Every release, in reverse order

Control plane

Added

• AddedSchedule firing wired end-to-end. Schedule rows synchronise into the django-q2 scheduler on signal, a boot check refuses to start if the two have drifted, a scheduler heartbeat gates /readyz for the first three minutes, and a missed-fire detector flips stale QUEUED runs so the next cron tick can pick them up.
• AddedCron → Job dispatch and pending-jobs in the heartbeat response.
• AddedAgent ↔ database pinning. Each database is pinned to a single agent in its organisation. The dispatcher refuses to send work to any other agent, and /config narrows to the agent's pinned databases only.
• AddedOn-demand “Run backup now” from the database detail page, async, with a flash, hidden until the pinned agent has been heard from.
• AddedFirst-run welcome pages on databases, agents, backups, and storage when an organisation has no rows yet, with the next CTA inside the empty-state hero.
• AddedRedesigned backups list and detail: window / outcome / database facets, cross-field search, fixed-layout responsive rows, and a presigned download link for the encrypted object.
• AddedNewsreader / Inter / JetBrains Mono self-hosted across the console, theme-aware wordmark and favicon on every page, and the canonical overview dashboard built from real organisation data.

Fixed

• FixedUser-defined schedules that never fired because of a stale next_run and a leftover second cluster. Q2 is collapsed to one cluster, and Schedule changes drive the row directly.
• FixedEmpty-list pages no longer issue duplicate queries; an EXISTS-first short-circuit short-circuits the empty case.

Control plane

Added

• AddedDatabase creation wizard. Five steps — connection, agent pick-or-install, storage destinations (one primary, optional mirrors), schedule rules, review — with the agent step live-polling for fresh heartbeats so the operator can watch a freshly installed agent come up in the same tab.
• AddedStorage destination probe: an end-to-end head_bucket → put_object → get_object (with byte match) → delete_object sweep, run synchronously at submit and exposed as an HTMX endpoint for the “Test now” button. Results are cached on the destination.
• AddedExpanded storage form to every S3-compatible provider with a tested config, plus a generic custom-endpoint option.
• AddedAgent certificate renewal endpoint and a CRL endpoint.

Control plane

Added

• AddedEnd-to-end encryption to the organisation's public key. Per-organisation X25519 keypair, auto-issued at organisation creation, with a one-time recovery-key download gated behind recent-auth on the security tab. A backfill command exists for organisations created before the keypair work landed.
• AddedPer-backup fingerprint pinned at upload time. A backup's file key is unwrapped on demand with a ranged GET against the age header, so only the few bytes needed reach the control plane.
• AddedKeypair rotation as a one-button operation on the organisation security tab. The rotation re-wraps each backup's age header (the file body is untouched), records progress in a KeypairRotationJob, and handles backups that arrive mid-rotation.
• AddedSettings shell with tabs (Organisation / People / Security) for admins, mirroring the operator profile (Identity / Security / Preferences / Activity). Timezone middleware and a user_dt filter route every timestamp through the operator's preferences.
• AddedOrganisation invitations, with SHA-256-hashed tokens and an accept flow.

Removed

• RemovedAn earlier in-database cache of unwrapped DEKs. Rotation operates on the age header directly; nothing decrypted lives at rest in the metadata DB.

Control plane

Added

• AddedFirst public cut. Django 6 application with operator accounts, organisations, role-based access control across four roles, an append-only audit log, envelope encryption for stored credentials, redacted structured logs, /healthz and /readyz endpoints, a CSP-enforcing middleware, and a django-q2 task cluster wired into boot.
• AddedDatabases, storage destinations, schedules, and retention policies as first-class records. The default retention is GFS (7 daily, 4 weekly, 12 monthly), overridable per database, with an optional hard age bound.
• AddedMutual TLS between the agent and the control plane. The agent generates its keypair on the host, sends a CSR, and receives a leaf certificate signed by the agent CA. The private key never leaves the host.
• AddedHeartbeat and /config endpoints with hash short-circuiting — the server tells the agent it is up-to-date without re-sending the whole config when nothing has changed.
• AddedSingle-use job credential exchange. Database passwords and storage secrets are fetched per job, never stored on the agent's disk, and the issuance is recorded in the audit log.
• AddedOperator-facing backups history and a console dashboard. One-shot restore initiation from the console, with the agent reporting the result back.