[Brian Krabach (bkrabach)]

Summary

• Add AMPLIFIER_SKIP_STARTUP_UPDATE_CHECK=1 as a process-local opt-out for the automatic startup update checker.
• Return before reading update settings, contacting update sources, or writing the last-check timestamp.
• Document the exact-value behavior and add regression coverage for the opt-out, unchanged frequency policy, and explicit amplifier update.

Motivation

An engineering worker with a read-only configuration home can fail during automatic startup update bookkeeping: timestamp persistence attempts to acquire ~/.amplifier/settings.yaml.lock, raises EROFS, and the error handler attempts the same save again.

This PR provides a narrow opt-out for callers that deliberately suppress automatic update work without changing saved settings or making shared installations writable.

AMPLIFIER_SKIP_STARTUP_UPDATE_CHECK=1 amplifier run "your prompt"

Only the exact value 1 opts out. Unset, empty, 0, true, and whitespace-padded values retain the existing behavior.

Verification

The original change was built and installed as a wheel in an isolated test environment on October 11, 2026:

• 25 passing cases across tests/test_startup_checker.py and tests/test_run_sigint_main_thread_guard.py.
• 54 passing cases in tests/test_update_reporting.py.
• Three guarded installed startup-entry probes through _run_startup_update_check, with missing, malformed, and valid settings: no update-settings or network attempts were recorded under the opt-out.

The PR is a single clean cherry-pick onto the current upstream base. The implementation, new tests, and README are byte-identical to the previously verified change; the AGENTS addition contains only startup-control guidance. Stable patch identity matches the original change. Unrelated local launcher-repair commits are excluded.

These results are retained verification evidence, not a fresh full-suite run on the PR branch. Repository CI results remain separate.

Scope and limits

• Default automatic-check behavior, including its existing timestamp-save error handling, is unchanged.
• Explicit amplifier update remains enabled; the new regression invokes its real Click command with mocked update boundaries.
• This is not a general read-only mode, runtime-isolation profile, full CLI worker-launch proof, or fix for long-running model calls.
• No launcher, shared installation, credentials, or settings files are changed by this PR.