diff --git a/harness/tests/conftest.py b/harness/tests/conftest.py
index c055f1c6..81081d1f 100644
--- a/harness/tests/conftest.py
+++ b/harness/tests/conftest.py
@@ -3,6 +3,7 @@ import sys
 from pathlib import Path
 
 import pytest
+from dotenv import load_dotenv
 from sqlalchemy import create_engine
 from testcontainers.postgres import PostgresContainer
 
@@ -15,6 +16,28 @@ if str(_ROOT) not in sys.path:
 # Directory sessions/ risolta relativamente alla root harness (per i test che creano sessioni)
 os.environ.setdefault("NSP_HARNESS_ROOT", str(_ROOT))
 
+# L2 tests need the remote credentials from harness/.env (gitignored). Loaded once,
+# autouse, before any test. L0/L1 tests don't read these vars; missing .env only
+# affects the L2 skip guard below, so L0/L1 never break for missing credentials.
+load_dotenv(_ROOT / ".env")
+
+# L2 connection prerequisites (spec Testing Strategy). If any is missing/empty, L2
+# tests are SKIPPED (not failed) so the default run (pytest = L0+L1) stays green.
+REQUIRED_L2 = ["THOTH_DWH_API_KEY", "THOTH_VEC_API_KEY", "THOTH_VEC_WRITE_API_KEY", "THOTH_SSL_CA"]
+
+
+@pytest.fixture(scope="session")
+def l2_env():
+    """Skip the test (not fail) when L2 credentials are absent. Use in every L2 test:
+    `def test_x(l2_env): ...`. Returns True so the test body runs once env is confirmed."""
+    missing = [v for v in REQUIRED_L2 if not os.environ.get(v, "").strip()]
+    if missing:
+        pytest.skip(
+            f"L2 skipped -- missing env vars: {', '.join(missing)} "
+            f"(populate harness/.env and connect via VPN)"
+        )
+    return True
+
 
 # --- L0 fixtures (testcontainers, real Postgres) --------------------------------
 # Session-scoped: un solo container per tutta la run L0. Schema fixture caricato una
diff --git a/harness/tests/l2/__init__.py b/harness/tests/l2/__init__.py
new file mode 100644
index 00000000..e69de29b