Autolith: a self-modifying coding agent built entirely in Common Lisp

Autolith is a terminal-based programming agent that operates directly inside a Git repository, handling the usual agent chores—reading and editing files, searching the workspace, running commands and tests—but with an unusual architecture underneath. Rather than wrapping a separate model process, the whole system lives in a single SBCL image: the provider client, terminal UI, tool registry, conversation state, and decision logic are all Common Lisp objects the agent can reach. Search is handled in-process by a Rust library (fff) with a warm index, and the release ships its own SBCL 2.6.6 plus dependencies as a self-contained binary for Linux, macOS, and several BSDs, with Nix offered as the cleaner install path.

Two design choices stand out. First, the agent treats context that exceeds the model window as an environment rather than a prompt: a corpus is interned as a content-addressed object, and the model sees only its label, size, and digest while driving a heap-isolated Lisp environment through bounded slices, searches, and sub-inferences under an explicit token and call budget, leaving a readable inference trace. Second, Autolith can rewrite itself while running—redefining functions, macros, classes, and conditions in its live image, journaling each change, then optionally promoting a useful edit to a ‘private image commit’ that carries an executable replay script in a separate Git history. Crucially, this modifies the active agent without silently patching the tracked source repository, and an —immutable mode is available for read-only inspection.

The project (v0.35.0, defaulting to a gpt-5.6-sol model, with support for Codex, Grok, Fireworks, Anthropic, and other OpenAI-compatible endpoints) is candid about its trust model: it executes model-generated code with the user’s own privileges, and its process boundaries exist for reliability, not isolation. The developers explicitly warn against treating it as a security sandbox—it is a development tool for people who want an agent they can inspect, extend, and recover, not one to point at untrusted code.