diff --git a/.env.example b/.env.example
index a655bfc..e3d34bb 100644
--- a/.env.example
+++ b/.env.example
@@ -11,6 +11,32 @@ MEDIA_OPS_REVIEW_PORT=8787
# Optional direct token override. Prefer local review-server generated files.
MEDIA_OPS_REVIEW_TOKEN=
+# X / Twitter API for approved publishing and metric collection.
+# Keep real values only in your local .env or system keychain.
+X_API_KEY=
+X_API_SECRET=
+X_ACCESS_TOKEN=
+X_ACCESS_TOKEN_SECRET=
+X_BEARER_TOKEN=
+
+# Image generation provider used by media-ops asset factories.
+OPENAI_API_KEY=
+OPENAI_IMAGE_MODEL=gpt-image-1
+
+# Video generation provider. Use either Seedance token or Volcengine AK/SK.
+SEEDANCE_API_TOKEN=
+VOLCENGINE_ACCESS_KEY_ID=
+VOLCENGINE_SECRET_ACCESS_KEY=
+
+# Optional Reddit API app for trend ingestion and future approved publishing.
+REDDIT_CLIENT_ID=
+REDDIT_CLIENT_SECRET=
+REDDIT_REFRESH_TOKEN=
+REDDIT_USER_AGENT=botcom-workbench-local/0.1
+
+# Browser profile used only for local, approved domestic-platform workflows.
+MEDIA_OPS_BROWSER_PROFILE_DIR=$HOME/BotCom/browser-profile
+
# Feishu / Lark custom bot
FEISHU_BOT_WEBHOOK=
FEISHU_BOT_SECRET=
diff --git a/README.md b/README.md
index 08a82e5..da6f6fc 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,7 @@ Core operating modules:
- operating-state snapshot;
- eight-module one-person company map;
- local operating adapters for CRM, delivery, revenue, assets, and automation;
+ - Growth Autopilot benchmark panel for social-media operating loops;
- approval queues and mobile approval links;
- service health, blockers, next actions, and review suggestions.
- AI beginner guide explaining agents, skills, models, API keys, context, and approval queues.
@@ -172,6 +173,8 @@ BotCom Workbench only proxies to `127.0.0.1`; it does not accept arbitrary backe
See `docs/INTEGRATION.md`.
+For the Growth Autopilot loop and social-media benchmark model, see `docs/GROWTH_AUTOPILOT.md`.
+
For the broader product model, see `docs/ONE_PERSON_COMPANY_OS.md`.
## Notifications
@@ -215,6 +218,7 @@ See `docs/SECURITY.md`.
- `docs/ARCHITECTURE.md`
- `docs/CONFIGURATION.md`
+- `docs/GROWTH_AUTOPILOT.md`
- `docs/INTEGRATION.md`
- `docs/ONE_PERSON_COMPANY_OS.md`
- `docs/PUBLISHING.md`
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index e0bfd93..1eefcc8 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -63,6 +63,37 @@ WECHAT_BOT_WEBHOOK=
WECHAT_WEBHOOK=
```
+## Growth Autopilot connectors
+
+These variables are optional until you enable the related connector. Keep real values in local `.env` or the OS keychain; do not commit them.
+
+```text
+# X API
+X_API_KEY=
+X_API_SECRET=
+X_ACCESS_TOKEN=
+X_ACCESS_TOKEN_SECRET=
+X_BEARER_TOKEN=
+
+# Image generation
+OPENAI_API_KEY=
+OPENAI_IMAGE_MODEL=gpt-image-1
+
+# Video generation
+SEEDANCE_API_TOKEN=
+VOLCENGINE_ACCESS_KEY_ID=
+VOLCENGINE_SECRET_ACCESS_KEY=
+
+# Reddit trend ingestion / approved posting
+REDDIT_CLIENT_ID=
+REDDIT_CLIENT_SECRET=
+REDDIT_REFRESH_TOKEN=
+REDDIT_USER_AGENT=botcom-workbench-local/0.1
+
+# Local browser-assisted domestic-platform workflows
+MEDIA_OPS_BROWSER_PROFILE_DIR=$HOME/BotCom/browser-profile
+```
+
## Local env files
The notification bridge reads, in order:
diff --git a/docs/GROWTH_AUTOPILOT.md b/docs/GROWTH_AUTOPILOT.md
new file mode 100644
index 0000000..ce4d6d8
--- /dev/null
+++ b/docs/GROWTH_AUTOPILOT.md
@@ -0,0 +1,115 @@
+# Growth Autopilot
+
+Growth Autopilot is BotCom Workbench's operating loop for AI-assisted social growth. It is designed for one-person companies that want AI workers to run the heavy work while the owner only reviews high-risk decisions.
+
+The goal is not to clone a scheduler. The loop covers the full operating chain:
+
+```text
+trend signals
+ -> positioning and experiment hypothesis
+ -> platform-specific drafts
+ -> image/video asset factory
+ -> quality and compliance gates
+ -> owner approval queue
+ -> publish-prep or approved publishing connector
+ -> metric capture
+ -> next experiment
+```
+
+## Public benchmark posture
+
+BotCom compares the local workflow against public reference products and workflow patterns:
+
+- Postiz-style open-source AI social scheduling;
+- n8n-style automation graphs and social templates;
+- Buffer-style creator scheduling and analytics;
+- Publer-style bulk scheduling and recurring content workflows.
+
+Those systems are useful references, but most of them are scheduler-centric. BotCom's differentiator is the company-level loop: strategy, agent roles, content matrix, asset generation, quality gate, approval UX, connectors, metrics, and the next experiment are evaluated together.
+
+## Local reports
+
+When a compatible `media-ops` workspace is present, the BotCom OS dashboard reads:
+
+```text
+$BOTCOM_MEDIA_OPS_ROOT/reports/growth_autopilot.json
+$BOTCOM_MEDIA_OPS_ROOT/reports/growth_autopilot.md
+$BOTCOM_MEDIA_OPS_ROOT/research/latest_public_benchmark.md
+```
+
+The desktop UI shows:
+
+- BotCom loop score;
+- best public reference score;
+- margin;
+- capability matrix;
+- missing credentials or login steps;
+- recent loop findings;
+- buttons to rerun the loop or open reports.
+
+The score is an architectural and readiness benchmark. Real growth performance still depends on live credentials, platform permissions, publishing cadence, and 24-hour / 72-hour metric feedback.
+
+## Owner approval model
+
+Growth Autopilot should keep irreversible or reputation-sensitive actions behind owner approval:
+
+- account connection;
+- platform publishing;
+- paid API usage above local thresholds;
+- external messages to customers or communities;
+- monetization offers;
+- policy-sensitive content.
+
+Safe local steps can run automatically:
+
+- research summarization;
+- draft generation;
+- image/video draft generation;
+- formatting;
+- queue creation;
+- quality checks;
+- report generation;
+- metric analysis after import.
+
+## Credential slots
+
+Keep real credentials out of Git. Use local `.env`, the operating system keychain, or an approved secret manager.
+
+Common variables:
+
+```text
+X_API_KEY=
+X_API_SECRET=
+X_ACCESS_TOKEN=
+X_ACCESS_TOKEN_SECRET=
+OPENAI_API_KEY=
+OPENAI_IMAGE_MODEL=gpt-image-1
+SEEDANCE_API_TOKEN=
+VOLCENGINE_ACCESS_KEY_ID=
+VOLCENGINE_SECRET_ACCESS_KEY=
+REDDIT_CLIENT_ID=
+REDDIT_CLIENT_SECRET=
+REDDIT_REFRESH_TOKEN=
+FEISHU_BOT_WEBHOOK=
+WECHAT_WORK_BOT_WEBHOOK=
+MEDIA_OPS_BROWSER_PROFILE_DIR=$HOME/BotCom/browser-profile
+```
+
+## Platform connector stance
+
+- **X**: prefer official API for posting and public metrics.
+- **Reddit**: prefer official OAuth API for trend ingestion and approved posting.
+- **TikTok / Douyin**: prefer official content posting APIs where account permissions allow it; use local browser-assisted steps only when explicitly approved by the operator and allowed by the platform/account context.
+- **Xiaohongshu**: treat direct publishing as a connector slot. Use official partner/open-platform paths when available; otherwise keep publishing in owner-reviewed browser or service-provider workflows.
+
+## Extending the loop
+
+A new connector or generator should expose:
+
+1. `status`: ready, blocked, missing credentials, last successful run;
+2. `inputs`: accepted local files or queue fields;
+3. `actions`: dry-run, prepare, publish, collect metrics;
+4. `evidence`: local logs, request IDs, generated files, metric snapshots;
+5. `risk`: whether owner approval is required.
+
+This keeps the product usable for non-technical operators while preserving auditability for advanced users.
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 4ebec88..92f6c68 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -15,6 +15,7 @@
- Installer-friendly first-run setup.
- In-app environment configuration screen.
- Optional sample media-ops workspace generator.
+- Growth Autopilot panel: public workflow benchmark, capability matrix, missing-credential checklist, and loop rerun command.
- Better empty-state guidance when no operating adapters are configured.
- Adapter contracts for CRM, delivery, revenue, assets, and metrics.
- Signed and notarized macOS release.
diff --git a/public/app.js b/public/app.js
index eb1bbd6..1eff3ed 100644
--- a/public/app.js
+++ b/public/app.js
@@ -1880,8 +1880,9 @@ function hlTerm(text, term) {
// ---------- BotCom OS:一人公司经营控制台 ----------
const botcomDashboard = {
- ov: null, data: null, review: null, reviewError: '',
- async show() {
+ ov: null, data: null, review: null, reviewError: '', focus: '',
+ async show(focus = '') {
+ this.focus = focus;
if (this.ov) this.ov.remove();
const ov = document.createElement('div');
this.ov = ov;
@@ -2177,6 +2178,48 @@ const botcomDashboard = {
`;
},
+ growthAutopilotSection(autopilot) {
+ if (!autopilot || !autopilot.score) {
+ return `