In this workflow, the configuration being applied to a server is whatever people happen to have rsynced to it. That may allow for quick iteration in their QA environment (as long as people avoid stepping on each others toes), but wouldn't it be better if the sandbox and production servers pulled their configuration from the sandbox and production git branches?
Our goal is to make applying changes to a server an intentional step. Instead of changes in production being pulled, we make it a push. With more complex changes it involves unbalancing a server, making the change, testing that everything is working correctly, then rebalancing it. While smaller changes, we simply apply them to the environment wholesale. This process gives us the flexibility to do both.
We do use the sandbox and production git branches for those environments. If you want to puppet sandbox, you start with a git checkout sandbox. If you try to puppet sandbox from the production or master branch, you get a big warning and a prompt asking if you are really sure.
