diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2faf672
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+# Credentials NEVER live in the repo. Any *.env landing here is ignored
+# as a tripwire (env.example is the only committed shape).
+*.env
+bin/
+.smoke/
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..cce9a33
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,19 @@
+# Makefile: thin front door over dev.sh so `make build/vet/test/check/smoke`
+# route through the digest-pinned Docker builder (ALL dev work in Docker —
+# the host never runs a Go toolchain).
+.PHONY: build vet test check smoke
+
+build:
+	@./dev.sh build
+
+vet:
+	@./dev.sh vet
+
+test:
+	@./dev.sh test
+
+check:
+	@./dev.sh check
+
+smoke:
+	@./dev.sh smoke
diff --git a/dev.sh b/dev.sh
new file mode 100755
index 0000000..a2190a0
--- /dev/null
+++ b/dev.sh
@@ -0,0 +1,54 @@
+#!/bin/sh
+# bitwarden-go dev wrapper. EVERY compile/vet/test path routes through the
+# digest-pinned Docker builder (same image as mopac-keyproxy; the host runs
+# containers, never toolchains).
+#
+# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
+#
+#   build    compile ./cmd/bitwarden-go into bin/bitwarden-go
+#   vet      go vet ./...
+#   test     go test ./... (all tests run against the in-process fake
+#            Secrets Manager server; the real vault is NEVER contacted)
+#   check    build + vet + test (the pre-push gate)
+#   smoke    end-to-end smoke: builds, boots the fake Secrets Manager in a
+#            container on 127.0.0.1:8600, drives the real CLI from the host
+#            through a 0600 env file (login / projects / secrets list / get,
+#            redaction check on stderr), tears everything down
+#   shell    interactive sh inside the builder
+set -e
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)
+
+run() {
+    docker run --rm -v "$PWD:/h" -w /h \
+        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+        "$IMAGE" "$@"
+}
+
+cmd=${1:-check}
+shift || true
+
+case "$cmd" in
+build)
+    run go build -o bin/bitwarden-go ./cmd/bitwarden-go
+    ;;
+vet)
+    run go vet ./...
+    ;;
+test)
+    run go test "$@" ./...
+    ;;
+check)
+    run sh -c 'go build -o bin/bitwarden-go ./cmd/bitwarden-go && go vet ./... && go test ./...'
+    ;;
+smoke)
+    ./smoke/smoke.sh
+    ;;
+shell)
+    run sh
+    ;;
+*)
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
+    exit 1
+    ;;
+esac
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..85bcbab
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,3 @@
+module git.knownelement.com/ukrrs/mopac-bitwarden-go
+
+go 1.26