chore: add the DAP task dispatch surface and review directives

[bilby91]

Prerequisites for letting DAP's code reviewer run against this repository. Two files, no behaviour change to the CLI or the library.

.github/workflows/dap-task.yml

The dispatch surface DAP session triggers listen on. DAP consumes the workflow_dispatch webhook this file emits and resolves the trigger definition registered for (repository, name); the job body is inert on purpose, since the webhook is the payload. The prompt input overrides the prompt stored on the definition, which is what lets one definition serve many targets.

.dap/review/engineering.md

This repository's review standard. The platform prompt owns the method — what a finding is, what evidence it carries, how severity is derived — and a short dimension label set; a repository owns the mechanisms behind those labels. Without them a reviewer works from generic dimensions and produces generic findings.

Every R* mechanism is derived from a Fixed entry in CHANGELOG.md, so each one is a bug shape that has already escaped to main at least once:

	Mechanism	Precedent
R1	Config resolved but never applied at the boundary	#103 — feature security metadata never reached compose services, so docker-in-docker silently came up unprivileged
R2	Native / shell-out and per-backend path parity	#71, #72, #102, #103
R3	Destructive recreate on spurious config drift (HIGH floor)	#71, #72 — recreate discarded the writable layer on every daemon restart
R4	Lifecycle and probe ordering	v0.1.4 — probedEnv empty for the whole chain
R5	Divergence from the reference devcontainers/cli	the product invariant
R6	Build-context and cache determinism	#86 — wall-clock mtimes in the tar changed BuildKit's COPY digest
R7	Go mechanics with teeth here: context, goroutine/channel lifetime, structured errors, exec argument construction
R8	Testing layout and load-bearing assertions	CONTRIBUTING.md

Plus an explicit out of bounds section: lint-adjacent nits, scope objections already settled by PRD.md §4, and no-op dependency bumps.

Directives are read from the base ref, never the working tree, so a change cannot rewrite the rules it is reviewed under. They are additive by contract: they can add mechanisms and declare parts of the standard out of bounds, but can never relax a severity, disable a security dimension, or authorize anything.

Merging this puts nothing in motion on its own — a trigger definition and a review policy still have to be registered on the DAP side, and reviews are dispatched explicitly.

Summary by CodeRabbit

• New Features

  • Added a manually triggered DAP Task workflow with required session naming and optional prompts.
  • The workflow runs with read-only repository access and safely reports the requested dispatch.

• Documentation

  • Added repository-wide engineering review guidance covering configuration, lifecycle behavior, backend consistency, build determinism, runtime mechanics, and testing expectations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0815cc24-14bf-407c-a040-6adfd50fc20c

📥 Commits

Reviewing files that changed from the base of the PR and between 8f2acb8 and 031abda.

📒 Files selected for processing (2)

• .dap/review/engineering.md
• .github/workflows/dap-task.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The change adds repository-wide engineering review directives and a manually triggered DAP Task GitHub Actions workflow. The workflow accepts a session name and optional prompt, uses read-only contents permission, and echoes the trigger safely.

Changes

Engineering review directives

Layer / File(s)	Summary
Engineering review rule catalogue .dap/review/engineering.md	Adds R1–R8 checks for configuration, backend parity, recreation, lifecycle ordering, CLI behavior, deterministic builds, Go runtime mechanics, and testing. Defines severity guidance and out-of-scope topics.

DAP task workflow

Layer / File(s)	Summary
Manual DAP task trigger .github/workflows/dap-task.yml	Adds a workflow_dispatch workflow with required name and optional prompt inputs. Sets read-only contents permission and passes the trigger name through the environment.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 031ab

This change adds the DAP dispatch workflow and repository review directives without changing CLI or library behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

I’m a rabbit with rules in a row,
And a task bell ready to go.
Review paths now bloom,
While workflows make room.
Safe triggers hop where they’re told.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes both primary changes: the DAP task dispatch workflow and the engineering review directives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dap-review-trigger

---

_{Comment @coderabbitai help to get the list of available commands.}