Kasse's runner can now ship a portal release here, the way the ergo sites already do: PORTAL_RELEASE is the pin, and bumping it is the rollout. No more ssh and a script run by hand across all three instances at once. The runner is not root. It may run one script, which checks the instance against a fixed list and the tag against a release-tag shape before it touches anything, and then health-checks the site without a forwarded header - so a check cannot pass while the site is broken for everything that is not Caddy, which is how v0.5.1 got out. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>