[dankoverride]

This is a review of the v0.2 docs from #5 against the v0.2.0 code, made after #5 merged. Those edits shipped without a docs gate pass. The gate found three statements that were false for v0.2.0, plus a rendering break.

Corrections

• Egress guard and proxies. The docs said a hostname that resolves to a metadata address "is refused too". That holds only without a proxy.
  • With HTTP_PROXY or HTTPS_PROXY set, the HTTP transport connects to the proxy, so guardEgress checks the proxy's address, never the target's (internal/probe/probe.go:92-93).
  • gRPC health checks bypass the proxy and are guarded: grpc-go skips the proxy resolver when a custom dialer is set.
  • The guard now has its own section, with its exact scope. It isn't general SSRF protection: loopback and private ranges are allowed, the OTLP exporter isn't covered, the metadata list isn't exhaustive, and on Windows the unspecified address becomes loopback before the guard runs.
• Exit code 0. It means no call was unanswered, not "every call was answered". Calls skipped by -max-in-flight leave the exit code at 0 (cmd/parallax/main.go:175-181). With the default 20 calls/s and 5 s timeout, slow but healthy targets can exceed 64 in flight. The docs now tell CI to fail when the pass line reports skipped above 0.
• A broken manifest table. The Hard limits paragraph sat between table rows, so the run.allow / run.deny row rendered as raw pipes. That row is the only place "deny always wins" is stated.
• Smaller corrections:
  • detail is cut to 512 bytes, then ....
  • A baseURL fragment is rejected.
  • Dry-run exit 2 also covers the hard limits.
  • Skipped result lines are documented: empty traceId, no probe span, and counted in calls.
  • The -allow-link-local link now points to the guard section.
  • The Hub page now says "Paced and bounded" and gives the 1 to 4096 range.

Engine issues (for the engine owner, not changed here)

1. Egress guard bypass through an HTTP proxy. Above, a probe to 169.254.169.254 is sent to the proxy, and the proxy decides. If the guard is meant to hold with a proxy, it has to check the target before proxying.
2. An empty fragment passes validation. With baseURL: http://svc#, manifest.go:256 special-cases only a trailing ?, so # passes and every route then probes /.

Verification

• Passed the C2 docs gate (Steelman, Constitutional, Devil's Advocate, then LLM-as-Judge): README 0.93, DOCKERHUB.md 0.92, no Critical findings. The gate verified the gRPC proxy bypass against the grpc-go v1.84.0 source.
• The CI glyph guard is clean.

After merge

Re-paste DOCKERHUB.md onto Docker Hub, from the # Parallax line down.

🤖 Generated with Claude Code