XYAIStudio · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,12 @@
 
 ### 新增
 
+- Finished self-growth loop: `freeos org loop run` compiles blueprints, promotes colleagues, registers FreeOS chat agents, publishes an asset pack, applies it to openXYOS (HTTP + local mirror), imports back, and proves governance blocks high-risk tools
+- `freeos org assets apply` POSTs/PUTs employees, talent, plugins, and module-settings; durable `{FREEOS_HOME}/openxyos-mirror/`
+- Inbound import / lifecycle `shadow|active` spawn real FreeOS agents (`org-<slug>`) via the host agents table + routing
+- Host-wide governance: `OrgGovernanceMiddleware` spliced into the harness tool path so pending/deny cannot execute
+- Colleague routing + org-knowledge live memory so produced employees are usable in FreeOS chat
+- Demo fixtures in `tests/fixtures/org-loop/` and e2e proof `tests/e2e/test_org_growth_loop.py`
 - Phase A: `xyos-governance-mcp` default-denies high-risk tools and durable-pauses for human approval (`freeos org governance`)
 - Phase A: module ↔ skill bridge generates catalog skills with tenant headers and a tenant-toggle publish draft (`freeos org skills`)
 - Phase B: `xyos2freeos` compiles `openxyos.agent-blueprint.v1` into tenant-scoped employee workspaces

diff --git a/README.md b/README.md
@@ -3,7 +3,7 @@
 </p>
 
 <p align="center">
-  <strong>FreeOS — a self-hosted multi-user, multi-agent assistant with an optional organization OS.</strong>
+  <strong>FreeOS — a self-hosted multi-agent OS that grows its own AI workforce.</strong>
 </p>
 
 <p align="center">
@@ -12,16 +12,44 @@
 </p>
 
 <p align="center">
+  <a href="#run-the-self-growth-loop">The loop</a> ·
   <a href="#run-freeos">Run</a> ·
-  <a href="#enable-the-organization-module">Organization module</a> ·
   <a href="#license-and-attribution">License</a> ·
   <a href="docs/architecture-integration.md">Architecture</a>
 </p>
 
-**FreeOS** is an independent open-source host for teams and individuals. The control plane is derived from [Octop](https://github.com/TencentCloud/Octop) (MIT). Organization capabilities come from [openXYOS](https://github.com/XYAIStudio/openXYOS) (Apache-2.0), wired as an **enable/disable sidecar module** — not a trademark or product affiliation with Tencent Cloud or XYAIStudio.
+**FreeOS** is an independent open-source host. The data plane is derived from [Octop](https://github.com/TencentCloud/Octop) (MIT). The organization control plane comes from [openXYOS](https://github.com/XYAIStudio/openXYOS) (Apache-2.0). They are complementary: FreeOS **produces** AI employees, skills, plugins, and MCPs; those assets **assemble into openXYOS**; openXYOS blueprints, catalog, policies, and talent **feed back** into FreeOS to spawn or upgrade more runtime agents.
 
 The web shell, README banner, favicons, and PWA icons use the FreeOS circular mark (gray ring, yellow / green / red teardrops, blue center).
 
+## Run the self-growth loop
+
+This is the product path. One command compiles a blueprint into an AI employee, promotes it `draft → market → recruit → shadow → active`, registers a FreeOS chat agent, publishes an asset pack, applies that pack onto openXYOS-shaped surfaces (live HTTP when `OPENXYOS_BASE_URL` is set, otherwise a durable local mirror), imports the control plane back, and proves governance still **blocks** high-risk tools.
+
+```bash
+git clone https://github.com/XYAIStudio/FreeOS.git
+cd FreeOS
+uv sync
+uv run freeos org loop run
+```
+
+Equivalent: `bash scripts/org-loop.sh`.
+
+CI / scripted proof of the same loop:
+
+```bash
+uv run pytest tests/e2e/test_org_growth_loop.py tests/unit/test_org_loop.py tests/unit/test_openxyos_apply.py tests/unit/test_colleague_spawn.py tests/unit/test_host_governance.py
+```
+
+| When | What happens |
+|---|---|
+| `OPENXYOS_BASE_URL` unset / sidecar down | Uses `tests/fixtures/org-loop/` and writes `{FREEOS_HOME}/openxyos-mirror/` |
+| `OPENXYOS_BASE_URL` (or `FREEOS_ORG_SIDECAR_URL`) set | Also POST/PUT `/api/employees`, `/api/talent`, `/api/plugins`, `/api/module-settings` |
+
+High-risk tools (`outbound`, `delete`, `pay`, `prod`) are default-denied in the host tool path (`OrgGovernanceMiddleware` + `xyos-governance-mcp`). `execute` stays false until `freeos org governance approve <id>` and the agent re-checks with the same args.
+
+Operator detail: [docs/asset-loop.md](docs/asset-loop.md).
+
 ## Run FreeOS
 
 ### Prerequisites
@@ -32,16 +60,13 @@ The web shell, README banner, favicons, and PWA icons use the FreeOS circular ma
 ### From this repository
 
 ```bash
-git clone https://github.com/XYAIStudio/FreeOS.git
-cd FreeOS
-uv sync
 uv run freeos init
 uv run freeos run
 ```
 
-`freeos` is an alias of the upstream `octop` CLI (same package). Either name works.
+`freeos` is the product CLI. `octop` remains a package-compatible alias.
 
-Open the dashboard (default port is the Octop/FreeOS listen port printed by `run`, commonly `http://127.0.0.1:18900`). Complete the first-run wizard.
+Open the dashboard (default listen port is printed by `run`, commonly `http://127.0.0.1:18900`). Complete the first-run wizard.
 
 Data directory precedence:
 
@@ -64,10 +89,10 @@ The Vite app in `dashboard/` is what you edit; packaged builds land in `src/octo
 ### Tests
 
 ```bash
-uv run pytest tests/unit/test_org_module.py tests/unit/test_paths.py tests/unit/test_bundled_plugins_layout.py tests/unit/test_governance_mcp.py tests/unit/test_skill_bridge.py tests/unit/test_blueprint_compiler.py tests/unit/test_lifecycle.py tests/unit/test_asset_loop.py
+uv run pytest tests/e2e/test_org_growth_loop.py tests/unit/test_org_loop.py tests/unit/test_org_module.py tests/unit/test_governance_mcp.py tests/unit/test_skill_bridge.py tests/unit/test_blueprint_compiler.py tests/unit/test_lifecycle.py tests/unit/test_asset_loop.py tests/unit/test_openxyos_apply.py tests/unit/test_colleague_spawn.py tests/unit/test_host_governance.py
 ```
 
-Full Octop-derived suite: `uv run pytest` / `make test-fast` (needs the usual extra services for marked tests).
+Full host suite: `uv run pytest` / `make test-fast` (needs the usual extra services for marked tests).
 
 ## Enable the organization module
 
@@ -86,56 +111,25 @@ Then start the sidecar (Node 20+):
 bash scripts/run-org-sidecar.sh
 ```
 
-Default origin: `http://127.0.0.1:3780` (`FREEOS_ORG_SIDECAR_URL` / `FREEOS_ORG_SIDECAR_PORT` to override). When `/api/health/livez` succeeds, `/organization` embeds the org console and `/api/org-module/sidecar/*` proxies to it.
-
-Sidecar env is generated at `modules/openxyos/.env` on first launch (do not commit secrets). See `modules/openxyos/.env.example` and [docs/architecture-integration.md](docs/architecture-integration.md).
-
-**Auth (MVP):** FreeOS JWT users and openXYOS tenants are separate. The proxy forwards `X-FreeOS-User*` and `X-FreeOS-Tenant-Id`; sign in to the sidecar for mutating org APIs. One tenant = one workspace/sandbox — not prompt isolation.
-
-## Phase A — governance MCP + module skills
+Default origin: `http://127.0.0.1:3780` (`FREEOS_ORG_SIDECAR_URL` / `OPENXYOS_BASE_URL` / `FREEOS_ORG_SIDECAR_PORT` to override). When `/api/health/livez` succeeds, `/organization` embeds the org console and `/api/org-module/sidecar/*` proxies to it.
 
-openXYOS is the **control plane**. FreeOS/Octop stays the **data plane** (do not replace Octop chat). Phase A inserts governance before high-risk tools and generates skills from the module catalog.
+**Auth:** FreeOS JWT users and openXYOS tenants are separate. The proxy forwards `X-FreeOS-User*` and `X-FreeOS-Tenant-Id`. One tenant = one workspace/sandbox — not prompt isolation.
 
-### Direction 2 — `xyos-governance-mcp`
+### Manual loop steps (the one command above already does this)
 
 ```bash
-uv run freeos org governance enable
-# writes {FREEOS_HOME}/governance/xyos-governance-mcp.json — add that stdio server to the agent
-uv run xyos-governance-mcp   # optional: run by hand
-uv run freeos org governance check --tool delete_employee --category delete
-```
-
-High-risk classes (`outbound`, `delete`, `pay`, `prod`) **default-deny**. Human approval is a durable pause under `~/.freeos/governance/pauses/`. `execute` stays false until `freeos org governance approve <id>` (or IM `/approve` once wired) and the agent **re-checks** with the same args. How-to: [src/octop/modules/org_os/governance/README.md](src/octop/modules/org_os/governance/README.md).
-
-### Direction 3 — module ↔ skill bridge
-
-```bash
-uv run freeos org skills generate
-uv run freeos org skills publish ~/.freeos/org-skills/org-employees
-```
-
-Each generated `SKILL.md` calls real `/api/…` routes through `/api/org-module/sidecar` with tenant headers. Publish writes a **disabled** tenant-toggleable plugin draft — it does not auto-enable. How-to: [src/octop/modules/org_os/skill_bridge/README.md](src/octop/modules/org_os/skill_bridge/README.md).
-
-### Phase B — grow the AI workforce (blueprints, lifecycle, asset loop)
-
-Non-developer loop (details in [docs/asset-loop.md](docs/asset-loop.md)):
-
-```bash
-uv run freeos org assets import --catalog --blueprint tests/fixtures/agent-blueprint.v1.json --tenant-id 1
+uv run freeos org enable
+uv run freeos org governance enable --tenant-id 1
+uv run freeos org assets import --catalog --blueprint tests/fixtures/org-loop/agent-blueprint.v1.json --tenant-id 1
 uv run freeos org employee transition policy-analyst market
 uv run freeos org employee transition policy-analyst recruit
 uv run freeos org employee transition policy-analyst shadow
 uv run freeos org employee transition policy-analyst active
 uv run freeos org assets publish
-uv run freeos org employee export-profile policy-analyst --tenant-id 1
+uv run freeos org assets apply
 ```
 
-- **Inbound:** catalog / blueprint / policies → skills + employee workspace (`xyos2freeos`)
-- **Lifecycle:** `draft → market → recruit → shadow → active → offboard` (offboard revokes `.env` and archives MEMORY)
-- **Outbound:** asset pack + openXYOS-shaped drafts (not auto-enabled)
-- High-risk tools still go through Phase A governance
-
-Phase C (chat routing, reflections, org-as-code) stays architecture-only.
+Inbound import compiles the blueprint **and** registers a FreeOS agent (`org-policy-analyst`) so the colleague is addressable in chat. Governance is spliced into the host tool path — a pending/deny decision is a hard stop.
 
 ## Host platform features (from Octop)
 
@@ -153,12 +147,11 @@ Longer host docs: [docs/user-guide.md](docs/user-guide.md), [docs/configuration.
 
 ## Remaining `octop` identifiers
 
-Intentional for MVP compatibility (not a rebrand miss):
+Intentional for package compatibility (not a rebrand miss):
 
 - Python package name `octop` and `import octop`
 - CLI `octop` alongside `freeos`
 - `OCTOP_*` environment variables
 - SQLite file `octop.db` inside the home directory
-- Many internal tests and IM strings
 
-See [docs/architecture-integration.md](docs/architecture-integration.md) for the seven integration directions, Phase A/B/C, and the chosen MVP topology.
+See [docs/architecture-integration.md](docs/architecture-integration.md) for the control/data-plane split and the running self-growth loop.
diff --git a/README_CN.md b/README_CN.md
@@ -3,10 +3,10 @@
 </p>
 
 <p align="center">
-  <strong>FreeOS — 自托管多用户、多 Agent 助手，可选组织 OS 模块。</strong>
+  <strong>FreeOS — 自托管多智能体 OS，能生产并回收自己的 AI 员工。</strong>
 </p>
 
-<p align="center">运行、组织模块、治理 MCP、蓝图编译与资产环见 <a href="README.md">README.md</a>；七条集成方向见 <a href="docs/architecture-integration.md">docs/architecture-integration.md</a>；非开发者闭环见 <a href="docs/asset-loop.md">docs/asset-loop.md</a>。</p>
+<p align="center">产品闭环：<code>uv run freeos org loop run</code>。详见 <a href="README.md">README.md</a> 与 <a href="docs/asset-loop.md">docs/asset-loop.md</a>。</p>
 
 <p align="center">
   <a href="https://www.python.org/downloads/"><img alt="Python 3.12+" src="https://img.shields.io/badge/python-3.12%2B-blue?logo=python&logoColor=white" /></a>

diff --git a/dashboard/src/locales/en.json b/dashboard/src/locales/en.json
@@ -8,13 +8,13 @@
   },
   "organization": {
     "title": "Organization OS",
-    "subtitle": "Enable the openXYOS organization module as a FreeOS sidecar.",
+    "subtitle": "Grow AI employees through the FreeOS ↔ openXYOS loop. Enable the organization control plane as a sidecar.",
     "toggleLabel": "Enable organization module",
     "on": "Enabled",
     "off": "Disabled",
     "sidecarUp": "Sidecar reachable",
     "sidecarDown": "Sidecar offline",
-    "bridgeHint": "This is a modular bridge: FreeOS keeps the host identity and plugins; openXYOS serves org APIs and UI on a sidecar.",
+    "bridgeHint": "FreeOS produces employees, skills, plugins, and MCPs. Those assets assemble into openXYOS; org blueprints and policies feed back into FreeOS. Run `freeos org loop run` to prove the loop.",
     "home": "Data home",
     "sidecar": "Sidecar URL",
     "startSidecarTitle": "Start the organization sidecar",

diff --git a/dashboard/src/locales/zh.json b/dashboard/src/locales/zh.json
@@ -8,13 +8,13 @@
   },
   "organization": {
     "title": "组织 OS",
-    "subtitle": "将 openXYOS 组织能力作为 FreeOS 模块启用或关闭。",
+    "subtitle": "通过 FreeOS ↔ openXYOS 闭环生产 AI 员工。将组织控制面作为边车启用。",
     "toggleLabel": "启用组织模块",
     "on": "已启用",
     "off": "已关闭",
     "sidecarUp": "边车可达",
     "sidecarDown": "边车未运行",
-    "bridgeHint": "这是模块化桥接：FreeOS 保留宿主身份与插件；openXYOS 在边车中提供组织 API 与界面。",
+    "bridgeHint": "FreeOS 生产员工、技能、插件与 MCP；这些资产组装进 openXYOS，组织蓝图与策略再回流到 FreeOS。用 `freeos org loop run` 跑通闭环。",
     "home": "数据目录",
     "sidecar": "边车地址",
     "startSidecarTitle": "启动组织边车",

diff --git a/docs/architecture-integration.md b/docs/architecture-integration.md
@@ -20,10 +20,8 @@ FreeOS grows its own AI workforce and capability catalog:
 3. openXYOS assets (org tree, `openxyos.agent-blueprint.v1`, governance,
    module catalog, talent market, knowledge/reflections) **feed back**
    into FreeOS to spawn or upgrade more runtime agents and skills.
-4. The loop repeats. Phase A is the safety gate + module↔skill pipe.
-   Phase B is the blueprint compiler, colleague lifecycle, and the
-   bidirectional asset factory. Operator guide:
-   [asset-loop.md](asset-loop.md).
+4. The loop repeats and is **runnable**: `freeos org loop run`. Operator
+   guide: [asset-loop.md](asset-loop.md).
 
 FreeOS is an independent project. It is not affiliated with Tencent Cloud,
 Octop, XYAIStudio, or XYOS trademarks beyond accurate license attribution.
@@ -46,11 +44,12 @@ See [NOTICE](../NOTICE) and `modules/openxyos/TRADEMARKS.md`.
   talent market                     running agent instances
 ```
 
-## Chosen MVP topology (Phase A — Directions 2 + 3)
+## Running topology
 
-Phase A does **not** compile blueprints or merge chat UIs. It inserts
-governance in front of high-risk data-plane tools, and generates real
-module skills that call sidecar `/api/*` with tenant headers.
+The host inserts governance in front of high-risk data-plane tools,
+generates module skills that call sidecar `/api/*` with tenant headers,
+compiles blueprints into chat-usable colleagues, and applies asset packs
+onto openXYOS-shaped surfaces.
 
 ```
                  ┌─────────────────────────────────────────────┐
@@ -127,11 +126,9 @@ Polished → freeos org skills publish <dir>
          → operator enables per tenant; not auto-on
 ```
 
-## Seven directions
+## Seven directions (all required for the running loop)
 
-### Phase A — implement now (highest value / verifiable)
-
-#### Direction 2 — `xyos-governance-mcp`
+#### Direction 2 — `xyos-governance-mcp` + host tool_guard
 
 Wrap openXYOS governance/audit as an MCP server and insert it **before**
 high-risk tool calls.
@@ -163,7 +160,7 @@ until the pause is approved for the same action digest.
 | CLI | `freeos org skills generate` · `freeos org skills publish` |
 | How-to | `src/octop/modules/org_os/skill_bridge/README.md` |
 
-### Phase B — implemented (Directions 1 + 4 + asset loop)
+### Directions 1 + 4 + asset loop (implemented)
 
 #### Direction 1 — `xyos2freeos` / blueprint compiler
 
@@ -214,25 +211,25 @@ sidecar SQL.js.
 
 High-risk runtime actions still pass through Phase A governance.
 
-### Phase C — architecture only (do not implement in this pass)
-
-#### Direction 5 — Chat / session routing Web ↔ IM
+#### Direction 5 — Chat / session routing (implemented as far as the loop needs)
 
-One conversation identity across FreeOS dashboard chat and Octop IM
-channels. Route; do not duplicate openXYOS chat as the agent loop.
+Compiled colleagues are registered as FreeOS agents (`org-<slug>`) with a
+tenant routing table (`tenants/<id>/routing.json`). `AgentManager.resolve_user_agent`
+resolves colleague slugs and display names so produced employees are
+usable in FreeOS chat. This does **not** duplicate openXYOS chat.
 
-#### Direction 6 — Reflections ↔ harness-memory
+#### Direction 6 — Org memory hooks (implemented as far as the loop needs)
 
-openXYOS reflections become an org learning loop that writes into
-harness-memory (and back). Keep tenant isolation at the workspace
-boundary, not in the prompt.
+Colleague `MEMORY.md` + `knowledge/` sync into
+`tenants/<id>/org-knowledge/live/<slug>/`. Offboard still archives into
+`org-knowledge/archived-colleagues/`. Tenant isolation stays at the
+workspace boundary.
 
-#### Direction 7 — Org-as-code GitOps (end-state, not MVP start)
+#### Direction 7 — Org-as-code GitOps (beyond the running loop)
 
-Reconcile control-plane YAML (modules, blueprints, policy) with running
-agents. Desired end-state: git is the source of org intent; FreeOS
-instances converge. Not the starting point — the contract and runtime
-must exist first (Phases A/B).
+Reconcile control-plane YAML with running agents. The contract and
+runtime now exist; GitOps convergence remains an operator workflow on
+top of `freeos org loop run`, not a substitute for it.
 
 ## Risks (encoded in design)
 
@@ -277,7 +274,9 @@ The Phase A work sits on the existing FreeOS bootstrap:
 | Module ↔ skill bridge (Phase A) | Bridge | `freeos org skills generate|publish` |
 | Blueprint compiler (Phase B) | Bridge | `xyos2freeos` · `/api/org-module/blueprints/compile` |
 | Colleague lifecycle (Phase B) | Bridge | `freeos org employee *` · `{home}/tenants/<id>/employees/` |
-| Asset factory (Phase B) | Bridge | `freeos org assets publish\|import` · `{home}/asset-packs/` |
+| Asset factory | Bridge | `freeos org assets publish\|import\|apply` · `{home}/asset-packs/` · `{home}/openxyos-mirror/` |
+| Self-growth loop | Bridge | `freeos org loop run` · `/api/org-module/loop/run` |
+| Colleague agents | Host agents table | `org-<slug>` · `{home}/org-agents/` · tenant `routing.json` |
 | Org APIs | openXYOS sidecar | `/api/org`, `/api/employees`, `/api/governance`, `/api/module-settings`, … |
 | Org UI | openXYOS Vite/Express | sidecar `:3780`; iframe on `/organization` when healthy |
 
@@ -348,6 +347,10 @@ copy the openXYOS working directory themselves.
 | Blueprint compiler | `src/octop/modules/org_os/compiler/` |
 | Colleague lifecycle | `src/octop/modules/org_os/lifecycle/` |
 | Asset factory | `src/octop/modules/org_os/assets/` |
+| Apply + mirror | `src/octop/modules/org_os/apply/` |
+| Loop orchestrator | `src/octop/modules/org_os/loop/` |
+| Colleague spawn / routing / memory | `src/octop/modules/org_os/runtime/` |
+| Host governance middleware | `src/octop/infra/agents/middleware/org_governance.py` |
 | Bundled plugin | `src/octop/infra/agents/plugins/bundled/org-os/` |
 | Dashboard page | `dashboard/src/pages/Organization/index.tsx` |
 | CLI | `src/octop/cli/commands/org.py` |