refactor phase 4: serialization consolidation — utils.py dissolved, codec on public constructors

[hussainsultan]

Phase 4 of the SCC-driven refactor, stacked on #300. The serialization stack becomes one self-contained package, the hand-built ibis internals are gone, and the codec provably works on plain ibis. Full suite green (1749 passed, exit 0 — up 46 tests from the new codec coverage).

utils.py no longer exists

The seven-cluster grab-bag dissolved into its real homes, bodies verbatim:

• safe_eval.py — the AST-allowlist sandbox for YAML/agent expression strings (its own trust boundary, now visibly separate from serialization's)
• io.py — YAML/URL config loading
• serialization/_trust.py — the callable allowlist for ("fn", module, qualname) payload arms, enforced on write and read; trust_callable_module/UntrustedCallableError export from the serialization package and the refusal message names the new path
• serialization/codec.py — the resolver-tree expression codec (scalar codec, serialize/deserialize_resolver, structured expr + join-predicate API). The layering inversion the audit flagged is fixed: the serialization stack's lowest layer finally lives inside the package.

Codec rebuilt on public constructors — and the plain-ibis Item bug is fixed

deserialize_resolver used object.__new__ + object.__setattr__ + a hand-computed __precomputed_hash__ to bypass validation — the source of an entire bug class (rebuilt resolvers raising AttributeError when hashed). Verified against both flavors: the public constructors are positionally identical and accept already-built child resolvers, so all seven arms now use them and _finalize_frozen_slotted is deleted. BinaryOperator/UnaryOperator gain upstream's own operator validation for free.

This also fixes the latent flavor bug: plain ibis 11 renamed Item's key slot name → indexer, so _["x"]-style expressions crashed on the HAS_XORQ=False branch — invisible because every serialization suite importorskips xorq. The serializer reads whichever slot exists; the deserializer passes the key positionally.

New coverage where the audit found none

• test_codec_no_xorq.py — runs the round-trip in a subprocess with xorq import-blocked (including the Item case), so the plain-ibis branch is exercised even on xorq machines
• test_codec_units.py — scalar-codec symmetry (dates, Decimal, timedelta…), freeze/thaw symmetry, and a 16-shape resolver round-trip battery with hashability checks (the precomputed-hash bug class now has direct unit coverage)

One format constant; less indirection

• SCHEMA_VERSION + SUPPORTED_PAYLOAD_MAJORS live together in context.py — writer stamps and reader gates from one place; a format bump is a one-file change
• helpers.py dissolved into the codec; extract_simple_column_name rewritten with real isinstance checks instead of type(x).__name__ == "Attr" string comparisons

Deliberately kept: trust roots stay a process-global registry — trust_callable_module is the documented, tested API and additive process-wide trust is the intended semantic; context-scoping it would thread a parameter through every codec call without a driving use case.

Verification

• Full suite: 1749 passed, exit 0; SQL snapshots byte-identical
• SCC ratchet green — serialization's internal graph stays acyclic through the reshuffle
• ruff + format clean

🤖 Generated with Claude Code