[Data Isolation][108dev] Questions assemblies endpoint includes essay assemblies

[Cataldir]

Summary

After restoring Questions API, /api/questions/assemblies returns essay assembly records (e.g., asm-essay-*) in the evaluator assembly list.

Impact

• Questions UI may show essay evaluator assemblies.
• Users can pick incompatible assemblies, producing evaluation inconsistencies.

Evidence

Sample records observed from /api/questions/assemblies:

• asm-essay-fund1-001
• asm-essay-em-001
• asm-essay-econ-001

Suspected root cause

Questions and Essays appear to read/write from a shared assemblies container without domain discriminator filtering.

Immediate mitigation idea

• Filter questions assembly queries to include only question-domain assemblies.
• Add domain/type discriminator on assembly documents (domain=questions|essays) and enforce per-service filters.

Longer-term

• Backport to IaC/data model and add regression tests for domain isolation.

Related: #139, #141, #144

[Cataldir]

Remediation status update:

• Deployment/recovery scripts were patched to prevent repeat Cosmos env drift incidents:

  • .github/workflows/azd-deploy.yml (unchanged-service skip path now reconciles COSMOS_ENDPOINT/COSMOS_DATABASE)
  • .github/workflows/aca-recovery.yml (recovery now reapplies + validates those values)

• This lowers recurrence risk for runtime 500s (Issue [Incident][108dev] Questions API 500 due to Cosmos env drift (empty endpoint/database) #144 class), but does NOT resolve Issue [Data Isolation][108dev] Questions assemblies endpoint includes essay assemblies #145 root cause (assemblies domain isolation). [Data Isolation][108dev] Questions assemblies endpoint includes essay assemblies #145 remains open for application-layer filtering/partition safeguards.