feat: e2e multi-agent development pipeline (5 agents, TLS + NATS)

e2e/tests/13-multi-agent-pipeline/Dockerfile

@@ -0,0 +1,19 @@
+FROM docker.io/library/python:3.13-slim
+
+WORKDIR /app
+ENV PYTHONPATH=/app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && pip install --no-cache-dir nats-py==2.9.0
+
+COPY e2e/tests/workspace_common /app/workspace_common
+COPY e2e/tests/13-multi-agent-pipeline/test_multi_agent_pipeline.py /app/test_multi_agent_pipeline.py
+
+RUN groupadd -r testuser && useradd -r -m -g testuser -u 1000 testuser && \
+    chown -R testuser:testuser /app
+
+USER testuser
+
+CMD ["python", "/app/test_multi_agent_pipeline.py"]

e2e/tests/13-multi-agent-pipeline/Makefile

@@ -0,0 +1,40 @@
+REGISTRY ?= ghcr.io/underpass-ai/underpass-runtime
+IMAGE_NAME = e2e-multi-agent-pipeline
+VERSION ?= v1.0.0
+NAMESPACE ?= underpass-runtime
+IMAGE = $(REGISTRY)/$(IMAGE_NAME):$(VERSION)
+LATEST = $(REGISTRY)/$(IMAGE_NAME):latest
+
+BUILDER := $(shell command -v podman 2>/dev/null || command -v docker 2>/dev/null)
+
+.PHONY: build push build-push deploy status logs delete
+
+build:
+	@echo "Building $(IMAGE)..."
+	cd ../../../ && $(BUILDER) build \
+		-f e2e/tests/13-multi-agent-pipeline/Dockerfile \
+		-t $(IMAGE) \
+		-t $(LATEST) \
+		.
+	@echo "Built $(IMAGE)"
+
+push:
+	@echo "Pushing $(IMAGE)..."
+	$(BUILDER) push $(IMAGE)
+	$(BUILDER) push $(LATEST)
+	@echo "Pushed $(IMAGE)"
+
+build-push: build push
+
+deploy:
+	kubectl apply -f job.yaml
+
+status:
+	kubectl get job -n $(NAMESPACE) e2e-multi-agent-pipeline || echo "Job not found"
+	kubectl get pods -n $(NAMESPACE) -l app=e2e-multi-agent-pipeline || echo "No pods found"
+
+logs:
+	kubectl logs -n $(NAMESPACE) -l app=e2e-multi-agent-pipeline --tail=200 -f
+
+delete:
+	kubectl delete job -n $(NAMESPACE) e2e-multi-agent-pipeline || true

e2e/tests/13-multi-agent-pipeline/job.yaml

@@ -0,0 +1,71 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: e2e-multi-agent-pipeline
+  namespace: underpass-runtime
+  labels:
+    app: e2e-multi-agent-pipeline
+    test-type: e2e
+    test-suite: workspace
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 7200
+  activeDeadlineSeconds: 300
+
+  template:
+    metadata:
+      labels:
+        app: e2e-multi-agent-pipeline
+        test-type: e2e
+    spec:
+      restartPolicy: Never
+      automountServiceAccountToken: false
+      imagePullSecrets:
+        - name: ghcr-pull
+      volumes:
+        - name: ca-cert
+          configMap:
+            name: runtime-ca
+
+      containers:
+        - name: test-runner
+          image: ghcr.io/underpass-ai/underpass-runtime/e2e-multi-agent-pipeline:v1.0.0
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: ca-cert
+              mountPath: /etc/ssl/runtime
+              readOnly: true
+          env:
+            - name: WORKSPACE_URL
+              value: "https://underpass-runtime.underpass-runtime.svc.cluster.local:50053"
+            - name: NATS_URL
+              value: "nats://nats.underpass-runtime.svc.cluster.local:4222"
+            - name: SSL_CERT_FILE
+              value: "/etc/ssl/runtime/ca.crt"
+            - name: REQUESTS_CA_BUNDLE
+              value: "/etc/ssl/runtime/ca.crt"
+            - name: EVIDENCE_FILE
+              value: "/tmp/evidence-13.json"
+            - name: PYTHONUNBUFFERED
+              value: "1"
+            - name: E2E_DEBUG
+              value: "1"
+            - name: E2E_SKIP_CLEANUP
+              value: "0"
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "256Mi"
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault