Summary

OpenAI's ChatGPT app submission requires a verification token at https://<host>/.well-known/openai-apps-challenge on the MCP hostname or a parent hostname of it.

The MCP hostname (mcp.cedarcopilot.com) is Manufact's proxy (CNAME to deploy.mcp-use.com) , Cedar doesn't control arbitrary routes there, and it's unclear whether an unrecognized path even forwards to Cedar's origin.

cedarcopilot.com, the apex/parent hostname, is a valid alternative per OpenAI's own instructions ("a parent hostname... paths are ignored") and is served directly by this same app , confirmed /pricing returns 200 on both cedarcopilot.com and mail.cedarcopilot.com (same deployment, same static /public directory).

Change

Dropped the token as a static file (apps/mail/public/.well-known/openai-apps-challenge) rather than a routes.ts entry , it needs no logic, just static content at a fixed path, exactly like every other file already in apps/mail/public/.

Verification

react-router build places the exact token, byte-for-byte (43 bytes, no added newline), at build/client/.well-known/openai-apps-challenge.

Action needed outside this PR

In OpenAI's submission form, set the Challenge Base URL override to https://cedarcopilot.com instead of leaving it blank (blank defaults to the MCP hostname, mcp.cedarcopilot.com, which this fix doesn't touch).

🤖 Generated with Claude Code

Confidence Score: 4/5

This PR is not safe to merge as-is because the deployed challenge URL bypasses the newly added static file.

Findings

1.  Challenge file is unreachable ▶

### Issue 1
apps/mail/public/.well-known/openai-apps-challenge:1
CloudFront routes every `/.well-known/*` request to the API origin instead of the frontend bucket containing this file. The API only handles `/.well-known/security.txt` and has no handler for `openai-apps-challenge`, so `https://cedarcopilot.com/.well-known/openai-apps-challenge` will not return this token and OpenAI's domain verification will fail. Serve the token from the API or change the CloudFront behavior so this asset is reachable.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds OpenAI's domain-verification token as a static file under the mail application's public directory.

• The build can copy the token into the frontend output.
• The deployed /.well-known/* CloudFront behavior bypasses that output and routes requests to an API that does not serve this challenge, preventing verification.

Diagram

_{Reviews (1) · Last reviewed commit: "feat(mail): serve OpenAI's domain-verifi..."}