resume session %q recorded no rule identity, so it cannot be

Error message

resume session %q recorded no rule identity, so it cannot be verified against the current rules; %s

What it means

This error is raised during session resume validation when the parent run's manifest exists but its execution.rule_config_sha256 field is empty. The digest is the aggregate identity of the rule configuration (rule text layers plus the include/exclude file filter), and without it the tool cannot prove that the current rules match the ones the parent run used. Rather than silently resuming with possibly different rules, ValidateResume rejects the resume and tells the user to start a new review.

Source

Thrown at internal/session/resume_identity.go:120

		// canonical empty digest, pass every comparison, and produce a run that
		// reuses nothing and dispatches nothing.
		return fmt.Errorf("resume session %q selected no input, so it has nothing to resume; %s", s.SessionID, resumeHint)
	}

	if m.Input.Mode != id.Mode {
		// Mode feeds item_id derivation, so parent and child items cannot even be
		// put side by side.
		return fmt.Errorf("resume rejected: input mode changed from %q to %q; %s", m.Input.Mode, id.Mode, resumeHint)
	}
	// Both sides empty means a repository with no remote, which is unchanged.
	if m.Repository.IdentitySHA256 != id.RepositorySHA256 {
		return fmt.Errorf("resume rejected: repository identity changed, so this is not the repository the parent run reviewed; %s", resumeHint)
	}
	if m.Input.SourceArtifactSHA256 != id.SourceArtifactSHA256 {
		return fmt.Errorf("resume rejected: the reviewed input changed since session %q — a ref may now point at a different commit, or the selected file set changed; %s", s.SessionID, resumeHint)
	}
	if m.Execution.RuleConfigSHA256 == "" {
		return fmt.Errorf("resume session %q recorded no rule identity, so it cannot be verified against the current rules; %s", s.SessionID, resumeHint)
	}
	if m.Execution.RuleConfigSHA256 != id.RuleConfigSHA256 {
		// The digest is one aggregate, so it can only be attributed to a layer,
		// never to a specific rule or pattern.
		return fmt.Errorf("resume rejected: review rule identity changed — either a rule text layer (custom, project, global or system) or the include/exclude file filter differs from session %q; %s", s.SessionID, resumeHint)
	}
	return nil
}

// explicitFlagHint renders the actionable half of a transition rejection. value
// is empty whenever the endpoint has no provider name — one configured straight
// from environment variables has none — and `pass --provider ` is not a command
// anyone can run, so name the flag rather than echoing the empty value.
func explicitFlagHint(flag, value string) string {
	if value == "" {
		return "pass " + flag + " <name> explicitly"
	}
	return "pass " + flag + " " + value

View on GitHub (pinned to 5cf97d0d15)

Solutions

Start a fresh review instead of resuming, as the error hint suggests.
Upgrade both the old and new runs to the same CLI version so manifests always include rule_config_sha256, then re-run the parent review once to regenerate a complete manifest.
Inspect the session manifest file to confirm execution.rule_config_sha256 is really empty; if the manifest is corrupted, discard the session.

Example fix

// before: resuming a legacy session
ocr review --resume <session-id>
// after: regenerate the parent with a current build, then resume
ocr review --resume <new-session-id>

Defensive patterns

Strategy: validation

Validate before calling

if manifest != nil && manifest.Execution.RuleConfigSHA256 == "" {
    // cannot verify rules; do not attempt resume
    return fmt.Errorf("session %s has no rule identity; start a new review", sessionID)
}

Type guard

func hasRuleIdentity(m *Manifest) bool { return m != nil && m.Execution.RuleConfigSHA256 != "" }

Try / catch

if err := state.ValidateResume(req); err != nil {
    var identityErr *IdentityError
    if errors.As(err, &identityErr) {
        log.Warn("resume rejected; falling back to a fresh review")
        return startNewReview(req)
    }
    return err
}

Prevention

Always create parent sessions with a build that records rule_config_sha256.
Validate manifest completeness before offering the resume option in tooling.
Never hand-edit session manifests.

When it happens

Trigger: Calling ValidateResume on a session whose manifest was written by a build that did not record Execution.RuleConfigSHA256 (older manifest schema, corrupted/partially written manifest, or a manifest edited to drop the field) — i.e. the manifest is present and closed, but m.Execution.RuleConfigSHA256 == "".

Common situations: Resuming a session created by an older version of the CLI before rule-identity hashing was introduced; a manifest truncated by a crash mid-write; hand-edited or migrated session files that lost the execution section.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/e125ed8ed82072fb. Report an issue: GitHub.