[Story] E2E test — two-cluster KinD federation scenario

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate. Depends on all implementation stories.

Goal

End-to-end test proving cross-cluster agent identity federation works in a realistic scenario.

Scenario

Two KinD clusters (west and east), each with NineVigil installed and SPIRE enabled. A research-agent AgentWorkload in west calls a data-agent AgentWorkload in east over the A2A v2 protocol, presenting a JWT-SVID minted by the west SPIRE server, validated by east using the federated trust bundle.

Scope

• tests/e2e/cross_cluster_identity_test.go (or yaml-based test harness)
• Test fixtures: two KinD configs, two AgentWorkload manifests, two trust domain names
• Helper: federate trust bundles between the two clusters (test uses connected mode + air-gapped mode in separate runs)
• Assertions:
  • west agent fetches SVID via Workload API
  • east agent verifies SVID signature against federated bundle
  • A2A handshake completes successfully
  • Request from west agent with no SVID is rejected
  • Request from west agent with SVID for unknown trust domain is rejected
• CI gate: run on PRs touching identity or A2A code (selective)

Acceptance

• Test passes in CI consistently (no flakes over 10 runs)
• Test runtime <5 minutes