Four weeks after the first report I sat in the same seat and asked the same question. The answer moved a long way. What's left isn't a missing button any more. It's the ground the console stands on.
The biggest move is release management. Roll back opens a rollback release PR against a healthy earlier release, where integrity gates block and content gates only advise, and I tested abort and retry live on a Skyport app's staging. Release state is now built from the Rollout's own facts (ADR-0021) instead of hook Jobs. And the plain-language troubleshooting banner on Deployments is the single best reason I no longer open the Argo CD UI for an app I own.
| Genuinely works | Still sends me elsewhere |
|---|---|
| Delegated authority. Every runtime action is an Argo CD call through one account with three narrow roles; every durable change is a PR. | Prod has no metrics. The prod cluster's Prometheus is scaled to zero for capacity, which empties three tabs for Flight. |
| Break-glass done better than exec. A debug container, a copy of the pod by default, cluster guardrails, a recording, and two people on Flight. | Prod depends on the dev cluster. Secrets, bootstrap Crossplane and part of Tower's read path live there. |
| Troubleshooting in sentences. An ordered rule table turns Argo CD, Rollout, pod and event signals into one line and a first thing to try. | Gates can't block. On GitHub's free plan the platform audits a bypass; it can't prevent one. |
| Environments as one model. Tower stages edits and opens exactly the PRs needed, in order. | Identity is one person. The authorization model is ready for teams; the identity layer under it isn't. |
| Honesty as a feature. Published known-gaps lists, 25 ADRs, and docs that say "verified" or "not verified". | No backup or restore. The architecture review called it, and nothing has moved. |
| Tests exist now. The review found none; Tower now has 62 test files and the backend 33. | Not built yet: runtime scale, Flight removal, two cloud targets, DORA on the Ops Wall, and the Autopilot tab. |
The first report's backlog was about adding levers. This one is about the floor under them. Three items were done the day after it was written.
The read token behind the portal could do far more than read, and any signed-in user could reach it through a generic proxy. Phase 0 of the credentials spec closed it.
Until then SLOs, pod metrics and canary analysis are empty for exactly the environments an owner cares about. The prod profile now runs Prometheus and tracing, and Tower reads every cluster through the hub's Thanos.
Durable scale already exists as a values PR. My recommendation: no runtime scale, and say so.
A signed debug image, an image policy scoped to debug containers, and a cleanup backstop in the cluster.
If it never did, the Images tab's one write action is dead on prod.
Testkube results belong on the Release Record and the pipeline row. Tower v0.79 and v0.80 put every attested test run on the image, a Tests view on Pipelines, and the test evidence on the Release Record.
Replace the never-expiring token with federated ten-minute tokens and split reads from writes.
If a merge can't be blocked, admission is the only place an unsigned image can be refused.
The webhook relay, the tunnels and each cluster's reachability, before an app looks wrong.
Ground removal is a confirmed PR. Flight removal is still a manual XR delete with a data-loss history.
Self grants, review-due tracking, an in-Tower recording player and retention.
Move bootstrap Crossplane, the secrets store and Backstage off the dev cluster so prod stops sharing its fate.
Retire the personal token, generate rulesets so gates block for real, and put sign-in in front of everything.
Cluster state, databases, the audit bucket and the secrets store's root key. One drill a quarter.
The Airframe scorecard climbed because it was measured every week. Give SSO, DR and platform SLOs the same treatment.
One live Lambda smoke test; the other targets are render-tested only. Since then Lambda and ECS have been tested end to end, with no stored key; Azure Container Apps is next.