One new page a day
Signals from your own Search Console snapshots — pages losing impressions, queries you don't cover — become a D2-reviewed task. Once approved, it turns into a GitHub PR with the evidence attached.
SELF-HOSTED · BYOK · DAILY PR
One PR a day. Your servers. Your keys.
growth-agent is a minimal growth agent you self-host: every day it ships one new-content PR and one page-fix PR. Every publish decision is graded by the zeus decision kernel (D2 human review) and merged by you on GitHub — the last step online is always yours. Once a week, a ranking report.
$ npm run batch -- daily --site example.com
signal gsc: pages losing impressions · uncovered queries
decide zeus: D2 decision submitted · awaiting_approval (sla 24h)
approve ops-console card → you approve → task = drafting
draft inbox/loom: no draft file, no fabricated content
qa intent ✓ · dedupe ✓ · value ✓ (results visible)
publish PR opened by bot — never merged by bot
report weekly-<week>-v<n>.md · append-only · cost ledgerCORE LOOP
What one day of growth work looks like
Not a dashboard you have to operate — one finished unit of growth work, delivered as a pull request you can inspect.
One page fix a day
Pages sliding in the rankings get a rewrite PR — title, meta, content — through the same approval chain. A fix task argues only from its own target page's data, never padded with site-wide stats.
Monitoring that feeds tomorrow
Daily GSC snapshots (strictly read-only) and SERP rank tracking on your own supplier key become the signal source for the next day's tasks.
A weekly report you can audit
Adoption rate, human edits per merged PR, rank / impression / click deltas, and what your own API keys actually cost — versioned, append-only, never overwritten, never emailed.
HOW IT RUNS
From docker compose up to a merged PR
Five steps. Every connector defaults to an offline fixture, so the whole pipeline runs before you hand over a single credential.
Self-host the stack
One compose file brings up the orchestrator and the zeus decision kernel; a 2-core 4 GB box is enough. /healthz reports database dialect, credential presence and startup reconciliation — any online mode missing credentials fails closed at boot.
docker compose up -d --build && curl localhost:8790/healthzBring your own keys
GSC installed-app OAuth (read-only scope, refresh token sealed with AES-256-GCM), your own SERP supplier account, a repo-scoped GitHub PAT. Credentials live only in .env or your secrets store — never in the business database, logs or git history.
cp .env.example .env # GA_GSC_*, GA_SERP_*, GA_GITHUB_*The batch ticks
The scheduler sidecar runs daily → production → verify every tick. All three are idempotent, so an empty tick is a no-op; report and packet run on their own schedule because they version their output.
npm run batch -- daily|production|verify --site <site>You approve
Every content decision lands in the approval console as a D2 card with a 24-hour SLA and a deep link. No approve-in-IM, no auto-release path — if you don't decide, it waits and reminds you.
You merge
The bot opens branches and PRs and never merges. Your merge webhook flips the task, verify re-checks the page later, and API spend lands in the cost ledger for the weekly report.
HARD CONSTRAINTS
Guardrails you cannot switch off
These are compile-time rules, not settings. They exist so a growth agent can never turn into a scaled-content machine.
D2 human review with a 24h SLA — no D0/D1 auto-approval path exists for content
PRs only, never merged — the last step online is always your merge
Hard daily cap of 1 write + 1 fix — there is no “10 posts a day” tier
GSC strictly read-only (webmasters.readonly); refresh token encrypted at rest
QA triple gate — intent, dedupe, value — runs before a PR opens, results visible
Fail-closed everywhere — missing credentials never silently fall back to fixtures
WHO IT'S FOR
Built for owners, not dashboard renters
Three profiles from the product requirement doc. Phase one serves P1 only; the rest follow after dogfood.
Multi-site indie builders
You run 3–20 Git-published sites (Astro / Next / static), know docker and PRs, refuse to rent a full SEO suite — and want one real unit of work done every day, with data never leaving your VPS.
Teams that guard data sovereignty
Content or marketing teams of 3–10 who are sensitive about GSC grants and data egress: clear compliance boundaries, an approval console with role separation, no black-box automation.
Merchants who outgrew suites
You bought Semrush and used 5% of it. You want traffic, not another dashboard. Served by an optional hosted edition in a later phase — phase one is deliberately not for you.
Dogfood starts on our own sites first
The 30-day dogfood plan runs on the author's own properties before any external install. If you want your site on the list after that, send a note.