test(den): reproduce corporate CA OAuth failures

[benjaminshafii]

Summary

• add optional HTTPS support to the existing full OAuth MCP fixture
• add an exact-route Den harness that runs once without a private root and once with NODE_EXTRA_CA_CERTS
• add an app-less eval and runbook for reproducing corporate CA failures in Daytona
• generate ephemeral certificates and clean up all keys, DB rows, and fixture processes

What this proves

The same GET /v1/mcp-connections/:id/connect/start path returns 502 oauth_handshake_failed with fetch failed when Node does not trust the fixture certificate. A fresh Node process with the generated root in NODE_EXTRA_CA_CERTS completes protected-resource discovery and dynamic client registration, returning 200 needs_auth and the authorization URL. No TLS verification bypass is used.

Evals

• pnpm --filter @openwork-ee/den-api build
• pnpm evals --flow den-corporate-ca-tls locally: passed
• Daytona server sandbox ow-den-corporate-ca, commit edf9653b3: passed in 7.363s
  • certificate-chain rejection captured
  • untrusted Den request returned 502
  • trusted Den request returned 200 needs_auth
  • voice-over coverage passed

Daytona report: evals/results/2026-07-10T05-50-10-439Z/report.md inside the sandbox.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview, Comment	Jul 10, 2026 5:51am
openwork-den	Ready	Preview, Comment	Jul 10, 2026 5:51am
openwork-den-worker-proxy	Ready	Preview, Comment	Jul 10, 2026 5:51am
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 10, 2026 5:51am