diff --git a/.ryph/Dockerfile b/.ryph/Dockerfile
new file mode 100644
index 000000000..db07eaefe
--- /dev/null
+++ b/.ryph/Dockerfile
@@ -0,0 +1,34 @@
+FROM ghcr.io/drips-network/ryph-universal:1
+
+USER root
+
+# Tauri's system libraries (radicle-desktop's cargo build, clippy and tests),
+# and bzip2 for radicle-explorer's .tar.bz2 test fixtures.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      libwebkit2gtk-4.1-dev \
+      libjavascriptcoregtk-4.1-dev \
+      libayatana-appindicator3-dev \
+      librsvg2-dev \
+      libxdo-dev \
+      bzip2 \
+ && rm -rf /var/lib/apt/lists/*
+
+# The OS libraries Playwright's browsers need: WebKit for radicle-desktop's e2e
+# tests, Chromium and WebKit for radicle-explorer's and always-on-node's. The
+# browsers themselves are installed by each member's setup, keyed on its lockfile.
+RUN npx -y playwright@1.61.1 install-deps chromium webkit \
+ && rm -rf /var/lib/apt/lists/* /root/.npm \
+ && chown -R runner:runner /usr/local/share/mise
+
+# garden-broker's `make lint`.
+RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.14.0/install.sh \
+      | sh -s -- -b /usr/local/bin v2.14.0 \
+ && golangci-lint version
+
+USER runner
+
+# garden-broker's go.mod files say `go 1.25.0`, a minimum, and pin no toolchain.
+# Without this, mise reads that line as a pin and tries to download Go 1.25.0
+# instead of using the image's newer Go.
+ENV MISE_IDIOMATIC_VERSION_FILE_ENABLE_TOOLS=node,python,deno,bun
diff --git a/.ryph/environment.md b/.ryph/environment.md
new file mode 100644
index 000000000..8d667a575
--- /dev/null
+++ b/.ryph/environment.md
@@ -0,0 +1,40 @@
+# radicle-desktop environment
+
+This repository's `.ryph/Dockerfile` is the machine for the whole Radicle
+workspace. On top of the universal image it adds:
+
+- Tauri's system libraries (`libwebkit2gtk-4.1-dev`,
+  `libjavascriptcoregtk-4.1-dev`, `libayatana-appindicator3-dev`,
+  `librsvg2-dev`, `libxdo-dev`), so the Rust crates build here;
+- the OS libraries Playwright's Chromium and WebKit need, and `bzip2`;
+- `golangci-lint` v2.14.0 in `/usr/local/bin`, for garden-broker;
+- `MISE_IDIOMATIC_VERSION_FILE_ENABLE_TOOLS=node,python,deno,bun`, so mise
+  does not read a `go.mod` `go` line as a pin: Go is the image's own.
+
+`.ryph/setup.yml` installs the npm dependencies, Playwright's WebKit and the
+pinned Radicle binaries (`tests/tmp/bin`), and warms clippy, the test build
+and the e2e backend (`test-http-api`, `rad-job`) in `target/`. Node 24.15.0
+(`.nvmrc`) and Rust 1.97.1 (`rust-toolchain.toml`) are installed by mise and
+rustup on first use.
+
+## Checks (what CI runs)
+
+```sh
+npm run check-js        # svelte-check, eslint, prettier
+scripts/check-rs        # cargo fmt --check, clippy -Dwarnings, cargo test
+npm run test:unit
+npm run test:e2e        # WebKit; needs scripts/install-binaries, done by setup
+```
+
+`npm run check:ci` runs all of them in order and logs to
+`tests/tmp/check-ci.log`. The machine has 2 CPUs: the Rust test build and the
+e2e suite are the slow parts.
+
+## What does not work here
+
+- Chromium cannot be installed by Playwright: its download redirects to
+  `storage.googleapis.com`, which the egress allowlist refuses. This app's
+  e2e tests use WebKit only and are unaffected; radicle-explorer's and
+  always-on-node's Chromium e2e tests are.
+- There is no container runtime, so nothing that runs `docker` or `podman`
+  works (always-on-node's `pnpm test:e2e`, garden-broker's integration tests).
diff --git a/.ryph/setup.yml b/.ryph/setup.yml
new file mode 100644
index 000000000..258b6ef76
--- /dev/null
+++ b/.ryph/setup.yml
@@ -0,0 +1,13 @@
+steps:
+  - name: install npm dependencies
+    run: npm install --prefer-offline
+  - name: install Playwright WebKit
+    run: npx playwright install webkit
+  - name: install the pinned Radicle binaries for e2e tests
+    run: scripts/install-binaries
+  - name: warm clippy (scripts/check-rs)
+    run: mkdir -p build && cargo clippy --workspace --all-targets --locked
+  - name: warm cargo test (scripts/check-rs)
+    run: cargo test --workspace --no-run --locked
+  - name: warm the e2e backend (tests/support/globalSetup.ts)
+    run: cargo build --manifest-path ./crates/test-http-api/Cargo.toml --locked && cargo build -p radicle-job --bin rad-job --locked