atproto OAuth will not run against the harness as it was: the Go OAuth client wants a portless https:// PDS issuer, the PDS's OAuth provider refuses client IDs on .test-style names and same-site navigations, and oatproxy and the browser client resolve did:plc against a hardcoded https://plc.directory. `streamplace e2e --https-pds-hostname --https-station-hostname` takes public DNS names for 127.0.0.1 and: - mints a throwaway CA and terminates TLS on 127.0.0.1:443, routing by SNI to the dev-env PDS (and handles under it), the node (running --behind-https-proxy) and, as plc.directory, the dev-env PLC; - runs a CONNECT proxy the node and browser use to reach that PLC; - trusts the CA per process (SSL_CERT_DIR, NODE_EXTRA_CA_CERTS, the leaf's SPKI for Chromium), installing nothing system-wide; - publishes this build's lexicons into a local lexicon authority account the PDS resolves permission sets from, so the OAuth scope include:place.stream.authFull is the branch's own. Without the flags the harness behaves as before. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>