diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..346cad1
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,40 @@
+# webber — the repo's command surface (D-27).
+#
+# Multi-component, so this lives at the root and reaches down rather than
+# sitting inside webber-api/. The code, tests and tooling config are all in
+# webber-api/; sandbox-templates/ and sandbox.sh are the other half of the repo
+# and have no build of their own. Keeping one Makefile means `make test` means
+# the same thing wherever you are standing (D-27).
+#
+# Paths resolve here (D-10): `python3` is 3.8 on this host, and a bare `pytest`
+# or `ruff` resolves only in a login shell.
+
+API    := $(CURDIR)/webber-api
+VENV   := $(API)/.venv
+PYTHON ?= python3.12
+
+.DEFAULT_GOAL := help
+
+.PHONY: help
+help: ## Show this help
+	@grep -hE '^[a-z][a-z0-9_-]*:.*?## ' $(MAKEFILE_LIST) \
+	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'
+
+.PHONY: setup
+setup: ## Create the webber-api venv and install dev dependencies
+	cd $(API) && $(PYTHON) -m venv .venv && .venv/bin/pip install -e ".[dev]"
+
+.PHONY: test
+test: ## Run the webber-api test suite
+	@test -x $(VENV)/bin/python || { echo "FAIL — no venv; run: make setup"; exit 1; }
+	cd $(API) && .venv/bin/python -m pytest tests/
+
+.PHONY: lint
+lint: ## ruff check over webber-api
+	@test -x $(VENV)/bin/ruff || { echo "FAIL — ruff not installed; run: make setup"; exit 1; }
+	cd $(API) && .venv/bin/ruff check .
+
+.PHONY: typecheck
+typecheck: ## mypy over webber-api
+	@test -x $(VENV)/bin/mypy || { echo "FAIL — mypy not installed; run: make setup"; exit 1; }
+	cd $(API) && .venv/bin/mypy .