render: add ASCII output mode and honour NO_COLOR / CLICOLOR

Accessibility for screen readers, non-UTF-8 terminals, and legacy consoles.

--ascii (-a) forces plain ASCII, and it is auto-enabled when the locale codeset
is not UTF-8 (setlocale + nl_langinfo). The Unicode status glyphs fall back to
[ok]/[warn]/[fail]/->, and the block-art and component banners get plain-text
forms. The em dash becomes a plain hyphen everywhere — this also changes the
default Unicode output. JSON (-j) and oneline (-1) carry no glyphs and are
documented as the fully accessible formats.

Colour now follows the standard env conventions: NO_COLOR (any value) and
CLICOLOR=0 disable it, CLICOLOR_FORCE forces it on even when piped, and an
explicit --color / CLICOLOR_FORCE overrides NO_COLOR.

Update the man page, usage.md, and --help.

Author: bcoles

docs/usage.md

@@ -83,6 +83,8 @@ the vantage. See [limitations.md](limitations.md).
 -1, --oneline       Single-line summary output (shell-pipeable)
 -m, --markdown      Markdown table output (for issue trackers)
 -c, --color         Colorize text output (auto-detected for TTYs)
+-a, --ascii         ASCII-only output: no Unicode glyphs or banner
+                    (auto-enabled in a non-UTF-8 locale)
 -q, --quiet         Suppress progress indicator and warnings
 -v, --verbose       Add banner, system-config block, per-component logs,
                     per-region Results table, KASLR analysis, and the
@@ -104,6 +106,19 @@ Single-dash short flags may be bundled: `-fq` is `-f -q`, `-vj` is `-v -j`. A
 value-taking flag (`-s`/`-t`/`-w`) may appear only as the last flag in a bundle,
 taking the next argument — `-fqt 2` is `-f -q -t 2`.
 
+### Accessibility
+
+The text output uses a few Unicode glyphs (`✓ ⚠ ✗ →`) and a box-art banner
+under `-v`. These are auto-disabled in a non-UTF-8 locale (`LANG=C`, legacy
+consoles), and `--ascii` (`-a`) forces plain ASCII regardless — for screen
+readers on a UTF-8 system, or non-UTF-8 pipelines. The JSON (`-j`) and one-line
+(`-1`) formats carry no glyphs and are the fully accessible, machine-readable
+interfaces.
+
+Colour follows the standard environment conventions: `NO_COLOR` (any value)
+disables it, `CLICOLOR=0` disables it, and `CLICOLOR_FORCE` (non-empty, not `0`)
+forces it on even when piped. An explicit `--color` overrides `NO_COLOR`.
+
 ## Output modes
 
 ### Default text mode

man/kasld.1

@@ -55,7 +55,22 @@ Show technique explanations before each component (implies
 Suppress the banner, progress, and warnings.
 .TP
 .BR \-c ", " \-\-color
-Colourize text output (auto-detected for TTYs).
+Colourize text output. Auto-detected for TTYs and suppressed by the
+.B NO_COLOR
+and
+.B CLICOLOR
+environment variables (see
+.BR ENVIRONMENT ).
+.TP
+.BR \-a ", " \-\-ascii
+ASCII-only output: replace the Unicode status glyphs and the box-art banner
+with ASCII equivalents. Auto-enabled in a non-UTF-8 locale; this flag forces it
+regardless (for screen readers on a UTF-8 system). The JSON
+.RB ( \-j )
+and one-line
+.RB ( \-1 )
+formats carry no glyphs and are unaffected \(em they are the fully accessible
+interfaces.
 .TP
 .BR \-H ", " \-\-hardening
 Append the hardening assessment to text and markdown output.
@@ -124,6 +139,23 @@ skipped.
 .B KASLD_EXPERIMENTAL
 When set, enable experimental components, equivalent to
 .BR \-\-experimental .
+.TP
+.B NO_COLOR
+When present (any value, including empty), disable coloured output regardless of
+whether stdout is a TTY. An explicit
+.B \-\-color
+or
+.B CLICOLOR_FORCE
+overrides it. See
+.IR https://no-color.org .
+.TP
+.BR CLICOLOR ", " CLICOLOR_FORCE
+.B CLICOLOR=0
+disables colour;
+.B CLICOLOR_FORCE
+(non-empty and not
+.BR 0 )
+forces colour on even when stdout is not a TTY (BSD convention).
 .SH FILES
 .TP
 .I <bindir>/../libexec/kasld/

src/components/acpi_mrrm.c

@@ -58,7 +58,7 @@ KASLD_EXPLAIN(
     "/sys/firmware/acpi/memory_ranges/rangeN/base. The kernel parses the "
     "ACPI MRRM table (Intel tiered-memory / CXL systems) and exposes each "
     "physical memory range with world-readable (0444) __ATTR_RO attributes "
-    "— no capability check, not gated by kptr_restrict. On architectures "
+    "- no capability check, not gated by kptr_restrict. On architectures "
     "with a fixed physical-to-virtual mapping the base addresses directly "
     "yield linear-map kernel virtual addresses. Requires CONFIG_ACPI_MRRM.");
 

src/components/alsa_seq_ext_ptr.c

@@ -197,7 +197,7 @@ KASLD_EXPLAIN(
     "sequencer event addressed to itself via direct dispatch, then reads it "
     "back. Before commit 705dd6dcbc0e, snd_seq_read() returned the event "
     "header with data.ext.ptr still pointing at the kvmalloc'd pool cell that "
-    "holds the chained payload — a kernel direct-map address that bounds "
+    "holds the chained payload - a kernel direct-map address that bounds "
     "the direct-map base. Holds many clients open at once so their pools land "
     "at "
     "different direct-map addresses, and emits the lowest (tightest "
@@ -437,7 +437,7 @@ int main(int argc, char **argv) {
      * empty. Such an address is a real leak but not a page_offset witness, so
      * emit nothing rather than mislabel a vmalloc pointer as direct-map. */
     kasld_err("leaked pointer 0x%lx is outside the direct-map window "
-              "(kvmalloc in vmalloc, or coupled arch) — nothing to emit",
+              "(kvmalloc in vmalloc, or coupled arch) - nothing to emit",
               addr);
     close(fd0);
     return 0;

src/components/boot_params_e820.c

@@ -73,7 +73,7 @@
 
 KASLD_EXPLAIN(
     "Reads the x86 E820 physical memory map and initrd physical address "
-    "directly from /sys/kernel/boot_params/data — a world-readable "
+    "directly from /sys/kernel/boot_params/data - a world-readable "
     "(0444) 4096-byte binary sysfs file exposing the full struct "
     "boot_params passed from the bootloader. No dmesg access is "
     "required. The E820 table yields physical DRAM bounds; the "

src/components/bpf_verifier_ksym.c

@@ -145,7 +145,7 @@ KASLD_EXPLAIN(
     "Before "
     "commit 72a85e9464a5 the verifier's pointer-mask left BTF_ID unmasked, so "
     "the "
-    "log printed each resolved kallsyms address — kernel .text pointers that "
+    "log printed each resolved kallsyms address - kernel .text pointers that "
     "bracket the image base. Reachable with CAP_BPF (without CAP_PERFMON), a "
     "BPF-token userns, or unprivileged_bpf_disabled=0; a silent no-op on "
     "patched "
@@ -294,7 +294,7 @@ int main(int argc, char **argv) {
   const char *why = "";
   int nids = find_func_btf_ids(ids, &why);
   if (nids == 0) {
-    kasld_err("no btf_ids (%s) — CONFIG_DEBUG_INFO_BTF off, or BTF unreadable",
+    kasld_err("no btf_ids (%s) - CONFIG_DEBUG_INFO_BTF off, or BTF unreadable",
               why);
     return KASLD_EXIT_UNAVAILABLE;
   }

src/components/bpf_verifier_log.c

@@ -111,7 +111,7 @@ KASLD_EXPLAIN(
     "Loads a tiny socket-filter BPF program that references a map via an "
     "fd_array index (BPF_PSEUDO_MAP_IDX ldimm64) and requests a verifier log. "
     "Before commit 72a85e9464a5 the verifier's pointer-mask left MAP_IDX "
-    "unmasked, so the log printed the resolved kernel pointer — the kmalloc'd "
+    "unmasked, so the log printed the resolved kernel pointer - the kmalloc'd "
     "struct bpf_map address, a direct-map VA that bounds the direct-map base. "
     "Reachable with CAP_BPF (without CAP_PERFMON), a BPF-token userns, or "
     "unprivileged_bpf_disabled=0. Emits only when a real kernel pointer "

src/components/dmesg_backtrace.c

@@ -68,7 +68,7 @@ KASLD_EXPLAIN(
     "Bracketed [<ffffffff...>] tokens are kernel text pointers; register "
     "values in the direct-map range bound the direct-map base; the x86 CR3 "
     "register exposes the physical page-table base. CR3 is classified by the "
-    "dump's process context — the idle task's CR3 is swapper_pg_dir (kernel "
+    "dump's process context - the idle task's CR3 is swapper_pg_dir (kernel "
     ".bss), any other task's is a process page table in generic DRAM. Access "
     "is gated by dmesg_restrict.");
 

src/components/dmesg_efi_memmap.c

@@ -56,7 +56,7 @@ KASLD_EXPLAIN(
     "(conventional memory, MMIO, runtime services, loader code, etc.). "
     "Extracts physical DRAM, MMIO and EFI_LOADER_CODE ranges. Each "
     "EFI_LOADER_CODE entry is emitted as a separate REGION_EFI_LOADER_IMAGE "
-    "observation with its full [start, end] extent — the running kernel is "
+    "observation with its full [start, end] extent - the running kernel is "
     "one of these entries on an EFI stub boot, with bootloader/driver "
     "images claiming the others. efi_loader_kernel_pick filters by EFI stub "
     "alignment + SF_IMAGE_SIZE_MIN match to identify the running-kernel entry. "

src/components/dmesg_mmu_idmap.c

@@ -59,7 +59,7 @@
 KASLD_EXPLAIN(
     "Searches dmesg for ARM32 identity_mapping_add() messages printed "
     "during early MMU setup. The logged range is the PHYSICAL address of "
-    "the kernel idmap text (virt_to_phys(__idmap_text)) — an interior "
+    "the kernel idmap text (virt_to_phys(__idmap_text)) - an interior "
     "physical kernel-image address. Access is gated by dmesg_restrict.");
 
 KASLD_META("method:parsed\n"