fix(scripts): fail tab-diff verify on live CLI panes with no captured session identity#535
Merged
Merged
Conversation
…ntity The verify subcommand silently passed live coding-CLI panes (claude/codex/ opencode/amplifier) that had no sessionRef in tabs-sync snapshots. After server restart, such panes respawn as blank sessions — silent conversation state loss — yet verify printed 'OK' as if restore succeeded. Add a fifth verdict: 'NO CAPTURED IDENTITY' for running panes with session- capable modes but no sessionRef. These fail verify loudly and are excluded from restore-tabs.sh remediation (no identity to restore). Shell panes remain stateless-exempt. Fixes the incident on 2026-07-25 where 7 amplifier/codex panes silently restored blank while verify reported success. TDD: extend deploy-tab-diff-rust.spec.ts offline diff test with dev-1 fixture pane (live amplifier terminal, no sessionRef) — RED before fix, GREEN after. All tests pass; tsc --noEmit clean. 🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier) Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
danshapiro
added a commit
that referenced
this pull request
Jul 27, 2026
…ype restore contract) (#538) This is the analysis document underpinning the 2026-07-25 incident response — the D3 identity-capture gap, the per-pane-type restore contract, and the roadmap that PRs #534 (client attach-leak fix) and #535 (tab-diff verify NO CAPTURED IDENTITY verdict) reference. Incorporates all round-2 council gates; pending final council confirmation. 🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier) Co-authored-by: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
scripts/deploy-tab-diff.sh verify(the pre/post-restart tab identity ritual, continuity trio deliverable 3) silently passed live coding-CLI panes whose session identity was never captured in tabs-sync snapshots (no sessionRef). Such panes restore as blank sessions after a restart — real conversation-state loss — while verify printed "OK: every previously-live pane came back with the same session identity." This hid the 2026-07-25 incident where 7 amplifier/codex panes restored blank.Fix
Add a fifth verdict,
NO CAPTURED IDENTITY: a pane that was running at capture, whose mode is session-capable (claude/codex/opencode/amplifier — mirrors crates/freshell-ws/src/existence.rs), but carries no sessionRef, now fails verify loudly. Shell panes remain exempt (stateless by design). These panes are excluded from the printed restore-tabs.sh --pane remediation (snapshots hold no identity to restore — it would only rebuild the blankness) and instead get an explicit "UNRECOVERABLE FROM SNAPSHOTS" section directing manual recovery from the provider's own session store.Testing (TDD)
Extended the offline diff-engine test in deploy-tab-diff-rust.spec.ts with a live amplifier fixture pane (no sessionRef, respawns fine) — confirmed RED before the fix (silently passed, reproducing the incident), GREEN after. All 4 offline tests in the spec pass; tsc --noEmit clean. Note: amplifier panes will keep failing verify until amplifier session-identity capture exists (D3 in docs/plans/2026-07-24-restart-resilience-architecture-analysis.md) — that is intended fail-loud behavior.
Generated with Amplifier