[sneak]

yadm implements this model, but also allows for machine-specific branching and encrypted secrets (no secrets should be directly committed in git).