Restricted Purchase Executor V0.3 — deterministic merchant session and cart bootstrap

[3ndym10n]

Closes #75. Parent: #65. Depends on structured governance contracts merged in 3ndym10n/Cogitator#1058 and NousResearch#1060.

Implements adapter-owned deterministic cart construction from the approved structured checkout target; exact merchant, product, quantity, subtotal, tax, mandatory fees, total, currency, recurrence, origin, and session validation before semantic payment discovery or credential loading; loopback-only synthetic authenticated session handoff; and fail-closed production behavior where no verified cart path or session handoff exists.

Validation:

• 108 purchase executor/discovery/packaging/operator tests passed.
• 11 browser cleanup and sandbox-bypass regressions passed.
• Same-page anonymous Chromium fake E2E passed.
• Hosted-frame authenticated-session Chromium fake E2E passed.
• Ruff, py_compile, and diff checks passed.
• Independent Security Validator: PASS.
• Independent Build Validator: PASS (117 focused tests independently passed).

No real merchant, credentials, production flags, deployment, proposal, ticket, or purchase was used.

[github-actions]

🔎 Lint report: feat/purchase-cart-bootstrap-v0 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 10832 on HEAD, 10833 on base (✅ -1)

🆕 New issues: none

✅ Fixed issues (1):

Rule	Count
no-matching-overload	1

First entries

tests/test_purchase_executor.py:292: [no-matching-overload] no-matching-overload: No overload of `dict.__init__` matches arguments

Unchanged: 5682 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.