Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- When POST /api/v1/dsl_to_json converts Python DSL, the API shall run the code only in the isolated DSL compiler service (#943: own container, egress-only network, no DB, secrets or API route), never on the API host.
- If the compiler reports an error, then the API shall return 400 EXECUTION_ERROR with the compiler's (truncated) message.
EVIDENCE: api/blueprints/v1/dsl_converter.py wrote the caller's code to a temp file and ran python3 in a subprocess on the API container (which holds DB credentials, platform secrets and today docker.sock); the only guard was an AST blocklist. POST /workflows already used the compiler service. Found by the #911 sweep.
FIX: convert_python_dsl_to_json moved to api/utils/dsl_compiler_client.py (workflows.py re-imports it, so api/services/reactions.py keeps working); dsl_to_json calls it; the subprocess and tempfile path is deleted; the AST pre-check stays as an early 400.
TESTS: tests/unit/api/test_dsl_to_json_isolated.py patches subprocess.run/Popen to refuse. On HEAD 2/3 fail (code executed locally); after the fix 3/3 pass, plus 34 neighbouring API tests.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1008