Commit and recover

Generations are complete, verifiable saves of the running agent. Recovery never depends on the damaged core.

Checkpoint

/checkpoint

A checkpoint requires a clean Git worktree and a passing ./script/check, then saves pending reconstructible mutations and publishes a retained image without stopping the session. /generations lists what is retained, and /rollback ID selects one and exits through recovery. The same works from the shell:

$ autolith --recovery --list
$ autolith --recovery --generation GENERATION-ID

Crash recovery

A fatal failure in the active image publishes a private crash capsule and restores the terminal. Recovery boots the separately built pristine image, or falls back to source, and tries in order: the selected generation for the current source revision, other compatible generations newest first, then a private clean checkout of committed source.

The conversation comes back without duplicated scrollback. With a valid capsule, recovery queues one read-only diagnosis turn before ordinary input: it can inspect bounded crash context, the workspace, tracked source, and active state, and it has no shell, MCP, image, write, mutation, checkpoint, or rollback tools. It asks before any repair.

Rebuild from source

Saved cores are exact but bound to their recorded SBCL version, OS build, and architecture. Source stays authoritative: a generation manifest carries an ordered reconstruct.lisp, and any machine can rebuild from it:

(asdf:load-asd (truename "autolith.asd"))
(asdf:load-system :autolith)
(load #P"/path/from/generation/manifest/reconstruct.lisp")