resume rejected: the reviewed input changed since session %q

Error message

resume rejected: the reviewed input changed since session %q — a ref may now point at a different commit, or the selected file set changed; %s

What it means

validateInputIdentity rejects resuming when the digest of the reviewed input (SourceArtifactSHA256) differs between the parent manifest and the current request. This means the actual reviewed content changed since the session — e.g. a ref now resolves to a different commit or the selected file set differs — so prior results cannot be safely reused.

Source

Thrown at internal/session/resume_identity.go:117

		return fmt.Errorf("resume session %q recorded operation %q, not %q; %s", s.SessionID, m.Operation, OperationReview, resumeHint)
	case len(m.Coverage.Selected) == 0:
		// Without this, an empty parent and an empty child would both hash to the
		// canonical empty digest, pass every comparison, and produce a run that
		// reuses nothing and dispatches nothing.
		return fmt.Errorf("resume session %q selected no input, so it has nothing to resume; %s", s.SessionID, resumeHint)
	}

	if m.Input.Mode != id.Mode {
		// Mode feeds item_id derivation, so parent and child items cannot even be
		// put side by side.
		return fmt.Errorf("resume rejected: input mode changed from %q to %q; %s", m.Input.Mode, id.Mode, resumeHint)
	}
	// Both sides empty means a repository with no remote, which is unchanged.
	if m.Repository.IdentitySHA256 != id.RepositorySHA256 {
		return fmt.Errorf("resume rejected: repository identity changed, so this is not the repository the parent run reviewed; %s", resumeHint)
	}
	if m.Input.SourceArtifactSHA256 != id.SourceArtifactSHA256 {
		return fmt.Errorf("resume rejected: the reviewed input changed since session %q — a ref may now point at a different commit, or the selected file set changed; %s", s.SessionID, resumeHint)
	}
	if m.Execution.RuleConfigSHA256 == "" {
		return fmt.Errorf("resume session %q recorded no rule identity, so it cannot be verified against the current rules; %s", s.SessionID, resumeHint)
	}
	if m.Execution.RuleConfigSHA256 != id.RuleConfigSHA256 {
		// The digest is one aggregate, so it can only be attributed to a layer,
		// never to a specific rule or pattern.
		return fmt.Errorf("resume rejected: review rule identity changed — either a rule text layer (custom, project, global or system) or the include/exclude file filter differs from session %q; %s", s.SessionID, resumeHint)
	}
	return nil
}

// explicitFlagHint renders the actionable half of a transition rejection. value
// is empty whenever the endpoint has no provider name — one configured straight
// from environment variables has none — and `pass --provider ` is not a command
// anyone can run, so name the flag rather than echoing the empty value.
func explicitFlagHint(flag, value string) string {
	if value == "" {

View on GitHub (pinned to 5cf97d0d15)

Solutions

Pin the input to the original commit SHA (the one recorded in the parent manifest) and resume
Start a new review against the updated input instead of resuming
If resuming should reflect new commits, accept that identity changed and run a fresh review

Example fix

// before
ocr review --resume abc123 --ref main        # main moved since parent run
// after
ocr review --resume abc123 --ref abcdef1234  # pin the original commit, then resume

Defensive patterns

Strategy: validation

Validate before calling

// Confirm the reviewed input is unchanged before resuming
if sess.Manifest != nil && sess.Manifest.Input.SourceArtifactSHA256 != currentSourceArtifactSHA256 {
    return fmt.Errorf("input changed since parent run; start a new review")
}

Try / catch

if err := ValidateResume(s, req); err != nil {
    if strings.Contains(err.Error(), "reviewed input changed") {
        return startNewReview(req) // branch moved — re-review the new state
    }
    return err
}

Prevention

Pin refs to commit SHAs, not branch names, for resumable runs
Avoid pushing new commits to a PR between the parent review and the resume
Recompute the artifact digest before resuming to fail fast in scripts

When it happens

Trigger: ValidateResume where m.Input.SourceArtifactSHA256 != id.SourceArtifactSHA256 — new commits landed on the reviewed branch, files changed, or the selection was computed differently between the parent run and the resume.

Common situations: Developer pushes new commits to a PR after starting a review, then resumes; CI re-runs after the branch moved; a mutable ref (e.g. a branch name instead of a SHA) resolves elsewhere at resume time.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/af73ee8288102883. Report an issue: GitHub.