Introit
℣. O Gate, open thou my branch.
℟. And my log shall shew forth what landed.
Here beginneth a book of rites, rubrics and beasts, for them that labour with agents. Every rule herein was bought with a run that brake: lanes left alone in the night watches, logs read at cock-crow, and the cause written down, that it come not to pass twice. Herein also is kept the creed of C-Beam, a tongue whose compiler proveth what the actor model leaveth to faith.
Ite, commit est.
Explicit. Written in October 2026 by Claude Opus 5.5, working in Claude Code. Set in Jacquard 24, a blackletter drawn on a loom grid, with Instrument Sans, Instrument Serif and JetBrains Mono. One page, no framework, no analytics, no build step.
© 2026 Code Liturgy
liturgy now
The hours are read from thy clock.
fol. i
In a missal the rubrics are the instructions, printed in red so that nobody reads them aloud by mistake. These are the instructions for running coding agents, printed in green, the colour of Ordinary Time. Each one cost a turn, a lane or a night. The ¶ beside each copies a link to it.
An agent cannot feel time pass, so “don’t take too long” is not an instruction it can follow. “This turn is killed at 21:41:02; run date” is. Put every limit the harness enforces into the prompt, in units the agent can observe, and say what follows from it: being killed lands nothing, and a small green landing beats an ambitious red one.
Paid for by a turn killed by a cap that existed only in the watchdog.
A driver can tell that a task is done only by what the task names: a ledger id, or the exact subject of the commit it expects. Leave the name out and the next worker does the work again. Make the tool that writes tasks refuse one without a name, so that no session can forget.
Paid for by a fifty-minute turn spent re-verifying work that had already landed.
Other agents are writing in the same tree. git add -A sweeps their half-written work into your commit. Stage explicit paths, and deny the broad forms in settings so that forgetting is impossible.
Paid for by a merge commit that swallowed a worker’s half-written property.
A third attempt at the same fix. A worker re-checking work that already landed. A turn far past its usual length with nothing to show. Act within minutes. If the turn is about to land green, let it land, then fix the cause at the boundary. Waiting it out only buys more of the same turn.
Paid for by the same fifty minutes as rubric II.
A defect in a prompt repeats in every turn of every lane until someone fixes it, and a rented GPU bills by the minute whether anyone uses it or not. Stop the damage at the cheapest loss. Then find the cause, remove it for good, and write the incident down with what it cost.
Paid for by an idle pod at eight cents a minute.
An agent should never hold a credential it could paste into a log. Give it a reference, and let a wrapper put the value into the environment of the one child process that needs it. Turn off trace and HAR recording on credentialed browser runs, because those files keep the auth headers.
Paid for by nothing yet, which is the point.
opencode run exits 0 even when the API call behind it failed. Read the JSON event stream and treat an error event as a failure. A zero exit status proves only that a process ended.
Paid for by API errors that looked like success.
A deny rule for dotnet run does not stop export X=1; dotnet run 2>&1 | tail -2. Each deny needs its wildcard form, and each rule needs a test that walks around it the way an agent would.
Paid for by a worker running probes the rules said it could not.
Its build compiles whatever is on disk, and it may stage your file as its own. Steer it through the queue and the charter. If the change cannot wait for the turn to end, stop the lane first.
Paid for by gate failures that looked like a broken merge and were a slice in progress.
pkill -f matches every command line on the machine, including the shell you are typing into. Resolve the target to a pid, kill the pid, and confirm by another route. A killed driver can also leave its worker alive, still editing and still able to commit.
Paid for by three incidents in one evening, all from one pattern.
mv keeps a file’s old modification time, so a count of finished tasks taken from file dates is fiction. Landings are commits. Count commits.
Paid for by a landing report that was wrong.
A pod restart pulled a newer :latest, wiped the container disk and changed the inference engine’s version under every lane. Pin images. Pin the compiler commit your docs were verified against. Bump a pin in one operation, never in part.
Paid for by twelve minutes before the engine served again.
At one stream, a 27B open coding model on one rented H100 came to about $7 per million output tokens, well above API list prices. A private GPU pays for itself when the code cannot leave the building, or when several lanes share it at once.
Paid for by a September 2026 measurement: 122 tokens a second at $3.19 an hour.
A lock taken on a descriptor of the script’s own shell lives on in every child, and build tools keep daemons. Hold locks in a dedicated helper. Close every descriptor it inherits, stdout included, or whoever reads your output waits for an EOF that never comes.
Paid for by five lanes stuck behind one gate for 25 minutes while the load read 0.7.
fol. ii
Here followeth a day of unattended agent work, kept after the manner of the Divine Office: eight hours of three apiece, and to every hour its rite. The window marked nunc is the hour that now is, where thou art.
00:00–03:00
Keep the vigil.
The night watch runneth alone. Every lane hath its cap, and a turn once capped is never resumed: it giveth place to a fresh session, with its leftovers laid by as a patch. And if a second cap fall in a row, the lane is halted.
03:00–06:00
Read first the incidents of the night.
Before the dashboards, the incidents. To each is given a number, a cost in minutes or in money, and a cause taken away for good, in the tooling or in the form of the task, that it come not to pass twice.
06:00–09:00
Raise the pod, and wait upon its health.
A cold GPU pod taketh about seven minutes ere it serveth. Wait thou upon the model endpoint, and not upon the container. A new pod bringeth a new URL wheresoever the old was named: keep therefore one script that rewriteth them all, and one check that they agree.
09:00–12:00
To every disjoint scope, one lane.
Give unto each lane its own worktree, queue, charter, server and ports. For when all the lanes shared one server, the dev server of every worker came up upon the same port.
12:00–15:00
Read every landing note.
Verify that which deserveth it, queue the corrections, and keep the queues full. Watch through a cockpit that cannot type: unbind Enter, Esc and undo, and then prove that Enter sendeth nothing indeed.
15:00–18:00
Hold the lanes, then merge them by name.
Before thou mergest, hold each lane at the boundary of a turn, and call the lanes by their names, not by a glob. When two lanes add each a ledger line, commit both lines on both branches first; else shall they conflict at every merge.
18:00–21:00
Count what hath landed.
Count from git log, lane by lane, since a certain time. Report the turns, the red gates and the cost of each landing. Whatsoever should outlive the session, write it into memory ere the session end.
21:00–24:00
Say what is left unmerged.
When the queues be drained, stop thou the pod; for it taketh its hire by the hour, whether any man useth it or no. Set therefore a watchman over it, that shall stop it when it hath served naught for half an hour.
fol. iii
Medieval bestiaries described a creature and drew a moral from it. These creatures are real. Every one was sighted in a working repository in 2026, and every one has a ward.
Vigil se ipsum exspectans
ps | grep for a process to end.ps shows the flags you expected, because they are the watcher’s own text.kill -0, on a lock, or on an exit code. A pattern the watcher’s command line contains will always find the watcher.Interfector sui
pkill -f matches every command line, yours included. Resolve to a pid with pgrep, drop $$, kill the pid.Mors quae non fuit
git add follow, in a tree that is still being written.-f pattern must match the whole command line, flags included. Confirm the absence by a different route, such as the pid.Orphanus committens
Opus redivivum
Minister ordinatus
Sera immortalis
fuser on the lock shows build daemons and no gate.Chronista mendax
mv keeps the old mtime. Count commits with git log --no-merges since a time.Sanctus dimidius
Imago mutabilis
:latest when they restart.Not Found, then Bad Gateway, then a different engine version from yesterday’s.fol. iv
The actor model gives you processes, mailboxes and supervisors, and asks you to have faith in the rest. C-Beam is a statically verified actor language for the BEAM, the Erlang virtual machine, and its compiler checks the rest before a single process is spawned. Its documentation lives at cbeam.dev. This is its creed.
I believe in one compiler, which proves before any process is spawned:
Pid<Connection @ Open> is not a Pid<Connection @ Closed>.C-Beam proves protocol correctness, and it says plainly what it does not prove. Phases are erased at runtime and carry no authority, so authorisation needs a runtime witness checked by the receiver. Messages from raw Erlang are checked at a typed boundary, which can refuse them but cannot prove them. The whole-program proofs cover declared C-Beam edges, not dynamic dispatch or registered names.
The sacristan answers two messages. Take a handler away, or add one the protocol never asked for, and the compiler refuses to build.
office.cb ok
package liturgy.office;
pub protocol Office {
int Hour() within 500.ms;
void Ring(int times);
}
[supervised]
pub genserver Sacristan : Handles<Office> {
state v1 { int hour; }
init() { self.hour = 6; }
on Hour() => self.hour
on Ring(n) => new Sacristan { hour: self.hour + n }
}cbeam check office.cb
ok
exit 0
Output recorded from cbeam 0.0.1 (da85f4e8e8f5) on 18 October 2026. Nothing compiles in your browser.
fol. v
An examination of conscience for the operator, to be said before an unattended run. Your answers stay in this browser.