I'm tentaively OK with this but I'd like to have more than, like, 12 hours of production use of mirrors before we pursue it. Are you okay with holding this out of the upstream for a week or two so we can make sure stuff is stable?

My biggest fear here is that someone is going to misconfigure things and mirror an empty repository on top of a full one or something like that. It shouldn't really be possible to do any damage (e.g., we don't --force push right now) but users have proven very creative in the past. Limiting the number of cases where mirroring is available makes me more confident I can react quickly if issues do arise.

The mirroring UI is also really bad right now (e.g., no display of mirror status); I pushed it forward in a pretty rough state since it blocked self-hosting Phabricator itself, but I'd like to pay down some of the product debt there before expanding things.

I don't see any purely technical barriers to implementing this for non-hosted repositories either, though.

(I'm also not aware of anything which makes running this patch locally dangerous.)

I'm absolutely fine with holding this out, it's a trivial change to have in our own tweaked phabricator install.

Cool, sounds good. If you manage to come up with a configuration that wipes out repositories, let me know. :)