Decision record
One serialized commit queue, and no cancellation
The first GitOps workflow failed for an embarrassingly concrete reason: it wrote to config/rc-appset, while the real manifests lived under config/bank-appset. It also allowed an in-progress deployment update to be cancelled by a newer run, which is unsafe for a repository acting as deployment authority. I replaced it with one serialized GitOps commit queue — cancellation disabled, environment validated, no-op updates made explicit, rebase before push. After that, every release became a commit with a reproducible image SHA, and rollback became a Git revert that ArgoCD could reconcile.
Written first-person · reproduced verbatim