readmegen

Overview ¶

Command readmegen regenerates the sample output blocks in README.md from the program itself, so they cannot drift away from what tracehound actually prints.

Both blocks used to be hand-written. They were wrong: they showed alert titles that had never existed in the code, counts and timestamps from no particular run, and omitted evidence fields the tool does emit. That is worse than having no samples, because the README's stated standard is that every finding is checkable, and the demo capture is deterministic enough for a reader to check it in one command and find the document wrong.

This replaces the region between marker comments:

<!-- readmegen:begin NAME -->
...generated...
<!-- readmegen:end NAME -->

It always rewrites the file. CI runs it and then "git diff --exit-code README.md", which is the same shape as the existing go.mod tidiness check and needs no separate verify mode: if the committed README does not match what the program prints, the diff is the error message.