fix(questions): verify provider answer question identities

src/benchmark_radar/questions.py

@@ -420,6 +420,8 @@ def _validate(
     for answer, question in zip(answers, group["questions"], strict=True):
         if not isinstance(answer, dict):
             raise BriefingError("OpenAI returned a malformed answer")
+        if answer.get("question") != question:
+            raise BriefingError("OpenAI returned an answer for a different question")
         unknown_stats = [
             stat_id for stat_id in answer.get("stat_ids") or [] if stat_id not in stats_by_id
         ]

tests/test_questions.py

@@ -578,3 +578,26 @@ def fake_translate(url, payload, **kwargs):
         for a in answers
     )
     assert result["zh_translation"]["response_id"] == "resp_zh"
+
+
+def test_daily_questions_rejects_provider_answers_bound_to_wrong_questions(monkeypatch):
+    current = snapshot_for_run(_run([_item(1), _item(2)]))
+
+    def post_json(url, payload, **kwargs):
+        packet = json.loads(payload["input"])
+        answers = [
+            _answer(question=question, signal="Captured records need review.")
+            for question in reversed(packet["questions"])
+        ]
+        return {
+            "output": [
+                {
+                    "type": "message",
+                    "content": [{"type": "output_text", "text": json.dumps({"answers": answers})}],
+                }
+            ]
+        }
+
+    monkeypatch.setattr(questions, "post_json", post_json)
+    with pytest.raises(BriefingError, match="question"):
+        questions.generate_daily_questions([], current, [], "test-key")