I have the following mutators enabled in oathkeeper:

mutators:
  header:
    enabled: true
    config:
      headers:
        X-Username: "{{ print .Subject }}"
  noop:
    enabled: true

As a sanity check, should using the header mutator work on an anonymous endpoint? As in:

- id: ory:runway:ui
  upstream:
    url: <http://tasks.ui>
  match:
    url: <https://my-app/><{,_app/**,login,register,recovery,favicon.png,index.html,50x.html}>
    methods:
      - GET
  authenticators:
    - handler: anonymous
  authorizer:
    handler: allow
  mutators:
    - handler: header

Would I be correct to "expect" requests to include the header

X-Username: guest

?

did you enable the allow authorizer, e.g. as in https://github.com/ory/oathkeeper/blob/master/.docker_compose/config.yaml ?