Managed Agents github_repository rejects documented fine-grained PAT after session creation

Environment

• Product: Claude Managed Agents (CMA), beta managed-agents-2026-04-01
• Resource: github_repository
• Repository: private GitHub repository
• Credential: repository-scoped fine-grained GitHub PAT
• Documented permission: Contents: Read and write
• Cloud environment with github.com and api.github.com allow-listed

Symptom

A session created with a github_repository resource accepts the resource and reaches session.status_running, but the repository mount never appears. Roughly 10–20 seconds later, the event stream emits:

session.error
error.type: unknown_error
error.retry_status.type: exhausted
error.message: GitHub refused access to the repository. If it is private, add an authorization_token with read access to the github_repository resource; if you already did, check that the URL and token are valid.

The session then becomes idle. An agent command against the documented mount path fails with No such file or directory.

What was verified

• The exact PAT supplied as authorization_token succeeds against GET /repos/{owner}/{repo} immediately before session creation.
• GitHub reports pull: true and push: true for that credential.
• The token is scoped to exactly the target repository and has Contents: Read and write as documented for fine-grained PATs.
• The repository URL is exactly https://github.com/{owner}/{repo}. The default branch is main.
• The CMA environment and agent are active.
• Both github.com and api.github.com are allowed by the environment.
• Reproduced with default checkout and explicit { "type": "branch", "name": "main" } checkout.
• Reproduced across multiple fresh sessions/resources after credential configuration was refreshed, ruling out a single stale session.
• A disposable probe with a fresh resource confirmed the mount directory was never created.
• .git suffix was also tested only as a cache-key diagnostic; CMA correctly rejected it synchronously as an invalid URL, so the normal no-suffix URL is being used.

Disposable sanitized reproduction session for Anthropic engineers:

• Session: sesn_01MGK2EZQRbzjRjspE98wNCa
• Resource: sesrsc_01UoCVBz2BJERrq8bxGDqdSZ
• Created: 2026-09-11T21:48:56Z
• Archived after evidence capture: 2026-09-11T21:49:54Z

Two additional reproductions:

• sesn_01Bkq96Cp2H9DtxXhSEDHqr6
• sesn_01SKxTxNNyiNfkBBGZEohG2d

Expected behavior

The repository should mount successfully because the Managed Agents documentation explicitly supports fine-grained PATs with Contents: Read and write for clone/push.

Questions

1. Did the git proxy receive the fine-grained PAT for the sessions above, or a non-substituted credential placeholder?
2. Does the current github_repository mount implementation support github_pat_* credentials as documented?
3. Is there another required fine-grained repository permission not listed in the Managed Agents resource documentation?

No credential values, placeholders, request headers, or private repository contents are included in this report.