diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..c03c519
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,37 @@
+# library-desk — the repo's command surface (D-27).
+#
+# Note the port split, which is the trap this repo's CLAUDE.md leads with:
+# `make run` serves on 8778 with reload, while 8089 is the *container*. Testing
+# localhost:8089 on this box hits the deployed service, not your dev server.
+#
+# Paths resolve here (D-10): `python3` is 3.8 on this host and a bare `pytest`
+# resolves only in a login shell, so both go through the venv explicitly.
+
+VENV   := $(CURDIR)/.venv
+PYTHON ?= python3.12
+
+.DEFAULT_GOAL := help
+
+.PHONY: help
+help: ## Show this help
+	@grep -hE '^[a-z][a-z0-9_-]*:.*?## ' $(MAKEFILE_LIST) \
+	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'
+
+.PHONY: setup
+setup: ## Create the venv and install dependencies
+	$(PYTHON) -m venv .venv
+	$(VENV)/bin/pip install -r requirements.txt
+
+.PHONY: run
+run: ## Dev server on :8778 with reload (8089 is the container, not this)
+	./wakeup.sh
+
+.PHONY: test
+test: ## Run the test suite
+	@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 1; }
+	$(VENV)/bin/python -m pytest tests/
+
+.PHONY: lint
+lint: ## ruff check over the sources
+	@test -x $(VENV)/bin/ruff || { echo "FAIL — ruff not installed; run: make setup"; exit 1; }
+	$(VENV)/bin/ruff check src tests