diff --git a/.ci/local.toml b/.ci/local.toml
new file mode 100644
index 0000000..c3c32ec
--- /dev/null
+++ b/.ci/local.toml
@@ -0,0 +1,92 @@
+# Muster's CI, run on Murph by ci-local (Castor-o7/rally RAL-144, docs/ci-local.md there).
+# One entry per job in .github/workflows/ci.yml, which still runs on GitHub too. Each posts
+# `local/<job>`, alongside Actions' `check`, which stays the one main's ruleset requires.
+
+workflows = ["ci.yml"]
+# Josh, 2026-11-11: run both. Muster is public, so GitHub's standard runners bill nothing.
+hosted_runs = "public repository: GitHub's standard hosted runners bill nothing"
+
+# The workspace checks and the end-to-end scripts.
+[jobs.tests]
+mem = "12G"
+cpu = "600%"
+timeout_min = 45
+postgres = true
+env = { CARGO_PROFILE_DEV_DEBUG = "line-tables-only" }
+run = """
+# Each published crate ships its own copy of the licences; they must match the root files exactly.
+status=0
+for crate in entities daemon shim tui; do
+  for f in LICENSE-MIT LICENSE-APACHE; do
+    if ! cmp -s "$f" "crates/$crate/$f"; then echo "crates/$crate/$f differs from the root $f (or is missing)"; status=1; fi
+  done
+done
+test $status = 0
+command -v nc >/dev/null || { echo "the end-to-end scripts need nc (openbsd-netcat), which this machine doesn't have"; exit 1; }
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --workspace
+cargo build --workspace && ./scripts/test-gate-e2e.sh
+./scripts/test-links-e2e.sh
+sh scripts/test-install-codex.sh
+RESTART_E2E_POSTGRES_URL="$CI_POSTGRES_URL" ./scripts/test-restart-e2e.sh
+./scripts/test-restart-file-e2e.sh
+python3 -m unittest discover -s scripts/sandbox -v
+"""
+
+# MUS-69's delivery conformance grid.
+[jobs.conformance]
+mem = "12G"
+cpu = "600%"
+timeout_min = 45
+postgres = true
+env = { CARGO_PROFILE_DEV_DEBUG = "line-tables-only" }
+run = """
+# bun, pinned and checked as the workflow does, kept between runs under ~/.cache/ci/tools.
+BUN_VERSION=1.3.14
+BUN_SHA256=951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f
+bun_dir="$HOME/.cache/ci/tools/bun-$BUN_VERSION"
+if [ ! -x "$bun_dir/bun-linux-x64/bun" ]; then
+  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$TMPDIR/bun.zip" "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip"
+  echo "${BUN_SHA256}  $TMPDIR/bun.zip" | sha256sum -c -
+  mkdir -p "$bun_dir" && python3 -m zipfile -e "$TMPDIR/bun.zip" "$bun_dir" && chmod +x "$bun_dir/bun-linux-x64/bun"
+fi
+export MUSTER_BUN="$bun_dir/bun-linux-x64/bun"
+"$MUSTER_BUN" --version
+for plugin in muster-pi muster-opencode muster-prime-agent; do
+  (cd "plugins/$plugin" && npm ci --workspaces=false --no-audit --no-fund --ignore-scripts)
+done
+(cd plugins/muster-pi && "$MUSTER_BUN" test)
+export CONFORMANCE_REQUIRE_BUN=1
+export CONFORMANCE_POSTGRES_URL="$CI_POSTGRES_URL"
+export CONFORMANCE_REQUIRE_POSTGRES=1
+cargo build --workspace && cargo test -p muster-shim --test conformance -- --ignored --nocapture
+"""
+
+# What main's ruleset requires: passes only when `tests` and `conformance` both passed.
+[jobs.check]
+needs = ["tests", "conformance"]
+
+[jobs.macos]
+manual = "macOS (MUS-13): runs on GitHub's hosted macOS, which bills nothing on a public repo"
+
+# muster-shim's #[cfg(windows)] code, cross-compiled.
+[jobs.windows-cross-check]
+mem = "6G"
+cpu = "400%"
+timeout_min = 25
+run = """
+command -v x86_64-w64-mingw32-gcc >/dev/null || { echo "needs the mingw C cross-compiler (mingw-w64-gcc), which this machine doesn't have"; exit 1; }
+rustup target list --installed | grep -qx x86_64-pc-windows-gnu || rustup target add x86_64-pc-windows-gnu
+cargo check -p muster-shim --target x86_64-pc-windows-gnu
+"""
+
+# Dependency audit (MUS-11), with cargo-deny at the workflow's pinned version.
+[jobs.dependency-audit]
+mem = "4G"
+cpu = "200%"
+timeout_min = 20
+run = """
+test "$(cargo deny --version)" = "cargo-deny 0.20.2" || cargo install --locked cargo-deny --version 0.20.2
+cargo deny check
+"""