I had a few quetions.
Q1 Why not running a git fsck on the canonical server before allowing mirror servers to sync ?
Q2 could it be possible to optimize git fsck to only do incremental checks, on the diffs sent to he mirrors ?
Q3 if a canonical git server is used, why not ensuring this one is very safe against data corruption ?
Q4 what about the ext4 corruption in the VMs ? Is the cause identified ?