feat(amp): add deterministic native workflows

[oliver-kriska]

Summary

Refresh the canonical Amp integration on current main and make its workflow behavior deterministic where the supported Plugin API allows. The generated target includes all 51 Agent Skills, 40 paired-local workflow wrappers, five native controls, five read-only specialists, bounded parallel analysis, and lifecycle safety controls.

This branch was rebased from the original #132 onto main at 3f0f117; generated artifacts were regenerated from canonical source rather than conflict-merged. The installable artifacts remain owned here and will be projected from the reviewed commit into the separately gated amp-elixir-phoenix distribution PR.

What changes

• Generate 40 workflow palette wrappers and five native controls alongside all 51 Agent Skills.
• Project the canonical Elixir, Ecto, LiveView, security, and testing reviewers into lower-cost child agents restricted to Read and finder.
• Add bounded parallel review/investigation, a persistent classified edit lock, and a bounded wrapper-activated phx-full verification gate.
• Align local wrapper resolution with Amp's supported precedence: machine-local roots first, then .agents/skills and .claude/skills from exposed workspaceRoot through its parents, then the legacy home fallback.
• Skip missing, unreadable, and non-file candidates so invalid higher-precedence entries cannot mask a valid lower source.
• Make the Bun plugin behavior harness a required CI check rather than an optional local skip.
• Compact generated metadata and share the repeated specialist contract in the output so the 95,269-byte plugin remains below Amp's hosted process-argument transport boundary while reconstructing the same enforced instructions at runtime.
• Document native skill: invoke, hosted-native versus paired-full profiles, machine-local versus personal/workspace hosted scope, independent skills/plugin publication, and skills-first rollout ordering.
• Preserve the standalone repository, generated target, gated mutable stable, paired local install, and GitHub/curl compatibility paths.

Explicit Plugin API boundary

Native skill: invoke uses Amp's effective resolver and supports local, built-in, personal hosted, and workspace hosted skills. The current Plugin API does not expose skill resolution/invocation or Amp's original nested invocation directory, so filesystem wrappers cannot correctly inject hosted-only, built-in, plugin-cache, custom-path, or unexposed nested skill bodies.

Consequently:

• hosted-native supports native skill invocation, specialists, parallel commands, and edit lock;
• paired-full supports those features plus all 40 local wrappers;
• only paired phx: full arms the plugin verification gate; native hosted skill: invoke → phx-full follows skill guidance but cannot activate that wrapper hook.

The implementation documents this boundary instead of scanning undocumented Amp caches or claiming unsupported hosted wrapper behavior.

Safety and distribution

Specialists cannot edit, run shell commands, or recursively create agents. Edit-lock paths resolve symlinks and fail closed on malformed, unreadable, or workspace-escaping state. Verification rejects piped, chained, neutralized, pre-edit, unrelated-PID, and nonzero-exit checks.

The generated plugin deliberately retains the direct GitHub/curl fallback. Promotion to the standalone distribution and mutable stable remains separately review-gated; neither is changed by this canonical PR.

Verification

Canonical commit: 3ea78b0fbae186840121aace789e86fe70e361dc

• make ci — PASS: 243 tests (including the Bun runtime harness), Claude manifest validation, all generated-target drift/snapshot checks, and full structural eval (51 skills, 26 agents). Skillspector was not installed in the orb, so the Makefile's optional security target reported its documented skip.
• make amp-runtime-smoke — PASS with Amp 0.0.1786436318-g8453bf (2026-08-11): 51 skills and plugin loaded in isolation without model calls.
• Personal hosted plugin transport pilot — PASS: the exact 95,269-byte plugin loaded user-scoped with all 45 commands and both parallel tools; the interactive edit lock blocked shell execution and hosted-only wrappers failed with their documented local-install requirement.
• make amp-target-validate — PASS: 51 skills and plugin, with regenerated golden snapshot.
• Focused resolver/runtime suite — PASS: 31 tests under Bun 1.3.14, including machine-local precedence, parent-directory resolution, invalid-entry fallback, all wrappers, specialists, parallel partial failure, edit-lock escapes, and verification lifecycle cases.
• Ruff, yamllint, Markdown lint, npm audit --audit-level=high, and git diff --check — PASS; npm audit found 0 vulnerabilities.

Review focus

The highest-value review areas are the documented hosted-wrapper boundary, local resolver precedence, Amp lifecycle assumptions, edit-lock enforcement, verification result classification, and generator-to-target parity.

---