P1 E8: preserve browser OIDC session across the post-callback navigation

[gnanirahulnutakki]

Problem

The browser OIDC callback mints the final __Host-sith-session cookie with SameSite=Strict and immediately redirects to the workspace console.

A browser evaluates that console navigation inside a top-level navigation initiated by the external identity provider. Under RFC6265bis, Strict cookies are withheld from top-level navigations triggered by a cross-site document context. The first console request can therefore arrive without the newly minted session and appear unauthenticated.

Parent: #26.

Required fix

• Mint the final session cookie with explicit SameSite=Lax so the safe top-level GET redirect can carry it.
• Retain __Host-, Secure, HttpOnly, Path=/, no Domain, the bounded session expiry, and the server-only token flow.
• Keep transaction state, nonce, PKCE S256, exact callback host/path validation, single-use consumption, and no-return-URL behavior unchanged.
• Update focused tests and operator documentation so the interoperability and CSRF boundary are explicit.
• Keep browser-session cookies excluded from bearer API authentication.

Acceptance criteria

• The callback test locks the final cookie to SameSite=Lax and all other security attributes.
• Unsafe cross-site methods remain outside the Lax exception; console state-changing reads continue to require the existing same-origin custom proof.
• Focused race tests and repository quality, isolation, release, and real-cluster gates remain green.
• Final independent review reports no unresolved finding.

Security and cost

Lax is a deliberate interoperability boundary, not the primary CSRF control. It allows only safe top-level cross-site navigation while the existing purpose-bound proof, safe-method-only console surface, host-only cookie prefix, TLS, PKCE, state, nonce, and server-side exchange remain authoritative. No cloud resource, egress path, storage, or recurring cost is added.

Primary source

• RFC6265bis SameSite semantics: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#samesite-cookies

[gnanirahulnutakki]

Landed and verified through PR #312.

Immutable closure proof:

• exact GitHub-verified signed DCO/GSTACK feature commit: 277277ec34a0fe9f82a50ab7db54258962970b7d
• merge commit: fdf932bbaaebb61f3d3a999b1d07160b02087c74
• merge parents: prior dev ea6dff314cc4eb4e9054dc41a42d53651e5a1bcc and exact feature head 277277ec34a0fe9f82a50ab7db54258962970b7d
• exact post-merge dev CI: https://github.com/ArdurAI/sith/actions/runs/29975233457
• exact post-merge CodeQL: https://github.com/ArdurAI/sith/actions/runs/29975233241
• complete local four-file CodeRabbit review: zero findings
• unresolved review threads: 0
• open security queues: 0 Dependabot / 0 code scanning / 0 secret scanning

The final cookie is explicitly Lax so the safe top-level post-IdP redirect receives it. The __Host-, Secure, HttpOnly, Path /, no-Domain, bounded-expiry, PKCE S256, state, nonce, exact callback, single-use transaction, same-origin proof, and bearer-only API boundaries remain intact. Unsafe login and callback methods are rejected. No cloud resource or recurring cost was added.