No path to install/sync artifacts onto an existing agent — "picked up on next rebuild" is false

[juniperbevensee]

Found during a read-only audit (2026-06-12).

installBaselineTemplates runs only at agent create (lib/services/harness.ts:243) and duplicate (:1149). restart/rebuild (lib/services/docker.ts restart()) are pure docker-compose operations and never re-install artifacts.

Consequences:

• Reinstate captcha_cascade + captcha-escalation (CAPSOLVER_API_KEY now provisioned) #81's premise doesn't hold: a reinstated plugin/skill added to infra/artifacts.json will NOT reach already-created agents via rebuild — only newly-created or duplicated agents pick up manifest changes. (Concretely: agents assigned a captcha artifact won't gain captcha_cascade + captcha-escalation from a rebuild, and won't have CAPSOLVER_API_KEY unless it was set at create time.)
• Any future manifest change has the same problem: existing agents are frozen at their creation-time artifact set; the only current paths are manual copy into the hot-mounted data dir or destroy-and-recreate.

Proposal: an artifacts-sync endpoint, e.g. POST /api/harnesses/:id/artifacts/sync — diff the agent's data dir against infra/artifacts.json (+ assigned env), copy missing plugins/skills, update plugins.enabled, then recreate. Idempotent, additive-only by default (never deletes user-added artifacts), dry-run flag for visibility.

🤖 Generated with Claude Code

[juniperbevensee]

Context + prior art that any fix here must honor (flagged by Juniper):

This gap actually spans three paths, not one:

1. Create new — installBaselineTemplates at agent create (works today)
2. Import/duplicate — harness.ts:1149 (works today)
3. Update-from-latest for existing agents — the missing path, and the hard one: it must never clobber user-added or user-modified artifacts in the hot-mounted data dir while still delivering updates.

Prior art / required reading before designing:

• docs/architecture/image-vs-hsm-boundary.md — what belongs in the image vs HSM scaffolding; scaffolding is explicitly "installed at agent creation time", so this issue is proposing a new lifecycle stage, not a bugfix
• docs/specs/2026-06-03-artifact-commons-design.md — artifact commons + manifest loader design; any sync endpoint should speak the manifest, not a hardcoded list
• docs/plans/opinionated-config.md — what HSM scaffolds and why

Design constraint sharpened: additive-only is necessary but not sufficient — an artifact that shipped in the baseline and was then edited by the user in their data dir must not be overwritten by sync (hash against the shipped version, or keep a manifest of installed-at-create hashes and only update artifacts that are still pristine). Dry-run first, always report what was skipped and why.

🤖 Generated with Claude Code