diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..53fba48
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# CI/CD baseline: any change to the workflow or root workspace config
+# requires a maintainer review. Keeps the release train safe.
+.github/workflows/   @ninan-versioning
+package.json         @ninan-versioning
+pnpm-workspace.yaml  @ninan-versioning
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..6d984ca
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+# Cancel superseded runs on the same ref
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  typecheck-and-test:
+    name: Typecheck + Test (Node 20, pnpm)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.12.0
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          # NOTE: `cache: pnpm` requires a root pnpm-lock.yaml. There isn't one
+          # yet because main is prose-only. Re-add caching in a follow-up PR
+          # after the first connector (#15) lands with a real lockfile.
+
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Typecheck (all packages)
+        run: pnpm -r --if-present run typecheck
+
+      - name: Test (all packages)
+        run: pnpm -r --if-present run test
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..209e3ef
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+20
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..679a4e4
--- /dev/null
+++ b/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "shoploop",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Shoploop monorepo root. Workspace orchestration only — no runtime code lives here.",
+  "license": "UNLICENSED",
+  "packageManager": "pnpm@9.12.0",
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "typecheck": "pnpm -r --if-present run typecheck",
+    "test": "pnpm -r --if-present run test",
+    "build": "pnpm -r --if-present run build",
+    "ci": "pnpm run typecheck && pnpm run test"
+  }
+}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..8abf7a3
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,4 @@
+packages:
+  - "connectors/*"
+  - "packages/*"
+  - "apps/*"