diff --git a/.crush/active-ticket b/.crush/active-ticket
index 77bdb53..1493e77 100644
--- a/.crush/active-ticket
+++ b/.crush/active-ticket
@@ -1 +1 @@
-#699
+#702
diff --git a/dev/README.md b/dev/README.md
new file mode 100644
index 0000000..db4304e
--- /dev/null
+++ b/dev/README.md
@@ -0,0 +1,8 @@
+# dev/ — workstation development loop (Tilt)
+
+Workstation = dev-only (founder rule, 2026-09-05). Production delivery stays
+flux-only (gitops, clusters/pfv-k8s/). Tilt provides the fast iteration loop
+for k8s services under development before they graduate to git.
+
+- `tilt up` — start the dev loop (UI: http://localhost:10350)
+- Tiltfile targets local/dev contexts; prod namespaces are guarded.
diff --git a/dev/Tiltfile b/dev/Tiltfile
new file mode 100644
index 0000000..2992371
--- /dev/null
+++ b/dev/Tiltfile
@@ -0,0 +1,20 @@
+# Tiltfile — WORKSTATION DEV LOOP (dev-only rule: this machine never runs prod)
+#
+# Pairs with ADR-0001: flux remains the ONLY path to prod (git -> pfv-k8s).
+# Tilt gives a fast local iteration loop for k8s-deployed services BEFORE they
+# graduate to the flux-managed manifests in clusters/pfv-k8s/.
+#
+# Usage (on the workstation):
+#   tilt up                     # dev UI on http://localhost:10350
+#   tilt down
+#
+# By default this targets the LOCAL cluster context; point at pfv-k8s only
+# with an explicit dev namespace (tilt-dev), never against prod namespaces.
+
+# --- example dev service (uncomment + adapt per service) ---
+# yaml = k8s_yaml(['dev/mcpjungle-dev.yaml'])
+# k8s_resource('mcpjungle-dev', port_forwards=['18080:8080'])
+
+# Dev-namespace guard: refuse to run against prod manifests
+fail_if(cond=os.path.exists('clusters/pfv-k8s/flux-system'),
+        msg='This Tiltfile is for local dev only. Prod delivery = flux (do not mix).')