Goat CLI 0.0.3

This release adds server groups and application stages delivered through the
orchestrator.

  • worker:orchestrator:join joins a server to a server group with the group's

enrollment secret (hidden prompt, --secret-file or --secret) and its own
machine key and name; worker:orchestrator:run reports state and facts, and
runs the group-mode runtime once the runtime paths are provisioned.

  • The CI worker serves application stages: GOAT_STAGE, GOAT_STAGE_MANIFEST,

GOAT_EXPOSE_<NAME>_PORT/_BIND, the stage's secret file and the group's
shared secrets; for group delivery it packs the stage and hands it to the
group's servers, including images the run built (.goat-stage/images.json).

  • The gateway's tenant_root sandbox runs each stage's signed deploy script

with only its own directory, and remote:service:up, remote:service:run
and remote:service:down manage the stage's services on its own network with
signed ports only.

Update the GoatCMS backend and panel first and apply migrations 1050–1054, then
update the CI/CD workers and the orchestrators. Workers of earlier releases do
not claim stage runs. A CLI downgrade does not reverse database migrations.