# Goat CLI 0.0.3

This release adds server groups and application stages delivered through the
orchestrator.

- `worker:orchestrator:join` joins a server to a server group with the group's
  enrollment secret (hidden prompt, `--secret-file` or `--secret`) and its own
  machine key and name; `worker:orchestrator:run` reports state and facts, and
  runs the group-mode runtime once the runtime paths are provisioned.
- The CI worker serves application stages: `GOAT_STAGE`, `GOAT_STAGE_MANIFEST`,
  `GOAT_EXPOSE_<NAME>_PORT`/`_BIND`, the stage's secret file and the group's
  shared secrets; for group delivery it packs the stage and hands it to the
  group's servers, including images the run built (`.goat-stage/images.json`).
- The gateway's `tenant_root` sandbox runs each stage's signed deploy script
  with only its own directory, and `remote:service:up`, `remote:service:run`
  and `remote:service:down` manage the stage's services on its own network with
  signed ports only.

Update the GoatCMS backend and panel first and apply migrations 1050–1054, then
update the CI/CD workers and the orchestrators. Workers of earlier releases do
not claim stage runs. A CLI downgrade does not reverse database migrations.