---
name: project-posture-closed-test
description: VR1 is a closed in-house test -- prioritize deployment tooling/runbooks/hardening over real-world security
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 75c0e0cb-822c-4f42-ab63-04d3175865f4
---

VR1 (the DC-DC buildout) is a CLOSED IN-HOUSE TEST cloud, not a live/shared/production environment.

**What to prioritize** (operator ruling, 2026-07-15): deployment steps, configuration tuning,
OpenTofu/juju/deployment-tool scripting and hardening, and runbook draft updates.

**What is DEFERRED:** real-world deployment security -- credential rotation/revocation, non-shared
tokens, flip-to-private, second-person unseal, etc. Those come AFTER the tests are complete, during
the teardown-and-redeploy cycles (test2/3/4/...). The security-ledger rows (SEC-001..008) stay OPEN
as tracked obligations but are NOT blockers on test progress.

**Why:** validating the deployment mechanics, tooling, and runbooks is the point of this phase;
locking down credentials on a closed test would spend effort where it does not yet matter. Security
hygiene that IS done now is the DATA-LOSS-preventing kind (see [[creds-folder-convention]]), not the
lockdown kind.

**How to apply:** when weighing a security hardening task vs a deployment/tooling/runbook task in
VR1, prefer the latter unless the security item is also a data-loss or continuity risk. Do not gate
test progress on the deferred SEC obligations. Still surface real exposures to the ledger (don't
hide them), just don't treat them as must-fix-now.
