What Is the Manifest Hash and Its Role in Session Integrity in Open‑Code‑Review

The manifest hash is a SHA‑256 cryptographic fingerprint that uniquely identifies a review run's complete context—repository identity, source artifact, rule configuration, and runtime environment—enabling deterministic verification, safe session resumption, and tamper detection.

Every scan or review operation in the Alibaba Open‑Code‑Review tool generates a run manifest that captures the complete state of the execution. At the heart of this manifest lies the manifest hash, a SHA‑256 digest computed from deterministic, non‑secret fields that together describe exactly what was analyzed and how. This article explains how this hash is constructed, where it lives in the codebase, and why it serves as the cryptographic anchor for session integrity across runs, resumptions, and audits.

What Fields Contribute to the Manifest Hash

The manifest hash is not a single value but a composite of several SHA‑256 fields, each capturing a distinct dimension of the run. These fields are defined in [internal/session/manifest.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/manifest.go):

Field	Purpose	Location
IdentitySHA256	Hash of repository identity (origin URL, default branch, and related metadata)	manifest.go#L241‑L242
SourceArtifactSHA256	Hash of the source artifact—typically the commit SHA or workspace snapshot	manifest.go#L55‑L57
RuleConfigSHA256	Hash of the rule configuration governing the scan	manifest.go#L66‑L67
RuntimeConfigSHA256	Hash of runtime flags, environment variables, and execution parameters	manifest.go#L66‑L68

Critically, no secrets, tokens, or raw credentials are ever folded into these hashes. Only redacted, deterministic values are included, ensuring that the manifest hash remains a pure function of the run's inputs.

How the Manifest Hash Is Computed

The actual digest generation happens in [internal/agent/agent.go](https://github.com/alibaba/open-code-review/blob/main/internal/agent/agent.go#L895‑L911) via the hashFields helper. This function accepts a variadic slice of strings and produces a single SHA‑256 digest:

// Conceptual implementation based on agent.go#L895-L911
func hashFields(fields ...string) string {
    h := sha256.New()
    for _, f := range fields {
        h.Write([]byte(f))
    }
    return hex.EncodeToString(h.Sum(nil))
}

The manifest hash extends this primitive by calling hashFields with a carefully ordered sequence of run context values. Here is how a complete manifest hash might be computed:

// Example: Computing a manifest hash for a run
func computeManifestHash(runID, repoURL, commitSHA string, cfg Config) string {
    // The hash folds together the run ID, repository identity, commit SHA,
    // and a redacted version of the configuration.
    return hashFields(
        runID,
        repoURL,
        commitSHA,
        cfg.Redacted(), // only non‑secret fields are included
    )
}

Four Mechanisms That Enforce Session Integrity

The manifest hash serves session integrity through four operational guarantees:

1. Deterministic Fingerprinting

Because the same fields are hashed in the same order every time, identical runs produce identical hashes. Any divergence—whether a new commit, altered rule file, or different repository URL—immediately yields a different digest. This creates a precise, content‑addressable identifier for every review operation.

2. Resume Safety

When a paused session is resumed, the system recomputes the manifest hash from the current environment and compares it against the stored value. A mismatch aborts the operation:

// Example: Validating a resumed session
func validateResume(storedHash string, currentHash string) error {
    if storedHash != currentHash {
        return fmt.Errorf("session integrity violation: manifest hash mismatch")
    }
    return nil
}

This prevents silent corruption that would occur if a user attempted to resume a session after switching branches, modifying rules, or changing runtime flags.

3. Tamper Detection

The manifest hash is persisted to the session file (typically manifest.jsonl) by [internal/session/persist.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/persist.go). During loading, [internal/viewer/store.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/persist.go) recomputes the hash and validates it against the stored value. Any external modification of session data without corresponding hash recomputation triggers an integrity violation error.

4. Cross‑Component Consistency

The same manifest hash appears in both the CLI JSON output and the persisted session stream. This ensures that CI pipelines, audit logs, and downstream consumers all reference exactly the same coverage snapshot, eliminating discrepancies between ephemeral output and durable state.

Where the Manifest Hash Lives in the Codebase

File	Role
[internal/session/manifest.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/manifest.go)	Defines RunManifest struct, all SHA‑256 fields, and builder logic
[internal/agent/agent.go](https://github.com/alibaba/open-code-review/blob/main/internal/agent/agent.go)	Implements hashFields helper used for manifest hash generation
[internal/session/persist.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/persist.go)	Handles serialization of the manifest (including hash) to disk
[internal/viewer/store.go](https://github.com/alibaba/open-code-review/blob/main/internal/viewer/store.go)	Validates manifest hash during session loading and resumption

Summary

• The manifest hash is a SHA‑256 composite digest computed from IdentitySHA256, SourceArtifactSHA256, RuleConfigSHA256, and RuntimeConfigSHA256.
• It is generated by hashFields in [agent.go](https://github.com/alibaba/open-code-review/blob/main/internal/agent/agent.go#L895‑L911) and defined in [manifest.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/manifest.go).
• It guarantees deterministic fingerprinting, resume safety, tamper detection, and cross‑component consistency.
• Secrets are explicitly excluded from hash computation; only redacted, deterministic values are used.

Frequently Asked Questions

What happens if the manifest hash mismatches during resume?

The resume operation aborts with an integrity violation error. According to the Open‑Code‑Review source code, [internal/viewer/store.go](https://github.com/alibaba/open-code-review/blob/main/internal/viewer/store.go) validates the stored hash against a freshly computed value, and any discrepancy prevents session restoration to avoid analyzing the wrong code state with mismatched rules.

Can the manifest hash be used to detect configuration drift?

Yes. Because RuleConfigSHA256 and RuntimeConfigSHA256 are components of the manifest hash, any change to scanning rules or runtime flags produces a different digest. Comparing hashes across runs immediately reveals when the analysis environment has diverged from a baseline.

Why SHA‑256 specifically?

The Open‑Code‑Review implementation uses SHA‑256 as implemented in Go's standard crypto/sha256 package. This provides sufficient collision resistance for fingerprinting purposes while maintaining compatibility with downstream verification tools and audit systems that expect standard cryptographic hashes.

Where is the manifest hash stored?

The hash is persisted to the session file (conventionally manifest.jsonl) by [internal/session/persist.go](https://github.com/alibaba/open-code-review/blob/main/internal/session/persist.go). It also appears in the CLI's JSON output, enabling both durable state management and ephemeral pipeline integration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}