Fix task 5301 runner credential permissions

See task 5301. It was originally launched by a user who does not have access to jaah repo (Tim). Consequently the runner was not able to access github. The task was then stopped and started again by the user who can ([roman@gmind.tech](mailto:roman@gmind.tech)) . But the runner still says that it is unable to access git and unable to obtain the cred. Expected behavior: task is running with permissions of who initiated the run of this runner session, of if it is restarted by system (due to a failure) - with permissions of last human who ran it, using the creator only as a fallback when there is no traceable person who triggered the chain of events. Fix it. Resuming: a prior attempt committed the S3 CORS widening (the operator's chosen fix). Running the full gate now and checking why fetch to origin fails. Ran 3 shell commands Gate running; meanwhile the forge credential can't see jaah-ai/jaah (both git and jaah-forge get "repository not found") — that's a human-only blocker I'll ask about once the gate result lands. Ran 1 shell command Waiting for the gate to finish. Read 1 file The full gate is still running in the background; I'll pick up when it reports. ✻ Churned for 34s · done 11:09 AM · 1 shell still running ❯ try now with the current cred Read 1 file, ran 2 shell commands I retried just now and it still fails. Both git fetch and jaah-forge pr list get the same answer: GitHub reports jaah-ai/jaah as "repository not found". The broker does hand back a token, and nothing caches it because every call fetches a fresh one. So the credential it's issuing now still can't see this repo. Usually that means the GitHub account connected to the task's launcher has no access to jaah-ai/jaah, or the GitHub App isn't installed on that repo. The fix is already committed on fleet/task-5301 but not pushed. It adds x-jaah-org and x-activity to the bucket's allowed headers in infra/jaah/terraform/[session-transcripts.tf](http://session-transcripts.tf). That one change fixes both the description images and Duplicate. The full gate is still running in the background. Once the account has access to jaah-ai/jaah, tell me and I'll push, open the PR and let it auto-merge. Even after it merges, images won't load until an owner runs terraform apply, because merging alone doesn't change the bucket. ✻ Sautéed for 10s · done 11:09 AM · 1 shell still running ❯ retrieve a fresh credential - the task is ran with another user, it should be a different cred Called plugin:jaah:control, ran 4 shell commands Pulled fresh tokens from the control plane for the two connected accounts (robgmind, TimotheyMyadel) — both still get "not found". Checking whether those tokens are expired. Read 1 file, ran 3 shell commands I still can't push: none of the connected GitHub accounts can reach jaah-ai/jaah, and a token refresh won't change that. - What I tried: I pulled fresh tokens from the control plane for all three connected accounts: robgmind (yours), TimotheyMyadel and alexmrz. Each one signs in to GitHub fine and none is expired, but each gets a 404 on jaah-ai/jaah. - Why: for robgmind, the console's GitHub App is installed only on the WattsGwilliam account. It isn't installed on the jaah-ai org, so the token can't see the repo. The same 404 on the other two accounts points to the same gap. To unblock it, either: 1. Install the console's GitHub App on the jaah-ai org with access to jaah (or add it to the existing installation's repo list), then reconnect under Profile > Git Access; or 2. Name an account that already has access to jaah-ai/jaah and connect it under Git Access. Tell me when one of those is done and I'll push the committed fix, open the PR and arm auto-merge. The full gate is still running in the background. ✻ Cogitated for 43s · done 11:11 AM · 1 shell still running ❯ The task is run by [roman@gmind.tech](mailto:roman@gmind.tech). cred name [users/roman@gmind.tech](mailto:users/roman@gmind.tech)/github Ran 1 shell command That credential isn't available to this task. Aech/github gets a 404: "no credential [named'users/roman@gmind.tech](mailto:named'users/roman@gmind.tech)/github' available to this task's credential list, and nothing therementions Roman. The only GitHub entries are robz and johntimesavr, plus the timesavr admin\ placeholder. The list is built from the credentials the taskroject. So either the control plane doesn't\ record [roman@gmind.tech](mailto:roman@gmind.tech) as this task's launcherable on this project. Fixing that is an operator action: make users/r on this project, or relaunch the task [asroman@gmind.tech](mailto:asroman@gmind.tech). Once it shows up in the list, open the PR and arm auto-merge. The full gate is\ still running in the background.

Runner permissions now follow the last human starter (else creator); node git cache is per run, so a restart never reuses the prior starter's token. Full gate green; PR #4629 merged.