go

@@ -3,12 +3,19 @@ package tui
 import tea "github.com/charmbracelet/bubbletea"
 
 func (m model) handleAcceptanceMenu() (tea.Model, tea.Cmd) {
-	if m.cursor == 1 {
+	if m.cursor == 3 {
 		m.screen = screenMain
 		m.cursor = 0
 		return m, nil
 	}
-	m.pendingAction = actionRunNvidiaSAT
+	switch m.cursor {
+	case 0:
+		m.pendingAction = actionRunNvidiaSAT
+	case 1:
+		m.pendingAction = actionRunMemorySAT
+	case 2:
+		m.pendingAction = actionRunStorageSAT
+	}
 	m.screen = screenConfirm
 	return m, nil
 }

audit/internal/tui/screen_main.go

@@ -12,6 +12,7 @@ func (m model) handleMainMenu() (tea.Model, tea.Cmd) {
 		return m, nil
 	case 1:
 		m.busy = true
+		m.busyTitle = "Services"
 		return m, func() tea.Msg {
 			services, err := m.app.ListBeeServices()
 			return servicesMsg{services: services, err: err}
@@ -22,29 +23,40 @@ func (m model) handleMainMenu() (tea.Model, tea.Cmd) {
 		return m, nil
 	case 3:
 		m.busy = true
+		m.busyTitle = "Run audit"
 		return m, func() tea.Msg {
 			result, err := m.app.RunAuditNow(m.runtimeMode)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenMain}
 		}
 	case 4:
 		m.busy = true
+		m.busyTitle = "Export audit"
 		return m, func() tea.Msg {
 			targets, err := m.app.ListRemovableTargets()
 			return exportTargetsMsg{targets: targets, err: err}
 		}
 	case 5:
 		m.busy = true
+		m.busyTitle = "Required tools"
 		return m, func() tea.Msg {
-			result := m.app.ToolCheckResult([]string{"dmidecode", "smartctl", "nvme", "ipmitool", "lspci", "bee", "nvidia-smi", "dhclient", "lsblk", "mount"})
+			result := m.app.ToolCheckResult([]string{"dmidecode", "smartctl", "nvme", "ipmitool", "lspci", "ethtool", "bee", "nvidia-smi", "bee-gpu-stress", "memtester", "dhclient", "lsblk", "mount"})
 			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
 		}
 	case 6:
 		m.busy = true
+		m.busyTitle = "Health summary"
+		return m, func() tea.Msg {
+			result := m.app.HealthSummaryResult()
+			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
+		}
+	case 7:
+		m.busy = true
+		m.busyTitle = "Audit logs"
 		return m, func() tea.Msg {
 			result := m.app.AuditLogTailResult()
 			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
 		}
-	case 7:
+	case 8:
 		return m, tea.Quit
 	}
 	return m, nil

audit/internal/tui/screen_network.go

@@ -10,12 +10,14 @@ func (m model) handleNetworkMenu() (tea.Model, tea.Cmd) {
 	switch m.cursor {
 	case 0:
 		m.busy = true
+		m.busyTitle = "Network status"
 		return m, func() tea.Msg {
 			result, err := m.app.NetworkStatus()
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
 		}
 	case 1:
 		m.busy = true
+		m.busyTitle = "DHCP all interfaces"
 		return m, func() tea.Msg {
 			result, err := m.app.DHCPAllResult()
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}
@@ -23,6 +25,7 @@ func (m model) handleNetworkMenu() (tea.Model, tea.Cmd) {
 	case 2:
 		m.pendingAction = actionDHCPOne
 		m.busy = true
+		m.busyTitle = "Interfaces"
 		return m, func() tea.Msg {
 			ifaces, err := m.app.ListInterfaces()
 			return interfacesMsg{ifaces: ifaces, err: err}
@@ -30,6 +33,7 @@ func (m model) handleNetworkMenu() (tea.Model, tea.Cmd) {
 	case 3:
 		m.pendingAction = actionStaticIPv4
 		m.busy = true
+		m.busyTitle = "Interfaces"
 		return m, func() tea.Msg {
 			ifaces, err := m.app.ListInterfaces()
 			return interfacesMsg{ifaces: ifaces, err: err}
@@ -50,6 +54,7 @@ func (m model) handleInterfacePickMenu() (tea.Model, tea.Cmd) {
 	switch m.pendingAction {
 	case actionDHCPOne:
 		m.busy = true
+		m.busyTitle = "DHCP on " + m.selectedIface
 		return m, func() tea.Msg {
 			result, err := m.app.DHCPOneResult(m.selectedIface)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenNetwork}

audit/internal/tui/screen_services.go

@@ -8,7 +8,7 @@ import (
 
 func (m model) handleServicesMenu() (tea.Model, tea.Cmd) {
 	if len(m.services) == 0 {
-		return m, resultCmd("bee services", "No bee-* services found", nil, screenMain)
+		return m, resultCmd("Services", "No bee-* services found.", nil, screenMain)
 	}
 	m.selectedService = m.services[m.cursor]
 	m.screen = screenServiceAction
@@ -25,22 +25,23 @@ func (m model) handleServiceActionMenu() (tea.Model, tea.Cmd) {
 	}
 
 	m.busy = true
+	m.busyTitle = "service: " + m.selectedService
 	return m, func() tea.Msg {
 		switch action {
-		case "status":
+		case "Status":
 			result, err := m.app.ServiceStatusResult(m.selectedService)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
-		case "restart":
+		case "Restart":
 			result, err := m.app.ServiceActionResult(m.selectedService, platform.ServiceRestart)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
-		case "start":
+		case "Start":
 			result, err := m.app.ServiceActionResult(m.selectedService, platform.ServiceStart)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
-		case "stop":
+		case "Stop":
 			result, err := m.app.ServiceActionResult(m.selectedService, platform.ServiceStop)
 			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenServiceAction}
 		default:
-			return resultMsg{title: "service", body: "unknown action", back: screenServiceAction}
+			return resultMsg{title: "Service", body: "Unknown action.", back: screenServiceAction}
 		}
 	}
 }

audit/internal/tui/tui_test.go

@@ -1,6 +1,7 @@
 package tui
 
 import (
+	"strings"
 	"testing"
 
 	"bee/audit/internal/app"
@@ -153,7 +154,8 @@ func TestMainMenuAsyncActionsSetBusy(t *testing.T) {
 		{name: "run audit", cursor: 3},
 		{name: "export", cursor: 4},
 		{name: "check tools", cursor: 5},
-		{name: "log tail", cursor: 6},
+		{name: "health summary", cursor: 6},
+		{name: "log tail", cursor: 7},
 	}
 
 	for _, test := range tests {
@@ -177,6 +179,24 @@ func TestMainMenuAsyncActionsSetBusy(t *testing.T) {
 	}
 }
 
+func TestMainViewIncludesBanner(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.banner = "System: Test Server | S/N ABC123\nIP: 10.0.0.10"
+
+	view := m.View()
+	if !strings.Contains(view, "System: Test Server | S/N ABC123") {
+		t.Fatalf("view missing system banner:\n%s", view)
+	}
+	if !strings.Contains(view, "IP: 10.0.0.10") {
+		t.Fatalf("view missing ip banner:\n%s", view)
+	}
+	if !strings.Contains(view, "Select action") {
+		t.Fatalf("view missing menu subtitle:\n%s", view)
+	}
+}
+
 func TestEscapeNavigation(t *testing.T) {
 	t.Parallel()
 
@@ -262,6 +282,31 @@ func TestAcceptanceConfirmFlow(t *testing.T) {
 	}
 }
 
+func TestAcceptanceMenuMapsNewTargets(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		cursor int
+		want   actionKind
+	}{
+		{cursor: 0, want: actionRunNvidiaSAT},
+		{cursor: 1, want: actionRunMemorySAT},
+		{cursor: 2, want: actionRunStorageSAT},
+	}
+
+	for _, test := range tests {
+		m := newTestModel()
+		m.screen = screenAcceptance
+		m.cursor = test.cursor
+
+		next, _ := m.handleAcceptanceMenu()
+		got := next.(model)
+		if got.pendingAction != test.want {
+			t.Fatalf("cursor=%d pendingAction=%q want %q", test.cursor, got.pendingAction, test.want)
+		}
+	}
+}
+
 func TestExportTargetSelectionOpensConfirm(t *testing.T) {
 	t.Parallel()
 
@@ -347,3 +392,197 @@ func TestConfirmCancelTarget(t *testing.T) {
 		t.Fatalf("default cancel target=%q want %q", got, screenMain)
 	}
 }
+
+func TestViewMainMenuRendersSelectedItem(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.cursor = 1
+
+	view := m.View()
+
+	for _, want := range []string{
+		"bee",
+		"Select action",
+		"  Network",
+		"> Services",
+		"Acceptance tests",
+		"[↑/↓] move  [enter] select  [esc] back  [ctrl+c] quit",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestViewBusyStateIsMinimal(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.busy = true
+
+	view := m.View()
+	want := "bee\n\nWorking...\n\n[ctrl+c] quit\n"
+	if view != want {
+		t.Fatalf("busy view mismatch\nwant:\n%s\ngot:\n%s", want, view)
+	}
+}
+
+func TestViewBusyStateUsesBusyTitle(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.busy = true
+	m.busyTitle = "Export audit"
+
+	view := m.View()
+
+	for _, want := range []string{
+		"Export audit",
+		"Working...",
+		"[ctrl+c] quit",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestViewOutputScreenRendersBodyAndBackHint(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenOutput
+	m.title = "Run audit"
+	m.body = "audit output: /var/log/bee-audit.json\n"
+
+	view := m.View()
+
+	for _, want := range []string{
+		"Run audit",
+		"audit output: /var/log/bee-audit.json",
+		"[enter/esc] back  [ctrl+c] quit",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestViewExportTargetsRendersDeviceMetadata(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenExportTargets
+	m.targets = []platform.RemovableTarget{
+		{
+			Device:     "/dev/sdb1",
+			FSType:     "vfat",
+			Size:       "29G",
+			Label:      "BEEUSB",
+			Mountpoint: "/media/bee",
+		},
+	}
+
+	view := m.View()
+
+	for _, want := range []string{
+		"Export audit",
+		"Select removable filesystem",
+		"> /dev/sdb1 [vfat 29G] label=BEEUSB mounted=/media/bee",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestViewStaticFormRendersFields(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenStaticForm
+	m.selectedIface = "enp1s0"
+	m.formFields = []formField{
+		{Label: "Address", Value: "192.0.2.10/24"},
+		{Label: "Gateway", Value: "192.0.2.1"},
+		{Label: "DNS", Value: "1.1.1.1"},
+	}
+	m.formIndex = 1
+
+	view := m.View()
+
+	for _, want := range []string{
+		"Static IPv4: enp1s0",
+		"  Address: 192.0.2.10/24",
+		"> Gateway: 192.0.2.1",
+		"  DNS: 1.1.1.1",
+		"[tab/↑/↓] move  [enter] next/submit  [backspace] delete  [esc] cancel",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestViewConfirmScreenMatchesPendingExport(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenConfirm
+	m.pendingAction = actionExportAudit
+	m.selectedTarget = &platform.RemovableTarget{Device: "/dev/sdb1"}
+
+	view := m.View()
+
+	for _, want := range []string{
+		"Export audit",
+		"Copy latest audit JSON to /dev/sdb1?",
+		"> Confirm",
+		"  Cancel",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestResultMsgClearsBusyAndPendingAction(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.busy = true
+	m.busyTitle = "Export audit"
+	m.pendingAction = actionExportAudit
+	m.screen = screenConfirm
+
+	next, _ := m.Update(resultMsg{title: "Export audit", body: "done", back: screenMain})
+	got := next.(model)
+
+	if got.busy {
+		t.Fatal("busy=true want false")
+	}
+	if got.busyTitle != "" {
+		t.Fatalf("busyTitle=%q want empty", got.busyTitle)
+	}
+	if got.pendingAction != actionNone {
+		t.Fatalf("pendingAction=%q want empty", got.pendingAction)
+	}
+}
+
+func TestResultMsgErrorWithoutBodyFormatsCleanly(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+
+	next, _ := m.Update(resultMsg{title: "Export audit", err: assertErr("boom"), back: screenMain})
+	got := next.(model)
+
+	if got.body != "ERROR: boom" {
+		t.Fatalf("body=%q want %q", got.body, "ERROR: boom")
+	}
+}
+
+type assertErr string
+
+func (e assertErr) Error() string { return string(e) }

audit/internal/tui/types.go

@@ -4,6 +4,7 @@ import (
 	"bee/audit/internal/app"
 	"bee/audit/internal/platform"
 	"bee/audit/internal/runtimeenv"
+	"strings"
 
 	tea "github.com/charmbracelet/bubbletea"
 )
@@ -26,11 +27,13 @@ const (
 type actionKind string
 
 const (
-	actionNone         actionKind = ""
-	actionDHCPOne      actionKind = "dhcp_one"
-	actionStaticIPv4   actionKind = "static_ipv4"
-	actionExportAudit  actionKind = "export_audit"
-	actionRunNvidiaSAT actionKind = "run_nvidia_sat"
+	actionNone          actionKind = ""
+	actionDHCPOne       actionKind = "dhcp_one"
+	actionStaticIPv4    actionKind = "static_ipv4"
+	actionExportAudit   actionKind = "export_audit"
+	actionRunNvidiaSAT  actionKind = "run_nvidia_sat"
+	actionRunMemorySAT  actionKind = "run_memory_sat"
+	actionRunStorageSAT actionKind = "run_storage_sat"
 )
 
 type model struct {
@@ -41,8 +44,10 @@ type model struct {
 	prevScreen  screen
 	cursor      int
 	busy        bool
+	busyTitle   string
 	title       string
 	body        string
+	banner      string
 	mainMenu    []string
 	networkMenu []string
 	serviceMenu []string
@@ -80,32 +85,35 @@ func newModel(application *app.App, runtimeMode runtimeenv.Mode) model {
 		runtimeMode: runtimeMode,
 		screen:      screenMain,
 		mainMenu: []string{
-			"Network setup",
-			"bee service management",
-			"System acceptance tests",
-			"Run audit now",
-			"Export audit to removable drive",
-			"Check required tools",
-			"Show last audit log tail",
+			"Network",
+			"Services",
+			"Acceptance tests",
+			"Run audit",
+			"Export audit",
+			"Check tools",
+			"Show health summary",
+			"Show audit logs",
 			"Exit",
 		},
 		networkMenu: []string{
-			"Show network status",
+			"Show status",
 			"DHCP on all interfaces",
 			"DHCP on one interface",
-			"Set static IPv4 on one interface",
+			"Set static IPv4",
 			"Back",
 		},
 		serviceMenu: []string{
-			"status",
-			"restart",
-			"start",
-			"stop",
-			"back",
+			"Status",
+			"Restart",
+			"Start",
+			"Stop",
+			"Back",
 		},
 	}
 }
 
 func (m model) Init() tea.Cmd {
-	return nil
+	return func() tea.Msg {
+		return bannerMsg{text: strings.TrimSpace(m.app.MainBanner())}
+	}
 }

audit/internal/tui/update.go

@@ -21,12 +21,19 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m.updateKey(msg)
 	case resultMsg:
 		m.busy = false
+		m.busyTitle = ""
 		m.title = msg.title
 		if msg.err != nil {
-			m.body = fmt.Sprintf("%s\n\nERROR: %v", strings.TrimSpace(msg.body), msg.err)
+			body := strings.TrimSpace(msg.body)
+			if body == "" {
+				m.body = fmt.Sprintf("ERROR: %v", msg.err)
+			} else {
+				m.body = fmt.Sprintf("%s\n\nERROR: %v", body, msg.err)
+			}
 		} else {
 			m.body = msg.body
 		}
+		m.pendingAction = actionNone
 		if msg.back != "" {
 			m.prevScreen = msg.back
 		} else {
@@ -37,8 +44,9 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, nil
 	case servicesMsg:
 		m.busy = false
+		m.busyTitle = ""
 		if msg.err != nil {
-			m.title = "bee services"
+			m.title = "Services"
 			m.body = msg.err.Error()
 			m.prevScreen = screenMain
 			m.screen = screenOutput
@@ -50,6 +58,7 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, nil
 	case interfacesMsg:
 		m.busy = false
+		m.busyTitle = ""
 		if msg.err != nil {
 			m.title = "interfaces"
 			m.body = msg.err.Error()
@@ -63,6 +72,7 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, nil
 	case exportTargetsMsg:
 		m.busy = false
+		m.busyTitle = ""
 		if msg.err != nil {
 			m.title = "export"
 			m.body = msg.err.Error()
@@ -74,6 +84,9 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.screen = screenExportTargets
 		m.cursor = 0
 		return m, nil
+	case bannerMsg:
+		m.banner = strings.TrimSpace(msg.text)
+		return m, nil
 	}
 
 	return m, nil
@@ -90,7 +103,7 @@ func (m model) updateKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	case screenServiceAction:
 		return m.updateMenu(msg, len(m.serviceMenu), m.handleServiceActionMenu)
 	case screenAcceptance:
-		return m.updateMenu(msg, 2, m.handleAcceptanceMenu)
+		return m.updateMenu(msg, 4, m.handleAcceptanceMenu)
 	case screenExportTargets:
 		return m.updateMenu(msg, len(m.targets), m.handleExportTargetsMenu)
 	case screenInterfacePick:
@@ -101,6 +114,7 @@ func (m model) updateKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 			m.screen = m.prevScreen
 			m.body = ""
 			m.title = ""
+			m.pendingAction = actionNone
 			return m, nil
 		case "ctrl+c":
 			return m, tea.Quit

audit/internal/tui/view.go

@@ -11,21 +11,25 @@ import (
 
 func (m model) View() string {
 	if m.busy {
-		return "bee\n\nWorking...\n"
+		title := "bee"
+		if m.busyTitle != "" {
+			title = m.busyTitle
+		}
+		return fmt.Sprintf("%s\n\nWorking...\n\n[ctrl+c] quit\n", title)
 	}
 	switch m.screen {
 	case screenMain:
-		return renderMenu("bee", "Select action", m.mainMenu, m.cursor)
+		return renderMainMenu("bee", m.banner, "Select action", m.mainMenu, m.cursor)
 	case screenNetwork:
 		return renderMenu("Network", "Select action", m.networkMenu, m.cursor)
 	case screenServices:
-		return renderMenu("bee services", "Select service", m.services, m.cursor)
+		return renderMenu("Services", "Select service", m.services, m.cursor)
 	case screenServiceAction:
 		items := make([]string, len(m.serviceMenu))
 		copy(items, m.serviceMenu)
 		return renderMenu("Service: "+m.selectedService, "Select action", items, m.cursor)
 	case screenAcceptance:
-		return renderMenu("System acceptance tests", "Select action", []string{"Run NVIDIA command pack", "Back"}, m.cursor)
+		return renderMenu("Acceptance tests", "Select action", []string{"Run NVIDIA command pack", "Run memory test", "Run storage diagnostic pack", "Back"}, m.cursor)
 	case screenExportTargets:
 		return renderMenu("Export audit", "Select removable filesystem", renderTargetItems(m.targets), m.cursor)
 	case screenInterfacePick:
@@ -51,6 +55,10 @@ func (m model) confirmBody() (string, string) {
 		return "Export audit", fmt.Sprintf("Copy latest audit JSON to %s?", m.selectedTarget.Device)
 	case actionRunNvidiaSAT:
 		return "NVIDIA SAT", "Run NVIDIA acceptance command pack?"
+	case actionRunMemorySAT:
+		return "Memory SAT", "Run runtime memory test with memtester?"
+	case actionRunStorageSAT:
+		return "Storage SAT", "Run storage diagnostic pack and start short self-tests where supported?"
 	default:
 		return "Confirm", "Proceed?"
 	}
@@ -101,6 +109,30 @@ func renderMenu(title, subtitle string, items []string, cursor int) string {
 	return body.String()
 }
 
+func renderMainMenu(title, banner, subtitle string, items []string, cursor int) string {
+	var body strings.Builder
+	fmt.Fprintf(&body, "%s\n\n", title)
+	if banner != "" {
+		body.WriteString(strings.TrimSpace(banner))
+		body.WriteString("\n\n")
+	}
+	body.WriteString(subtitle)
+	body.WriteString("\n\n")
+	if len(items) == 0 {
+		body.WriteString("(no items)\n")
+	} else {
+		for i, item := range items {
+			prefix := "  "
+			if i == cursor {
+				prefix = "> "
+			}
+			fmt.Fprintf(&body, "%s%s\n", prefix, item)
+		}
+	}
+	body.WriteString("\n[↑/↓] move  [enter] select  [esc] back  [ctrl+c] quit\n")
+	return body.String()
+}
+
 func renderForm(title string, fields []formField, idx int) string {
 	var body strings.Builder
 	fmt.Fprintf(&body, "%s\n\n", title)

audit/internal/webui/server.go

@@ -0,0 +1,77 @@
+package webui
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"reanimator/chart/viewer"
+	chartweb "reanimator/chart/web"
+)
+
+const defaultTitle = "Bee Hardware Audit"
+
+type HandlerOptions struct {
+	Title     string
+	AuditPath string
+}
+
+func NewHandler(opts HandlerOptions) http.Handler {
+	title := strings.TrimSpace(opts.Title)
+	if title == "" {
+		title = defaultTitle
+	}
+
+	auditPath := strings.TrimSpace(opts.AuditPath)
+	mux := http.NewServeMux()
+	mux.Handle("GET /static/", http.StripPrefix("/static/", chartweb.Static()))
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	})
+	mux.HandleFunc("GET /audit.json", func(w http.ResponseWriter, r *http.Request) {
+		data, err := loadSnapshot(auditPath)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				http.Error(w, "audit snapshot not found", http.StatusNotFound)
+				return
+			}
+			http.Error(w, fmt.Sprintf("read audit snapshot: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_, _ = w.Write(data)
+	})
+	mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
+		snapshot, err := loadSnapshot(auditPath)
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			http.Error(w, fmt.Sprintf("read audit snapshot: %v", err), http.StatusInternalServerError)
+			return
+		}
+
+		html, err := viewer.RenderHTML(snapshot, title)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("render snapshot: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = w.Write(html)
+	})
+	return mux
+}
+
+func ListenAndServe(addr string, opts HandlerOptions) error {
+	return http.ListenAndServe(addr, NewHandler(opts))
+}
+
+func loadSnapshot(path string) ([]byte, error) {
+	if strings.TrimSpace(path) == "" {
+		return nil, os.ErrNotExist
+	}
+	return os.ReadFile(path)
+}

audit/internal/webui/server_test.go

@@ -0,0 +1,82 @@
+package webui
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRootRendersLatestSnapshot(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	if err := os.WriteFile(path, []byte(`{"collected_at":"2026-03-15T00:00:00Z","hardware":{"board":{"serial_number":"SERIAL-OLD"}}}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{
+		Title:     "Bee Hardware Audit",
+		AuditPath: path,
+	})
+
+	first := httptest.NewRecorder()
+	handler.ServeHTTP(first, httptest.NewRequest(http.MethodGet, "/", nil))
+	if first.Code != http.StatusOK {
+		t.Fatalf("first status=%d", first.Code)
+	}
+	if !strings.Contains(first.Body.String(), "SERIAL-OLD") {
+		t.Fatalf("first body missing old serial: %s", first.Body.String())
+	}
+	if got := first.Header().Get("Cache-Control"); got != "no-store" {
+		t.Fatalf("first cache-control=%q", got)
+	}
+
+	if err := os.WriteFile(path, []byte(`{"collected_at":"2026-03-15T00:05:00Z","hardware":{"board":{"serial_number":"SERIAL-NEW"}}}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	second := httptest.NewRecorder()
+	handler.ServeHTTP(second, httptest.NewRequest(http.MethodGet, "/", nil))
+	if second.Code != http.StatusOK {
+		t.Fatalf("second status=%d", second.Code)
+	}
+	if !strings.Contains(second.Body.String(), "SERIAL-NEW") {
+		t.Fatalf("second body missing new serial: %s", second.Body.String())
+	}
+	if strings.Contains(second.Body.String(), "SERIAL-OLD") {
+		t.Fatalf("second body still contains old serial: %s", second.Body.String())
+	}
+}
+
+func TestAuditJSONServesLatestSnapshot(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	body := `{"hardware":{"board":{"serial_number":"SERIAL-API"}}}`
+	if err := os.WriteFile(path, []byte(body), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{AuditPath: path})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/audit.json", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d", rec.Code)
+	}
+	if got := strings.TrimSpace(rec.Body.String()); got != body {
+		t.Fatalf("body=%q want %q", got, body)
+	}
+	if got := rec.Header().Get("Content-Type"); !strings.Contains(got, "application/json") {
+		t.Fatalf("content-type=%q", got)
+	}
+}
+
+func TestMissingAuditJSONReturnsNotFound(t *testing.T) {
+	handler := NewHandler(HandlerOptions{AuditPath: "/missing/audit.json"})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/audit.json", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status=%d want %d", rec.Code, http.StatusNotFound)
+	}
+}

bible-local/README.md

@@ -9,4 +9,5 @@ Generic engineering rules live in `bible/rules/patterns/`.
 |---|---|
 | `architecture/system-overview.md` | What bee does, scope, tech stack |
 | `architecture/runtime-flows.md` | Boot sequence, audit flow, service order |
+| `docs/hardware-ingest-contract.md` | Current Reanimator hardware ingest JSON contract |
 | `decisions/` | Architectural decision log |

bible-local/architecture/runtime-flows.md

@@ -18,8 +18,10 @@ local-fs.target
   ├── bee-network.service    (starts `dhclient -nw` on all physical interfaces, non-blocking)
   ├── bee-nvidia.service     (insmod nvidia*.ko from /usr/local/lib/nvidia/,
   │                           creates /dev/nvidia* nodes)
-  └── bee-audit.service      (runs `bee audit` → /var/log/bee-audit.json,
-                               never blocks boot on partial collector failures)
+  ├── bee-audit.service      (runs `bee audit` → /var/log/bee-audit.json,
+  │                            never blocks boot on partial collector failures)
+  └── bee-web.service        (runs `bee web` on :80,
+                               reads the latest audit snapshot on each request)
 ```
 
 **Critical invariants:**
@@ -29,6 +31,28 @@ local-fs.target
   Reason: the modules are shipped in the ISO overlay under `/usr/local/lib/nvidia/`, not in the host module tree.
 - `bee-audit.service` does not wait for `network-online.target`; audit is local and must run even if DHCP is broken.
 - `bee-audit.service` logs audit failures but does not turn partial collector problems into a boot blocker.
+- `bee-web.service` binds `0.0.0.0:80` and always renders the current `/var/log/bee-audit.json` contents.
+- Audit JSON now includes a `hardware.summary` block with overall verdict and warning/failure counts.
+
+## Console and login flow
+
+Local-console behavior:
+
+```text
+tty1
+  └── live-config autologin → bee
+        └── /home/bee/.profile
+              └── exec menu
+                    └── /usr/local/bin/bee-tui
+                          └── sudo -n /usr/local/bin/bee tui --runtime livecd
+```
+
+Rules:
+- local `tty1` lands in user `bee`, not directly in `root`
+- `menu` must work without typing `sudo`
+- TUI actions still run as `root` via `sudo -n`
+- SSH is independent from the tty1 path
+- serial console support is enabled for VM boot debugging
 
 ## ISO build sequence
 
@@ -39,7 +63,7 @@ build.sh [--authorized-keys /path/to/keys]
   3. inject authorized_keys into staged `root/.ssh/` (or set password fallback marker)
   4. copy `bee` binary → staged `/usr/local/bin/bee`
   5. copy vendor binaries from `iso/vendor/` → staged `/usr/local/bin/`
-     (`storcli64`, `sas2ircu`, `sas3ircu`, `mstflint` — each optional)
+     (`storcli64`, `sas2ircu`, `sas3ircu`, `arcconf`, `ssacli` — optional; `mstflint` comes from the Debian package set)
   6. `build-nvidia-module.sh`:
        a. install Debian kernel headers if missing
        b. download NVIDIA `.run` installer (sha256 verified, cached in `dist/`)
@@ -80,6 +104,10 @@ Exit code 0 = all required checks pass. All `FAIL` lines must be zero before shi
 Key checks: NVIDIA modules loaded, `nvidia-smi` sees all GPUs, lib symlinks present,
 systemd services running, audit completed with NVIDIA enrichment, LAN reachability.
 
+Current validation state:
+- local/libvirt VM boot path is validated for `systemd`, SSH, `bee audit`, `bee-network`, and TUI startup
+- real hardware validation is still required before treating the ISO as release-ready
+
 ## Overlay mechanism
 
 `live-build` copies files from `config/includes.chroot/` into the ISO filesystem.
@@ -95,10 +123,21 @@ systemd services running, audit completed with NVIDIA enrichment, LAN reachabili
   3. memory collector  (dmidecode -t 17)
   4. storage collector (lsblk -J, smartctl -j, nvme id-ctrl, nvme smart-log)
   5. pcie collector    (lspci -vmm -D, /sys/bus/pci/devices/)
-  6. psu collector     (ipmitool fru — silent if no /dev/ipmi0)
+  6. psu collector     (ipmitool fru + sdr — silent if no /dev/ipmi0)
   7. nvidia enrichment (nvidia-smi — skipped if binary absent or driver not loaded)
   8. output JSON → /var/log/bee-audit.json
   9. QR summary to stdout (qrencode if available)
 ```
 
 Every collector returns `nil, nil` on tool-not-found. Errors are logged, never fatal.
+
+Acceptance flows:
+- `bee sat nvidia` → diagnostic archive with `nvidia-smi -q` + `nvidia-bug-report` + lightweight `bee-gpu-stress`
+- `bee sat memory` → `memtester` archive
+- `bee sat storage` → SMART/NVMe diagnostic archive and short self-test trigger where supported
+- SAT `summary.txt` now includes `overall_status` and per-job `*_status` values (`OK`, `FAILED`, `UNSUPPORTED`)
+- Runtime overrides:
+  - `BEE_GPU_STRESS_SECONDS`
+  - `BEE_GPU_STRESS_SIZE_MB`
+  - `BEE_MEMTESTER_SIZE_MB`
+  - `BEE_MEMTESTER_PASSES`

bible-local/architecture/system-overview.md

@@ -4,7 +4,7 @@
 
 Hardware audit LiveCD. Boots on a server via BMC virtual media or USB.
 Collects hardware inventory at OS level (not through BMC/Redfish).
-Produces `HardwareIngestRequest` JSON compatible with core/reanimator.
+Produces `HardwareIngestRequest` JSON compatible with the contract in `bible-local/docs/hardware-ingest-contract.md`.
 
 ## Why it exists
 
@@ -19,10 +19,15 @@ Fills gaps where Redfish/logpile is blind:
 ## In scope
 
 - Read-only hardware inventory: board, CPU, memory, storage, PCIe, PSU, GPU, NIC, RAID
-- Unattended operation — no user interaction required
+- Machine-readable health summary derived from collector verdicts
+- Operator-triggered acceptance tests for NVIDIA, memory, and storage
+- NVIDIA SAT includes both diagnostic collection and lightweight GPU stress via `bee-gpu-stress`
+- Automatic boot audit with operator-facing local console and SSH access
 - NVIDIA proprietary driver loaded at boot for GPU enrichment via `nvidia-smi`
 - SSH access (OpenSSH) always available for inspection and debugging
 - Interactive Go TUI via `bee tui` for network setup, service management, and acceptance tests
+- Read-only web viewer via `bee web`, rendering the latest audit snapshot through the embedded Reanimator Chart
+- Local `tty1` operator UX: `bee` autologin, `menu` auto-start, privileged actions via `sudo -n`
 
 ## Network isolation — CRITICAL
 
@@ -42,6 +47,16 @@ Fills gaps where Redfish/logpile is blind:
 - Anything requiring persistent storage on the audited machine
 - Windows support
 - Any functionality requiring internet access at boot
+- Component lifecycle/history across multiple snapshots
+- Status transition history (`status_history`, `status_changed_at`) derived from previous exports
+- Replacement detection between two or more audit runs
+
+## Contract boundary
+
+- `bee` is responsible for the current hardware snapshot only.
+- `bee` should populate current component state, hardware inventory, telemetry, and `status_checked_at`.
+- Historical status transitions and component replacement logic belong to the centralized ingest/lifecycle system, not to `bee`.
+- Contract fields that have no honest local source on a generic Linux host may remain empty.
 
 ## Tech stack
 
@@ -56,6 +71,14 @@ Fills gaps where Redfish/logpile is blind:
 | NVIDIA modules | Loaded via `insmod` from `/usr/local/lib/nvidia/` |
 | Builder | Debian 12 host/VM or Debian 12 container image |
 
+## Operator UX
+
+- On the live ISO, `tty1` autologins as `bee`
+- The login profile auto-runs `menu`, which enters the Go TUI
+- The TUI itself executes privileged actions as `root` via `sudo -n`
+- SSH remains available independently of the local console path
+- VM-oriented builds also include `qemu-guest-agent` and serial console support for debugging
+
 ## Runtime split
 
 - The main Go application must run both on a normal Linux host and inside the live ISO
@@ -72,8 +95,11 @@ Fills gaps where Redfish/logpile is blind:
 | `audit/internal/schema/` | HardwareIngestRequest types |
 | `iso/builder/` | ISO build scripts and `live-build` profile |
 | `iso/overlay/` | Source overlay copied into a staged build overlay |
-| `iso/vendor/` | Optional pre-built vendor binaries (storcli64, sas2ircu, sas3ircu, mstflint, …) |
+| `iso/vendor/` | Optional pre-built vendor binaries (storcli64, sas2ircu, sas3ircu, arcconf, ssacli, …) |
+| `internal/chart/` | Git submodule with `reanimator/chart`, embedded into `bee web` |
 | `iso/builder/VERSIONS` | Pinned versions: Debian, Go, NVIDIA driver, kernel ABI |
 | `iso/builder/smoketest.sh` | Post-boot smoke test — run via SSH to verify live ISO |
+| `iso/overlay/etc/profile.d/bee.sh` | `menu` helper + tty1 auto-start policy |
+| `iso/overlay/home/bee/.profile` | `bee` shell profile for local console startup |
 | `dist/` | Build outputs (gitignored) |
 | `iso/out/` | Downloaded ISO files (gitignored) |

bible-local/backlog.md

@@ -1,22 +1,68 @@
 # Backlog
 
-## GPU stress test (H100)
+## Real hardware validation
 
-**Статус:** отложено. В текущем ISO `gpu_burn` не включается и не запускается.
+**Статус:** ожидает доступа к железу.
 
-**Почему задача всё ещё в backlog:**
-- `gpu_burn` остаётся тяжёлым и неудобным с точки зрения зависимостей
-- хочется штатный lightweight stress tool без `libcublas.so` и без заметного раздувания ISO
-- для H100 нужен предсказуемый offline-инструмент, который можно стабильно возить внутри ISO
+Что осталось подтвердить на практике:
+- `bee sat nvidia` на реальном NVIDIA GPU host
+- `bee sat storage` на NVMe/SATA/RAID host
+- `ipmitool sdr` parsing на сервере с реальным BMC/IPMI
+- vendor RAID tooling (`storcli64`, `sas2ircu`, `sas3ircu`, `arcconf`, `ssacli`) в живом ISO
 
-**Желаемый следующий шаг:** написать минимальный stress tool на CUDA Driver API
-- использует только `libcuda.so`, уже присутствующий в ISO
-- выполняет простой compute / memory workload через `cuLaunchKernel`
-- собирается отдельно на builder VM и кладётся в `iso/vendor/`
-- в будущем может вызываться из `bee tui` как предпочтительный встроенный GPU SAT/stress path
+## SAT result polish
 
-**Отклонённые / проблемные варианты:**
-- `gpu_burn` — нужен libcublas (~500MB)
-- `nvbandwidth` — только bandwidth, не жжёт FLOPs; нужен libcudart (~8MB)
-- DCGM diag — правильный инструмент для H100 но ~100MB установка
-- Download on demand — нужен libcublas, проблема та же
+**Статус:** частично закрыто.
+
+Что ещё можно улучшить после полевой проверки:
+- точнее классифицировать vendor-specific self-test outputs в `storage SAT`
+- подобрать дефолты `memtester` по объёму RAM на целевых машинах
+- при необходимости расширить `bee-gpu-stress` по длительности/нагрузке
+
+## Hardware Contract backlog
+
+**Статус:** уточнён, сокращён до `bee`-only snapshot scope.
+
+### Не backlog для `bee`
+
+Эти задачи не должны реализовываться в `bee`, потому что относятся к централизованному ingest/lifecycle слою:
+- `status_history`
+- `status_changed_at`
+- определение замены компонента между snapshot'ами
+- timeline/lifecycle/history по diff между экспортами
+
+`bee` отвечает только за текущий snapshot железа и `status_checked_at`.
+
+### Реализуемо инкрементально
+
+Эти поля можно развивать дальше по мере появления реальных sample outputs и vendor-specific parser'ов:
+- `cpus.correctable_error_count`
+- `cpus.uncorrectable_error_count`
+- `power_supplies.life_remaining_pct`
+- `power_supplies.life_used_pct`
+- `pcie_devices.battery_charge_pct`
+- `pcie_devices.battery_health_pct`
+- `pcie_devices.battery_temperature_c`
+- `pcie_devices.battery_voltage_v`
+- `pcie_devices.battery_replace_required`
+
+### Vendor/platform-specific, часто пустые
+
+Эти поля допустимо оставлять пустыми на части платформ даже после реализации parser'ов:
+- `power_supplies.life_remaining_pct`
+- `power_supplies.life_used_pct`
+- часть `pcie_devices.battery_*` для неподдержанных RAID/NIC/GPU вендоров
+
+### Unsupported в `bee`
+
+Эти поля считаются нереалистичными для общего OS-level hardware snapshotter без synthetic/fake data:
+- `cpus.life_remaining_pct`
+- `cpus.life_used_pct`
+- `memory.life_remaining_pct`
+- `memory.life_used_pct`
+- `memory.spare_blocks_remaining_pct`
+- `memory.performance_degraded`
+
+Причина: у обычного Linux-host audit обычно нет честного vendor-neutral runtime source для этих метрик.
+
+Эти поля считаются дропнутыми из backlog `bee` и не должны возвращаться в план работ без появления нового доказуемого локального источника данных на целевых машинах.

bible-local/docs/hardware-ingest-contract.md

@@ -0,0 +1,730 @@
+---
+title: Hardware Ingest JSON Contract
+version: "2.1"
+updated: "2026-03-15"
+maintainer: Reanimator Core
+audience: external-integrators, ai-agents
+language: ru
+---
+
+# Интеграция с Reanimator: контракт JSON-импорта аппаратного обеспечения
+
+Версия: **2.1** · Дата: **2026-03-15**
+
+Документ описывает формат JSON для передачи данных об аппаратном обеспечении серверов в систему **Reanimator** (управление жизненным циклом аппаратного обеспечения).
+Предназначен для разработчиков смежных систем (Redfish-коллекторов, агентов мониторинга, CMDB-экспортёров) и может быть включён в документацию интегрируемых проектов.
+
+> Актуальная версия документа: https://git.mchus.pro/reanimator/core/src/branch/main/bible-local/docs/hardware-ingest-contract.md
+
+---
+
+## Changelog
+
+| Версия | Дата | Изменения |
+|--------|------|-----------|
+| 2.4 | 2026-03-15 | Добавлена первая волна component telemetry: health/life поля для `cpus`, `memory`, `storage`, `pcie_devices`, `power_supplies` |
+| 2.3 | 2026-03-15 | Добавлены component telemetry поля: `pcie_devices.temperature_c`, `pcie_devices.power_w`, `power_supplies.temperature_c` |
+| 2.2 | 2026-03-15 | Добавлено поле `numa_node` у `pcie_devices` для topology/affinity |
+| 2.1 | 2026-03-15 | Добавлена секция `sensors` (fans, power, temperatures, other); поле `mac_addresses` у `pcie_devices`; расширен список значений `device_class` |
+| 2.0 | 2026-02-01 | История статусов (`status_history`, `status_changed_at`); поля telemetry у PSU; async job response |
+| 1.0 | 2026-01-01 | Начальная версия контракта |
+
+---
+
+## Принципы
+
+1. **Snapshot** — JSON описывает состояние сервера на момент сбора. Может включать историю изменений статуса компонентов.
+2. **Идемпотентность** — повторная отправка идентичного payload не создаёт дублей (дедупликация по хешу).
+3. **Частичность** — можно передавать только те секции, данные по которым доступны. Пустой массив и отсутствие секции эквивалентны.
+4. **Строгая схема** — endpoint использует строгий JSON-декодер; неизвестные поля приводят к `400 Bad Request`.
+5. **Event-driven** — импорт создаёт события в timeline (LOG_COLLECTED, INSTALLED, REMOVED, FIRMWARE_CHANGED и др.).
+
+---
+
+## Endpoint
+
+```
+POST /ingest/hardware
+Content-Type: application/json
+```
+
+**Ответ при приёме (202 Accepted):**
+```json
+{
+  "status": "accepted",
+  "job_id": "job_01J..."
+}
+```
+
+Импорт выполняется асинхронно. Результат доступен по:
+```
+GET /ingest/hardware/jobs/{job_id}
+```
+
+**Ответ при успехе задачи:**
+```json
+{
+  "status": "success",
+  "bundle_id": "lb_01J...",
+  "asset_id": "mach_01J...",
+  "collected_at": "2026-02-10T15:30:00Z",
+  "duplicate": false,
+  "summary": {
+    "parts_observed": 15,
+    "parts_created": 2,
+    "parts_updated": 13,
+    "installations_created": 2,
+    "installations_closed": 1,
+    "timeline_events_created": 9,
+    "failure_events_created": 1
+  }
+}
+```
+
+**Ответ при дубликате:**
+```json
+{
+  "status": "success",
+  "duplicate": true,
+  "message": "LogBundle with this content hash already exists"
+}
+```
+
+**Ответ при ошибке (400 Bad Request):**
+```json
+{
+  "status": "error",
+  "error": "validation_failed",
+  "details": {
+    "field": "hardware.board.serial_number",
+    "message": "serial_number is required"
+  }
+}
+```
+
+Частые причины `400`:
+- Неверный формат `collected_at` (требуется RFC3339).
+- Пустой `hardware.board.serial_number`.
+- Наличие неизвестного JSON-поля на любом уровне.
+- Тело запроса превышает допустимый размер.
+
+---
+
+## Структура верхнего уровня
+
+```json
+{
+  "filename":     "redfish://10.10.10.103",
+  "source_type":  "api",
+  "protocol":     "redfish",
+  "target_host":  "10.10.10.103",
+  "collected_at": "2026-02-10T15:30:00Z",
+  "hardware": {
+    "board":          { ... },
+    "firmware":       [ ... ],
+    "cpus":           [ ... ],
+    "memory":         [ ... ],
+    "storage":        [ ... ],
+    "pcie_devices":   [ ... ],
+    "power_supplies": [ ... ],
+    "sensors":        { ... }
+  }
+}
+```
+
+### Поля верхнего уровня
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `collected_at` | string RFC3339 | **да** | Время сбора данных |
+| `hardware` | object | **да** | Аппаратный снапшот |
+| `hardware.board.serial_number` | string | **да** | Серийный номер платы/сервера |
+| `target_host` | string | нет | IP или hostname |
+| `source_type` | string | нет | Тип источника: `api`, `logfile`, `manual` |
+| `protocol` | string | нет | Протокол: `redfish`, `ipmi`, `snmp`, `ssh` |
+| `filename` | string | нет | Идентификатор источника |
+
+---
+
+## Общие поля статуса компонентов
+
+Применяются ко всем компонентным секциям (`cpus`, `memory`, `storage`, `pcie_devices`, `power_supplies`).
+
+| Поле | Тип | Описание |
+|------|-----|----------|
+| `status` | string | Текущий статус: `OK`, `Warning`, `Critical`, `Unknown`, `Empty` |
+| `status_checked_at` | string RFC3339 | Время последней проверки статуса |
+| `status_changed_at` | string RFC3339 | Время последнего изменения статуса |
+| `status_history` | array | История переходов статусов (см. ниже) |
+| `error_description` | string | Текст ошибки/диагностики |
+
+**Объект `status_history[]`:**
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `status` | string | **да** | Статус в этот момент |
+| `changed_at` | string RFC3339 | **да** | Время перехода (без этого поля запись игнорируется) |
+| `details` | string | нет | Пояснение к переходу |
+
+**Правила приоритета времени события:**
+
+1. `status_changed_at`
+2. Последняя запись `status_history` с совпадающим статусом
+3. Последняя парсируемая запись `status_history`
+4. `status_checked_at`
+
+**Правила передачи статусов:**
+- Передавайте `status` как текущее состояние компонента в snapshot.
+- Если источник хранит историю — передавайте `status_history` отсортированным по `changed_at` по возрастанию.
+- Не включайте записи `status_history` без `changed_at`.
+- Все даты — RFC3339, рекомендуется UTC (`Z`).
+
+---
+
+## Секции hardware
+
+### board
+
+Основная информация о сервере. Обязательная секция.
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `serial_number` | string | **да** | Серийный номер (ключ идентификации Asset) |
+| `manufacturer` | string | нет | Производитель |
+| `product_name` | string | нет | Модель |
+| `part_number` | string | нет | Партномер |
+| `uuid` | string | нет | UUID системы |
+
+Значения `"NULL"` в строковых полях трактуются как отсутствие данных.
+
+```json
+"board": {
+  "manufacturer": "Supermicro",
+  "product_name": "X12DPG-QT6",
+  "serial_number": "21D634101",
+  "part_number": "X12DPG-QT6-REV1.01",
+  "uuid": "d7ef2fe5-2fd0-11f0-910a-346f11040868"
+}
+```
+
+---
+
+### firmware
+
+Версии прошивок системных компонентов (BIOS, BMC, CPLD и др.).
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `device_name` | string | **да** | Название устройства (`BIOS`, `BMC`, `CPLD`, …) |
+| `version` | string | **да** | Версия прошивки |
+
+Записи с пустым `device_name` или `version` игнорируются.
+Изменение версии создаёт событие `FIRMWARE_CHANGED` для Asset.
+
+```json
+"firmware": [
+  { "device_name": "BIOS", "version": "06.08.05" },
+  { "device_name": "BMC",  "version": "5.17.00"  },
+  { "device_name": "CPLD", "version": "01.02.03" }
+]
+```
+
+---
+
+### cpus
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `socket` | int | **да** | Номер сокета (используется для генерации serial) |
+| `model` | string | нет | Модель процессора |
+| `manufacturer` | string | нет | Производитель |
+| `cores` | int | нет | Количество ядер |
+| `threads` | int | нет | Количество потоков |
+| `frequency_mhz` | int | нет | Текущая частота |
+| `max_frequency_mhz` | int | нет | Максимальная частота |
+| `temperature_c` | float | нет | Температура CPU, °C (telemetry) |
+| `power_w` | float | нет | Текущая мощность CPU, Вт (telemetry) |
+| `throttled` | bool | нет | Зафиксирован thermal/power throttling |
+| `correctable_error_count` | int | нет | Количество корректируемых ошибок CPU |
+| `uncorrectable_error_count` | int | нет | Количество некорректируемых ошибок CPU |
+| `life_remaining_pct` | float | нет | Остаточный ресурс / health, % |
+| `life_used_pct` | float | нет | Использованный ресурс / wear, % |
+| `serial_number` | string | нет | Серийный номер (если доступен) |
+| `firmware` | string | нет | Версия микрокода |
+| `present` | bool | нет | Наличие (по умолчанию `true`) |
+| + общие поля статуса | | | см. раздел выше |
+
+**Генерация serial_number при отсутствии:** `{board_serial}-CPU-{socket}`
+
+```json
+"cpus": [
+  {
+    "socket": 0,
+    "model": "INTEL(R) XEON(R) GOLD 6530",
+    "cores": 32,
+    "threads": 64,
+    "frequency_mhz": 2100,
+    "max_frequency_mhz": 4000,
+    "temperature_c": 61.5,
+    "power_w": 182.0,
+    "throttled": false,
+    "manufacturer": "Intel",
+    "status": "OK",
+    "status_checked_at": "2026-02-10T15:28:00Z"
+  }
+]
+```
+
+---
+
+### memory
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `slot` | string | нет | Идентификатор слота |
+| `location` | string | нет | Физическое расположение |
+| `present` | bool | нет | Наличие модуля (по умолчанию `true`) |
+| `serial_number` | string | нет | Серийный номер |
+| `part_number` | string | нет | Партномер (используется как модель) |
+| `manufacturer` | string | нет | Производитель |
+| `size_mb` | int | нет | Объём в МБ |
+| `type` | string | нет | Тип: `DDR3`, `DDR4`, `DDR5`, … |
+| `max_speed_mhz` | int | нет | Максимальная частота |
+| `current_speed_mhz` | int | нет | Текущая частота |
+| `temperature_c` | float | нет | Температура DIMM/модуля, °C (telemetry) |
+| `correctable_ecc_error_count` | int | нет | Количество корректируемых ECC-ошибок |
+| `uncorrectable_ecc_error_count` | int | нет | Количество некорректируемых ECC-ошибок |
+| `life_remaining_pct` | float | нет | Остаточный ресурс / health, % |
+| `life_used_pct` | float | нет | Использованный ресурс / wear, % |
+| `spare_blocks_remaining_pct` | float | нет | Остаток spare blocks, % |
+| `performance_degraded` | bool | нет | Зафиксирована деградация производительности |
+| `data_loss_detected` | bool | нет | Источник сигнализирует риск/факт потери данных |
+| + общие поля статуса | | | см. раздел выше |
+
+Модуль без `serial_number` игнорируется. Модуль с `present=false` или `status=Empty` игнорируется.
+
+```json
+"memory": [
+  {
+    "slot": "CPU0_C0D0",
+    "present": true,
+    "size_mb": 32768,
+    "type": "DDR5",
+    "max_speed_mhz": 4800,
+    "current_speed_mhz": 4800,
+    "temperature_c": 43.0,
+    "correctable_ecc_error_count": 0,
+    "manufacturer": "Hynix",
+    "serial_number": "80AD032419E17CEEC1",
+    "part_number": "HMCG88AGBRA191N",
+    "status": "OK"
+  }
+]
+```
+
+---
+
+### storage
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `slot` | string | нет | Идентификатор слота |
+| `serial_number` | string | нет | Серийный номер |
+| `model` | string | нет | Модель |
+| `manufacturer` | string | нет | Производитель |
+| `type` | string | нет | Тип: `NVMe`, `SSD`, `HDD` |
+| `interface` | string | нет | Интерфейс: `NVMe`, `SATA`, `SAS` |
+| `size_gb` | int | нет | Размер в ГБ |
+| `temperature_c` | float | нет | Температура накопителя, °C (telemetry) |
+| `power_on_hours` | int64 | нет | Время работы, часы |
+| `power_cycles` | int64 | нет | Количество циклов питания |
+| `unsafe_shutdowns` | int64 | нет | Нештатные выключения |
+| `media_errors` | int64 | нет | Ошибки носителя / media errors |
+| `error_log_entries` | int64 | нет | Количество записей в error log |
+| `written_bytes` | int64 | нет | Всего записано байт |
+| `read_bytes` | int64 | нет | Всего прочитано байт |
+| `life_used_pct` | float | нет | Использованный ресурс / wear, % |
+| `life_remaining_pct` | float | нет | Остаточный ресурс / health, % |
+| `available_spare_pct` | float | нет | Доступный spare, % |
+| `reallocated_sectors` | int64 | нет | Переназначенные сектора |
+| `current_pending_sectors` | int64 | нет | Сектора в ожидании ремапа |
+| `offline_uncorrectable` | int64 | нет | Некорректируемые ошибки offline scan |
+| `firmware` | string | нет | Версия прошивки |
+| `present` | bool | нет | Наличие (по умолчанию `true`) |
+| + общие поля статуса | | | см. раздел выше |
+
+Диск без `serial_number` игнорируется. Изменение `firmware` создаёт событие `FIRMWARE_CHANGED`.
+
+```json
+"storage": [
+  {
+    "slot": "OB01",
+    "type": "NVMe",
+    "model": "INTEL SSDPF2KX076T1",
+    "size_gb": 7680,
+    "temperature_c": 38.5,
+    "power_on_hours": 12450,
+    "unsafe_shutdowns": 3,
+    "written_bytes": 9876543210,
+    "life_remaining_pct": 91.0,
+    "serial_number": "BTAX41900GF87P6DGN",
+    "manufacturer": "Intel",
+    "firmware": "9CV10510",
+    "interface": "NVMe",
+    "present": true,
+    "status": "OK"
+  }
+]
+```
+
+---
+
+### pcie_devices
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `slot` | string | нет | Идентификатор слота |
+| `vendor_id` | int | нет | PCI Vendor ID (decimal) |
+| `device_id` | int | нет | PCI Device ID (decimal) |
+| `numa_node` | int | нет | NUMA node / CPU affinity устройства |
+| `temperature_c` | float | нет | Температура устройства, °C (telemetry) |
+| `power_w` | float | нет | Текущее энергопотребление устройства, Вт (telemetry) |
+| `life_remaining_pct` | float | нет | Остаточный ресурс / health, % |
+| `life_used_pct` | float | нет | Использованный ресурс / wear, % |
+| `ecc_corrected_total` | int64 | нет | Всего корректируемых ECC-ошибок |
+| `ecc_uncorrected_total` | int64 | нет | Всего некорректируемых ECC-ошибок |
+| `hw_slowdown` | bool | нет | Устройство вошло в hardware slowdown / protective mode |
+| `battery_charge_pct` | float | нет | Заряд батареи / supercap, % |
+| `battery_health_pct` | float | нет | Состояние батареи / supercap, % |
+| `battery_temperature_c` | float | нет | Температура батареи / supercap, °C |
+| `battery_voltage_v` | float | нет | Напряжение батареи / supercap, В |
+| `battery_replace_required` | bool | нет | Требуется замена батареи / supercap |
+| `sfp_temperature_c` | float | нет | Температура SFP/optic, °C |
+| `sfp_tx_power_dbm` | float | нет | TX optical power, dBm |
+| `sfp_rx_power_dbm` | float | нет | RX optical power, dBm |
+| `sfp_voltage_v` | float | нет | Напряжение SFP, В |
+| `sfp_bias_ma` | float | нет | Bias current SFP, мА |
+| `bdf` | string | нет | Bus:Device.Function, например `0000:18:00.0` |
+| `device_class` | string | нет | Класс устройства (см. список ниже) |
+| `manufacturer` | string | нет | Производитель |
+| `model` | string | нет | Модель |
+| `serial_number` | string | нет | Серийный номер |
+| `firmware` | string | нет | Версия прошивки |
+| `link_width` | int | нет | Текущая ширина линка |
+| `link_speed` | string | нет | Текущая скорость: `Gen3`, `Gen4`, `Gen5` |
+| `max_link_width` | int | нет | Максимальная ширина линка |
+| `max_link_speed` | string | нет | Максимальная скорость |
+| `mac_addresses` | string[] | нет | MAC-адреса портов (для сетевых устройств) |
+| `present` | bool | нет | Наличие (по умолчанию `true`) |
+| + общие поля статуса | | | см. раздел выше |
+
+`numa_node` передавайте для NIC / InfiniBand / RAID / GPU, когда источник знает CPU/NUMA affinity. Поле сохраняется в snapshot-атрибутах PCIe-компонента и дублируется в telemetry для topology use cases.
+Поля `temperature_c` и `power_w` используйте для device-level telemetry GPU / accelerator / smart PCIe devices. Они не влияют на идентификацию компонента.
+
+**Генерация serial_number при отсутствии или `"N/A"`:** `{board_serial}-PCIE-{slot}`
+
+**Значения `device_class`:**
+
+| Значение | Назначение |
+|----------|------------|
+| `MassStorageController` | RAID-контроллеры |
+| `StorageController` | HBA, SAS-контроллеры |
+| `NetworkController` | Сетевые адаптеры (InfiniBand, общий) |
+| `EthernetController` | Ethernet NIC |
+| `FibreChannelController` | Fibre Channel HBA |
+| `VideoController` | GPU, видеокарты |
+| `ProcessingAccelerator` | Вычислительные ускорители (AI/ML) |
+| `DisplayController` | Контроллеры дисплея (BMC VGA) |
+
+Список открытый: допускаются произвольные строки для нестандартных классов.
+
+```json
+"pcie_devices": [
+  {
+    "slot": "PCIeCard2",
+    "vendor_id": 5555,
+    "device_id": 4401,
+    "numa_node": 0,
+    "temperature_c": 48.5,
+    "power_w": 18.2,
+    "sfp_temperature_c": 36.2,
+    "sfp_tx_power_dbm": -1.8,
+    "sfp_rx_power_dbm": -2.1,
+    "bdf": "0000:3b:00.0",
+    "device_class": "EthernetController",
+    "manufacturer": "Intel",
+    "model": "X710 10GbE",
+    "serial_number": "K65472-003",
+    "firmware": "9.20 0x8000d4ae",
+    "mac_addresses": ["3c:fd:fe:aa:bb:cc", "3c:fd:fe:aa:bb:cd"],
+    "status": "OK"
+  }
+]
+```
+
+---
+
+### power_supplies
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `slot` | string | нет | Идентификатор слота |
+| `present` | bool | нет | Наличие (по умолчанию `true`) |
+| `serial_number` | string | нет | Серийный номер |
+| `part_number` | string | нет | Партномер |
+| `model` | string | нет | Модель |
+| `vendor` | string | нет | Производитель |
+| `wattage_w` | int | нет | Мощность в ваттах |
+| `firmware` | string | нет | Версия прошивки |
+| `input_type` | string | нет | Тип входа (например `ACWideRange`) |
+| `input_voltage` | float | нет | Входное напряжение, В (telemetry) |
+| `input_power_w` | float | нет | Входная мощность, Вт (telemetry) |
+| `output_power_w` | float | нет | Выходная мощность, Вт (telemetry) |
+| `temperature_c` | float | нет | Температура PSU, °C (telemetry) |
+| `life_remaining_pct` | float | нет | Остаточный ресурс / health, % |
+| `life_used_pct` | float | нет | Использованный ресурс / wear, % |
+| + общие поля статуса | | | см. раздел выше |
+
+Поля telemetry (`input_voltage`, `input_power_w`, `output_power_w`, `temperature_c`, `life_remaining_pct`, `life_used_pct`) сохраняются в атрибутах компонента и не влияют на его идентификацию.
+
+PSU без `serial_number` игнорируется.
+
+```json
+"power_supplies": [
+  {
+    "slot": "0",
+    "present": true,
+    "model": "GW-CRPS3000LW",
+    "vendor": "Great Wall",
+    "wattage_w": 3000,
+    "serial_number": "2P06C102610",
+    "firmware": "00.03.05",
+    "status": "OK",
+    "input_type": "ACWideRange",
+    "input_power_w": 137,
+    "output_power_w": 104,
+    "input_voltage": 215.25,
+    "temperature_c": 39.5,
+    "life_remaining_pct": 97.0
+  }
+]
+```
+
+---
+
+### sensors
+
+Показания сенсоров сервера. Секция опциональная, не привязана к компонентам.
+Данные хранятся как последнее известное значение (last-known-value) на уровне Asset.
+
+```json
+"sensors": {
+  "fans":         [ ... ],
+  "power":        [ ... ],
+  "temperatures": [ ... ],
+  "other":        [ ... ]
+}
+```
+
+#### sensors.fans
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `name` | string | **да** | Уникальное имя сенсора в рамках секции |
+| `location` | string | нет | Физическое расположение |
+| `rpm` | int | нет | Обороты, RPM |
+| `status` | string | нет | Статус: `OK`, `Warning`, `Critical`, `Unknown` |
+
+#### sensors.power
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `name` | string | **да** | Уникальное имя сенсора |
+| `location` | string | нет | Физическое расположение |
+| `voltage_v` | float | нет | Напряжение, В |
+| `current_a` | float | нет | Ток, А |
+| `power_w` | float | нет | Мощность, Вт |
+| `status` | string | нет | Статус |
+
+#### sensors.temperatures
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `name` | string | **да** | Уникальное имя сенсора |
+| `location` | string | нет | Физическое расположение |
+| `celsius` | float | нет | Температура, °C |
+| `threshold_warning_celsius` | float | нет | Порог Warning, °C |
+| `threshold_critical_celsius` | float | нет | Порог Critical, °C |
+| `status` | string | нет | Статус |
+
+#### sensors.other
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `name` | string | **да** | Уникальное имя сенсора |
+| `location` | string | нет | Физическое расположение |
+| `value` | float | нет | Значение |
+| `unit` | string | нет | Единица измерения |
+| `status` | string | нет | Статус |
+
+**Правила sensors:**
+- Идентификатор сенсора: пара `(sensor_type, name)`. Дубли в одном payload — берётся первое вхождение.
+- Сенсоры без `name` игнорируются.
+- При каждом импорте значения перезаписываются (upsert по ключу).
+
+```json
+"sensors": {
+  "fans": [
+    { "name": "FAN1", "location": "Front", "rpm": 4200, "status": "OK" },
+    { "name": "FAN_CPU0", "location": "CPU0", "rpm": 5600, "status": "OK" }
+  ],
+  "power": [
+    { "name": "12V Rail", "location": "Mainboard", "voltage_v": 12.06, "status": "OK" },
+    { "name": "PSU0 Input", "location": "PSU0", "voltage_v": 215.25, "current_a": 0.64, "power_w": 137.0, "status": "OK" }
+  ],
+  "temperatures": [
+    { "name": "CPU0 Temp", "location": "CPU0", "celsius": 46.0, "threshold_warning_celsius": 80.0, "threshold_critical_celsius": 95.0, "status": "OK" },
+    { "name": "Inlet Temp", "location": "Front", "celsius": 22.0, "threshold_warning_celsius": 40.0, "threshold_critical_celsius": 50.0, "status": "OK" }
+  ],
+  "other": [
+    { "name": "System Humidity", "value": 38.5, "unit": "%", "status": "OK" }
+  ]
+}
+```
+
+---
+
+## Обработка статусов компонентов
+
+| Статус | Поведение |
+|--------|-----------|
+| `OK` | Нормальная обработка |
+| `Warning` | Создаётся событие `COMPONENT_WARNING` |
+| `Critical` | Создаётся событие `COMPONENT_FAILED` + запись в `failure_events` |
+| `Unknown` | Компонент считается рабочим, создаётся событие `COMPONENT_UNKNOWN` |
+| `Empty` | Компонент не создаётся/не обновляется |
+
+---
+
+## Обработка отсутствующих serial_number
+
+| Тип | Поведение |
+|-----|-----------|
+| CPU | Генерируется: `{board_serial}-CPU-{socket}` |
+| PCIe | Генерируется: `{board_serial}-PCIE-{slot}` (если serial = `"N/A"` или пустой) |
+| Memory | Компонент игнорируется |
+| Storage | Компонент игнорируется |
+| PSU | Компонент игнорируется |
+
+Если `serial_number` не уникален внутри одного payload для того же `model`:
+- Первое вхождение сохраняет оригинальный серийный номер.
+- Каждое следующее дублирующее получает placeholder: `NO_SN-XXXXXXXX`.
+
+---
+
+## Минимальный валидный пример
+
+```json
+{
+  "collected_at": "2026-02-10T15:30:00Z",
+  "target_host": "192.168.1.100",
+  "hardware": {
+    "board": {
+      "serial_number": "SRV-001"
+    }
+  }
+}
+```
+
+---
+
+## Полный пример с историей статусов
+
+```json
+{
+  "filename": "redfish://10.10.10.103",
+  "source_type": "api",
+  "protocol": "redfish",
+  "target_host": "10.10.10.103",
+  "collected_at": "2026-02-10T15:30:00Z",
+  "hardware": {
+    "board": {
+      "manufacturer": "Supermicro",
+      "product_name": "X12DPG-QT6",
+      "serial_number": "21D634101"
+    },
+    "firmware": [
+      { "device_name": "BIOS", "version": "06.08.05" },
+      { "device_name": "BMC",  "version": "5.17.00"  }
+    ],
+    "cpus": [
+      {
+        "socket": 0,
+        "model": "INTEL(R) XEON(R) GOLD 6530",
+        "manufacturer": "Intel",
+        "cores": 32,
+        "threads": 64,
+        "status": "OK"
+      }
+    ],
+    "storage": [
+      {
+        "slot": "OB01",
+        "type": "NVMe",
+        "model": "INTEL SSDPF2KX076T1",
+        "size_gb": 7680,
+        "serial_number": "BTAX41900GF87P6DGN",
+        "manufacturer": "Intel",
+        "firmware": "9CV10510",
+        "present": true,
+        "status": "OK",
+        "status_changed_at": "2026-02-10T15:22:00Z",
+        "status_history": [
+          { "status": "Critical", "changed_at": "2026-02-10T15:10:00Z", "details": "I/O timeout on NVMe queue 3" },
+          { "status": "OK",       "changed_at": "2026-02-10T15:22:00Z", "details": "Recovered after controller reset" }
+        ]
+      }
+    ],
+    "pcie_devices": [
+      {
+        "slot": "PCIeCard1",
+        "device_class": "EthernetController",
+        "manufacturer": "Intel",
+        "model": "X710 10GbE",
+        "serial_number": "K65472-003",
+        "mac_addresses": ["3c:fd:fe:aa:bb:cc", "3c:fd:fe:aa:bb:cd"],
+        "status": "OK"
+      }
+    ],
+    "power_supplies": [
+      {
+        "slot": "0",
+        "present": true,
+        "model": "GW-CRPS3000LW",
+        "vendor": "Great Wall",
+        "wattage_w": 3000,
+        "serial_number": "2P06C102610",
+        "firmware": "00.03.05",
+        "status": "OK",
+        "input_power_w": 137,
+        "output_power_w": 104,
+        "input_voltage": 215.25
+      }
+    ],
+    "sensors": {
+      "fans": [
+        { "name": "FAN1", "location": "Front", "rpm": 4200, "status": "OK" }
+      ],
+      "power": [
+        { "name": "12V Rail", "voltage_v": 12.06, "status": "OK" }
+      ],
+      "temperatures": [
+        { "name": "CPU0 Temp", "celsius": 46.0, "threshold_warning_celsius": 80.0, "threshold_critical_celsius": 95.0, "status": "OK" }
+      ],
+      "other": [
+        { "name": "System Humidity", "value": 38.5, "unit": "%" }
+      ]
+    }
+  }
+}
+```

iso/builder/Dockerfile

@@ -1,6 +1,6 @@
 FROM debian:12
 
-ARG GO_VERSION=1.23.6
+ARG GO_VERSION=1.24.0
 ARG DEBIAN_KERNEL_ABI=6.1.0-43
 
 ENV DEBIAN_FRONTEND=noninteractive

iso/builder/VERSIONS

@@ -1,5 +1,5 @@
 DEBIAN_VERSION=12
 DEBIAN_KERNEL_ABI=6.1.0-43
 NVIDIA_DRIVER_VERSION=590.48.01
-GO_VERSION=1.23.6
+GO_VERSION=1.24.0
 AUDIT_VERSION=0.1.1

iso/builder/auto/config

@@ -21,7 +21,7 @@ lb config noauto \
     --linux-flavours "amd64" \
     --linux-packages "linux-image-${DEBIAN_KERNEL_ABI}" \
     --memtest none \
-    --iso-volume "BEE-DEBUG" \
+    --iso-volume "BEE" \
     --iso-application "Bee Hardware Audit" \
     --bootappend-live "boot=live components console=tty0 console=ttyS0,115200n8 username=bee user-fullname=Bee modprobe.blacklist=nouveau" \
     --apt-recommends false \

iso/builder/bee-gpu-stress.c

@@ -0,0 +1,314 @@
+#define _POSIX_C_SOURCE 200809L
+
+#include <dlfcn.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+typedef int CUdevice;
+typedef uint64_t CUdeviceptr;
+typedef int CUresult;
+typedef void *CUcontext;
+typedef void *CUmodule;
+typedef void *CUfunction;
+typedef void *CUstream;
+
+#define CU_SUCCESS 0
+
+static const char *ptx_source =
+    ".version 6.0\n"
+    ".target sm_30\n"
+    ".address_size 64\n"
+    "\n"
+    ".visible .entry burn(\n"
+    "    .param .u64 data,\n"
+    "    .param .u32 words,\n"
+    "    .param .u32 rounds\n"
+    ")\n"
+    "{\n"
+    "    .reg .pred %p<2>;\n"
+    "    .reg .b32 %r<8>;\n"
+    "    .reg .b64 %rd<5>;\n"
+    "\n"
+    "    ld.param.u64 %rd1, [data];\n"
+    "    ld.param.u32 %r1, [words];\n"
+    "    ld.param.u32 %r2, [rounds];\n"
+    "    mov.u32 %r3, %ctaid.x;\n"
+    "    mov.u32 %r4, %ntid.x;\n"
+    "    mov.u32 %r5, %tid.x;\n"
+    "    mad.lo.s32 %r0, %r3, %r4, %r5;\n"
+    "    setp.ge.u32 %p0, %r0, %r1;\n"
+    "    @%p0 bra DONE;\n"
+    "    mul.wide.u32 %rd2, %r0, 4;\n"
+    "    add.s64 %rd3, %rd1, %rd2;\n"
+    "    ld.global.u32 %r6, [%rd3];\n"
+    "LOOP:\n"
+    "    setp.eq.u32 %p1, %r2, 0;\n"
+    "    @%p1 bra STORE;\n"
+    "    mad.lo.u32 %r6, %r6, 1664525, 1013904223;\n"
+    "    sub.u32 %r2, %r2, 1;\n"
+    "    bra LOOP;\n"
+    "STORE:\n"
+    "    st.global.u32 [%rd3], %r6;\n"
+    "DONE:\n"
+    "    ret;\n"
+    "}\n";
+
+typedef CUresult (*cuInit_fn)(unsigned int);
+typedef CUresult (*cuDeviceGetCount_fn)(int *);
+typedef CUresult (*cuDeviceGet_fn)(CUdevice *, int);
+typedef CUresult (*cuDeviceGetName_fn)(char *, int, CUdevice);
+typedef CUresult (*cuCtxCreate_fn)(CUcontext *, unsigned int, CUdevice);
+typedef CUresult (*cuCtxDestroy_fn)(CUcontext);
+typedef CUresult (*cuCtxSynchronize_fn)(void);
+typedef CUresult (*cuMemAlloc_fn)(CUdeviceptr *, size_t);
+typedef CUresult (*cuMemFree_fn)(CUdeviceptr);
+typedef CUresult (*cuMemcpyHtoD_fn)(CUdeviceptr, const void *, size_t);
+typedef CUresult (*cuMemcpyDtoH_fn)(void *, CUdeviceptr, size_t);
+typedef CUresult (*cuModuleLoadDataEx_fn)(CUmodule *, const void *, unsigned int, void *, void *);
+typedef CUresult (*cuModuleGetFunction_fn)(CUfunction *, CUmodule, const char *);
+typedef CUresult (*cuLaunchKernel_fn)(CUfunction,
+                                      unsigned int,
+                                      unsigned int,
+                                      unsigned int,
+                                      unsigned int,
+                                      unsigned int,
+                                      unsigned int,
+                                      unsigned int,
+                                      CUstream,
+                                      void **,
+                                      void **);
+typedef CUresult (*cuGetErrorName_fn)(CUresult, const char **);
+typedef CUresult (*cuGetErrorString_fn)(CUresult, const char **);
+
+struct cuda_api {
+    void *lib;
+    cuInit_fn cuInit;
+    cuDeviceGetCount_fn cuDeviceGetCount;
+    cuDeviceGet_fn cuDeviceGet;
+    cuDeviceGetName_fn cuDeviceGetName;
+    cuCtxCreate_fn cuCtxCreate;
+    cuCtxDestroy_fn cuCtxDestroy;
+    cuCtxSynchronize_fn cuCtxSynchronize;
+    cuMemAlloc_fn cuMemAlloc;
+    cuMemFree_fn cuMemFree;
+    cuMemcpyHtoD_fn cuMemcpyHtoD;
+    cuMemcpyDtoH_fn cuMemcpyDtoH;
+    cuModuleLoadDataEx_fn cuModuleLoadDataEx;
+    cuModuleGetFunction_fn cuModuleGetFunction;
+    cuLaunchKernel_fn cuLaunchKernel;
+    cuGetErrorName_fn cuGetErrorName;
+    cuGetErrorString_fn cuGetErrorString;
+};
+
+static int load_symbol(void *lib, const char *name, void **out) {
+    *out = dlsym(lib, name);
+    return *out != NULL;
+}
+
+static int load_cuda(struct cuda_api *api) {
+    memset(api, 0, sizeof(*api));
+    api->lib = dlopen("libcuda.so.1", RTLD_NOW | RTLD_LOCAL);
+    if (!api->lib) {
+        return 0;
+    }
+    return
+        load_symbol(api->lib, "cuInit", (void **)&api->cuInit) &&
+        load_symbol(api->lib, "cuDeviceGetCount", (void **)&api->cuDeviceGetCount) &&
+        load_symbol(api->lib, "cuDeviceGet", (void **)&api->cuDeviceGet) &&
+        load_symbol(api->lib, "cuDeviceGetName", (void **)&api->cuDeviceGetName) &&
+        load_symbol(api->lib, "cuCtxCreate_v2", (void **)&api->cuCtxCreate) &&
+        load_symbol(api->lib, "cuCtxDestroy_v2", (void **)&api->cuCtxDestroy) &&
+        load_symbol(api->lib, "cuCtxSynchronize", (void **)&api->cuCtxSynchronize) &&
+        load_symbol(api->lib, "cuMemAlloc_v2", (void **)&api->cuMemAlloc) &&
+        load_symbol(api->lib, "cuMemFree_v2", (void **)&api->cuMemFree) &&
+        load_symbol(api->lib, "cuMemcpyHtoD_v2", (void **)&api->cuMemcpyHtoD) &&
+        load_symbol(api->lib, "cuMemcpyDtoH_v2", (void **)&api->cuMemcpyDtoH) &&
+        load_symbol(api->lib, "cuModuleLoadDataEx", (void **)&api->cuModuleLoadDataEx) &&
+        load_symbol(api->lib, "cuModuleGetFunction", (void **)&api->cuModuleGetFunction) &&
+        load_symbol(api->lib, "cuLaunchKernel", (void **)&api->cuLaunchKernel);
+}
+
+static const char *cu_error_name(struct cuda_api *api, CUresult rc) {
+    const char *value = NULL;
+    if (api->cuGetErrorName && api->cuGetErrorName(rc, &value) == CU_SUCCESS && value) {
+        return value;
+    }
+    return "CUDA_ERROR";
+}
+
+static const char *cu_error_string(struct cuda_api *api, CUresult rc) {
+    const char *value = NULL;
+    if (api->cuGetErrorString && api->cuGetErrorString(rc, &value) == CU_SUCCESS && value) {
+        return value;
+    }
+    return "unknown";
+}
+
+static int check_rc(struct cuda_api *api, const char *step, CUresult rc) {
+    if (rc == CU_SUCCESS) {
+        return 1;
+    }
+    fprintf(stderr, "%s failed: %s (%s)\n", step, cu_error_name(api, rc), cu_error_string(api, rc));
+    return 0;
+}
+
+static double now_seconds(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (double)ts.tv_sec + ((double)ts.tv_nsec / 1000000000.0);
+}
+
+int main(int argc, char **argv) {
+    int seconds = 5;
+    int size_mb = 64;
+    for (int i = 1; i < argc; i++) {
+        if ((strcmp(argv[i], "--seconds") == 0 || strcmp(argv[i], "-t") == 0) && i + 1 < argc) {
+            seconds = atoi(argv[++i]);
+        } else if ((strcmp(argv[i], "--size-mb") == 0 || strcmp(argv[i], "-m") == 0) && i + 1 < argc) {
+            size_mb = atoi(argv[++i]);
+        } else {
+            fprintf(stderr, "usage: %s [--seconds N] [--size-mb N]\n", argv[0]);
+            return 2;
+        }
+    }
+    if (seconds <= 0) {
+        seconds = 5;
+    }
+    if (size_mb <= 0) {
+        size_mb = 64;
+    }
+
+    struct cuda_api api;
+    if (!load_cuda(&api)) {
+        fprintf(stderr, "failed to load libcuda.so.1 or required Driver API symbols\n");
+        return 1;
+    }
+    load_symbol(api.lib, "cuGetErrorName", (void **)&api.cuGetErrorName);
+    load_symbol(api.lib, "cuGetErrorString", (void **)&api.cuGetErrorString);
+
+    if (!check_rc(&api, "cuInit", api.cuInit(0))) {
+        return 1;
+    }
+
+    int count = 0;
+    if (!check_rc(&api, "cuDeviceGetCount", api.cuDeviceGetCount(&count))) {
+        return 1;
+    }
+    if (count <= 0) {
+        fprintf(stderr, "no CUDA devices found\n");
+        return 1;
+    }
+
+    CUdevice dev = 0;
+    if (!check_rc(&api, "cuDeviceGet", api.cuDeviceGet(&dev, 0))) {
+        return 1;
+    }
+    char name[128] = {0};
+    if (!check_rc(&api, "cuDeviceGetName", api.cuDeviceGetName(name, (int)sizeof(name), dev))) {
+        return 1;
+    }
+
+    CUcontext ctx = NULL;
+    if (!check_rc(&api, "cuCtxCreate", api.cuCtxCreate(&ctx, 0, dev))) {
+        return 1;
+    }
+
+    size_t bytes = (size_t)size_mb * 1024 * 1024;
+    uint32_t words = (uint32_t)(bytes / sizeof(uint32_t));
+    if (words < 1024) {
+        words = 1024;
+        bytes = (size_t)words * sizeof(uint32_t);
+    }
+
+    uint32_t *host = (uint32_t *)malloc(bytes);
+    if (!host) {
+        fprintf(stderr, "malloc failed\n");
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+    for (uint32_t i = 0; i < words; i++) {
+        host[i] = i ^ 0x12345678u;
+    }
+
+    CUdeviceptr device_mem = 0;
+    if (!check_rc(&api, "cuMemAlloc", api.cuMemAlloc(&device_mem, bytes))) {
+        free(host);
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+    if (!check_rc(&api, "cuMemcpyHtoD", api.cuMemcpyHtoD(device_mem, host, bytes))) {
+        api.cuMemFree(device_mem);
+        free(host);
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+
+    CUmodule module = NULL;
+    if (!check_rc(&api, "cuModuleLoadDataEx", api.cuModuleLoadDataEx(&module, ptx_source, 0, NULL, NULL))) {
+        api.cuMemFree(device_mem);
+        free(host);
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+
+    CUfunction kernel = NULL;
+    if (!check_rc(&api, "cuModuleGetFunction", api.cuModuleGetFunction(&kernel, module, "burn"))) {
+        api.cuMemFree(device_mem);
+        free(host);
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+
+    unsigned int threads = 256;
+    unsigned int blocks = (words + threads - 1) / threads;
+    uint32_t rounds = 256;
+    void *params[] = {&device_mem, &words, &rounds};
+
+    double start = now_seconds();
+    double deadline = start + (double)seconds;
+    unsigned long iterations = 0;
+    while (now_seconds() < deadline) {
+        if (!check_rc(&api, "cuLaunchKernel",
+                      api.cuLaunchKernel(kernel, blocks, 1, 1, threads, 1, 1, 0, NULL, params, NULL))) {
+            api.cuMemFree(device_mem);
+            free(host);
+            api.cuCtxDestroy(ctx);
+            return 1;
+        }
+        iterations++;
+    }
+
+    if (!check_rc(&api, "cuCtxSynchronize", api.cuCtxSynchronize())) {
+        api.cuMemFree(device_mem);
+        free(host);
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+    if (!check_rc(&api, "cuMemcpyDtoH", api.cuMemcpyDtoH(host, device_mem, bytes))) {
+        api.cuMemFree(device_mem);
+        free(host);
+        api.cuCtxDestroy(ctx);
+        return 1;
+    }
+
+    uint64_t checksum = 0;
+    for (uint32_t i = 0; i < words; i += words / 256 ? words / 256 : 1) {
+        checksum += host[i];
+    }
+
+    double elapsed = now_seconds() - start;
+    printf("device=%s\n", name);
+    printf("duration_s=%.2f\n", elapsed);
+    printf("buffer_mb=%d\n", size_mb);
+    printf("iterations=%lu\n", iterations);
+    printf("checksum=%llu\n", (unsigned long long)checksum);
+    printf("status=OK\n");
+
+    api.cuMemFree(device_mem);
+    free(host);
+    api.cuCtxDestroy(ctx);
+    return 0;
+}

iso/builder/build.sh

@@ -39,8 +39,12 @@ echo "=== bee ISO build ==="
 echo "Debian: ${DEBIAN_VERSION}, Kernel ABI: ${DEBIAN_KERNEL_ABI}, Go: ${GO_VERSION}"
 echo ""
 
+echo "=== syncing git submodules ==="
+git -C "${REPO_ROOT}" submodule update --init --recursive
+
 # --- compile bee binary (static, Linux amd64) ---
 BEE_BIN="${DIST_DIR}/bee-linux-amd64"
+GPU_STRESS_BIN="${DIST_DIR}/bee-gpu-stress-linux-amd64"
 NEED_BUILD=1
 if [ -f "$BEE_BIN" ]; then
     NEWEST_SRC=$(find "${REPO_ROOT}/audit" -name '*.go' -newer "$BEE_BIN" | head -1)
@@ -70,6 +74,22 @@ else
     echo "=== bee binary up to date, skipping build ==="
 fi
 
+GPU_STRESS_NEED_BUILD=1
+if [ -f "$GPU_STRESS_BIN" ] && [ "${BUILDER_DIR}/bee-gpu-stress.c" -ot "$GPU_STRESS_BIN" ]; then
+    GPU_STRESS_NEED_BUILD=0
+fi
+
+if [ "$GPU_STRESS_NEED_BUILD" = "1" ]; then
+    echo "=== building bee-gpu-stress ==="
+    gcc -O2 -s -Wall -Wextra \
+        -o "$GPU_STRESS_BIN" \
+        "${BUILDER_DIR}/bee-gpu-stress.c" \
+        -ldl
+    echo "binary: $GPU_STRESS_BIN"
+else
+    echo "=== bee-gpu-stress up to date, skipping build ==="
+fi
+
 echo "=== preparing staged overlay ==="
 rm -rf "${BUILD_WORK_DIR}" "${OVERLAY_STAGE_DIR}"
 mkdir -p "${BUILD_WORK_DIR}" "${OVERLAY_STAGE_DIR}"
@@ -80,6 +100,7 @@ rm -f \
     "${OVERLAY_STAGE_DIR}/etc/bee-release" \
     "${OVERLAY_STAGE_DIR}/root/.ssh/authorized_keys" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/bee" \
+    "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-gpu-stress" \
     "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest"
 
 # --- inject authorized_keys for SSH access ---
@@ -119,13 +140,15 @@ fi
 mkdir -p "${OVERLAY_STAGE_DIR}/usr/local/bin"
 cp "${DIST_DIR}/bee-linux-amd64" "${OVERLAY_STAGE_DIR}/usr/local/bin/bee"
 chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee"
+cp "${GPU_STRESS_BIN}" "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-gpu-stress"
+chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-gpu-stress"
 
 # --- inject smoketest into overlay so it runs directly on the live CD ---
 cp "${BUILDER_DIR}/smoketest.sh" "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest"
 chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-smoketest"
 
 # --- vendor utilities (optional pre-fetched binaries) ---
-for tool in storcli64 sas2ircu sas3ircu mstflint; do
+for tool in storcli64 sas2ircu sas3ircu arcconf ssacli; do
     if [ -f "${VENDOR_DIR}/${tool}" ]; then
         cp "${VENDOR_DIR}/${tool}" "${OVERLAY_STAGE_DIR}/usr/local/bin/${tool}"
         chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/${tool}" || true

iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot

@@ -9,6 +9,7 @@ echo "=== bee chroot setup ==="
 systemctl enable bee-network.service
 systemctl enable bee-nvidia.service
 systemctl enable bee-audit.service
+systemctl enable bee-web.service
 systemctl enable bee-sshsetup.service
 systemctl enable ssh.service
 systemctl enable qemu-guest-agent.service 2>/dev/null || true

iso/builder/config/package-lists/bee.list.chroot

@@ -11,6 +11,8 @@ lshw
 iproute2
 isc-dhcp-client
 iputils-ping
+ethtool
+lm-sensors
 qemu-guest-agent
 
 # SSH
@@ -27,6 +29,8 @@ mc
 htop
 sudo
 zstd
+mstflint
+memtester
 
 # QR codes (for displaying audit results)
 qrencode

iso/builder/setup-builder.sh

@@ -12,7 +12,7 @@
 set -e
 
 . "$(dirname "$0")/VERSIONS" 2>/dev/null || true
-GO_VERSION="${GO_VERSION:-1.23.6}"
+GO_VERSION="${GO_VERSION:-1.24.0}"
 DEBIAN_VERSION="${DEBIAN_VERSION:-12}"
 DEBIAN_KERNEL_ABI="${DEBIAN_KERNEL_ABI:-6.1.0-28}"
 

iso/builder/smoketest.sh

@@ -96,7 +96,7 @@ done
 
 echo ""
 echo "-- systemd services --"
-for svc in bee-nvidia bee-network bee-audit; do
+for svc in bee-nvidia bee-network bee-audit bee-web; do
     if systemctl is-active --quiet "$svc" 2>/dev/null; then
         ok "service active: $svc"
     else
@@ -151,6 +151,20 @@ else
     warn "audit: no log found at /var/log/bee-audit.log"
 fi
 
+echo ""
+echo "-- bee web --"
+if [ -f /var/log/bee-web.log ]; then
+    info "last web log line: $(tail -1 /var/log/bee-web.log)"
+else
+    warn "web: no log found at /var/log/bee-web.log"
+fi
+
+if bash -c 'exec 3<>/dev/tcp/127.0.0.1/80 && printf "GET /healthz HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3 && grep -q "^ok$" <&3'; then
+    ok "web: health endpoint reachable on 127.0.0.1:80"
+else
+    fail "web: health endpoint not reachable on 127.0.0.1:80"
+fi
+
 echo ""
 echo "-- network --"
 if ip route show default 2>/dev/null | grep -q "default"; then

iso/overlay/etc/systemd/system/bee-audit.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=Bee: run hardware audit
 After=bee-network.service bee-nvidia.service
+Before=bee-web.service
 
 [Service]
 Type=oneshot

iso/overlay/etc/systemd/system/bee-web.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Bee: hardware audit web viewer
+After=bee-network.service bee-audit.service
+Wants=bee-audit.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/bee web --listen :80 --audit-path /var/log/bee-audit.json --title "Bee Hardware Audit"
+Restart=always
+RestartSec=2
+StandardOutput=append:/var/log/bee-web.log
+StandardError=append:/var/log/bee-web.log
+
+[Install]
+WantedBy=multi-user.target