[dankoverride]

Rewrites the README against the code and adds DOCKERHUB.md, the canonical source for the Docker Hub overview. Supersedes the DOCKERHUB.md in #2, which repeats the original README's errors.

README: what was wrong

• Trace direction was backwards. Each call starts a new Parallax trace; the callee's spans join it, and only if the callee reads W3C trace context.
• Overclaims. "Over REST and gRPC" is HTTP GET/HEAD plus the gRPC health check. "Any OTLP backend" is OTLP over gRPC only. "Repeat-safe by default" implied an override that does not exist.
• Missing or wrong flags. -results, -version and -manifest - were missing; the -headers default was shown as the env var (it is empty, with an env fallback).

README: what was added

• Install: release binaries with checksum steps, the immersivefusion/parallax image, and building from source. No version numbers: release links use /releases/latest and commands use the untagged image, mirroring Snowglobe, so nothing goes stale on the next tag.
• Real output: the examples/shop.yaml dry run and a -once -results jsonl pass, both captured from runs.
• What "unanswered" means, including that a 3xx counts as answered.
• Operator caveats, each checked in code:
  • run.maxCallsPerSecond is an average checked at plan build, not a throttle.
  • Allow/deny path matches the route path only, not any path inside baseURL.
  • Credentials written into a baseURL are sent as Basic auth and printed as-is.
  • /healthz reports Parallax's own health, not your services'.
  • Every probe trace is sampled.
  • At most 1 MiB of each response body is read.
  • The health listener binds all interfaces by default.
• The banner image, at .img/banner.jpg.

Not changed here (code, for the engine owner)

1. -once exits 0 when cancelled mid-pass (internal/runner/runner.go:83-86, cmd/parallax/main.go:158-161). A cancelled CI job can read as a pass. The README discloses it until it is fixed.
2. The dry-run refusal string "Parallax never calls a system you don't own" (internal/plan/plan.go:112) reads as a guarantee. The README glosses it as the owned: true guardrail.
3. "Absence" wording in the comments of examples/gate-target.yaml and scripts/propagation-check.sh.

Verification

• Built from source: the dry run matches the README.
• v0.1.0 Windows binary: SHA256 matches SHA256SUMS, and it prints parallax v0.1.0.
• immersivefusion/parallax:0.1.0:
  • The README's docker run ... -dry-run exits 0.
  • The Hub page's example manifest was run in the image; its output is on the page verbatim.
  • imagetools inspect shows provenance and an SPDX SBOM on both platforms.
• The CI glyph guard passes on the tree.
• Both files passed the C2 documentation quality gate (Steelman, Constitutional, Devil's Advocate, then LLM-as-Judge). After the version-pin removal, the README scored 0.92 and the Hub page 0.921, with no Critical or Major findings.

After merge (by hand)

• Paste DOCKERHUB.md onto Docker Hub, from the # Parallax line down.
• The repo About description still says "REST and gRPC calls". Proposed replacement: "Walks a graph of your services and makes real, repeat-safe HTTP GET/HEAD and gRPC health calls with W3C trace context. Exports its own spans over OTLP. Apache-2.0."

🤖 Generated with Claude Code

The merge-base changed after approval.