From 76c514b9c1cc025a24b6b6787174501c7aa5e5a8 Mon Sep 17 00:00:00 2001
From: agent-exec-transport <agent-exec-transport@localhost.invalid>
Date: Sun, 18 Oct 2026 15:07:15 +0000
Subject: [PATCH] agent-exec transport
 9e9255c1a5d63cb004c963f5c112b634/1574b796b404

---
 .../multi-instance/multi_instance_test.go     | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/tests/integration/multi-instance/multi_instance_test.go b/tests/integration/multi-instance/multi_instance_test.go
index 6c6ff29f..efff349c 100644
--- a/tests/integration/multi-instance/multi_instance_test.go
+++ b/tests/integration/multi-instance/multi_instance_test.go
@@ -475,6 +475,8 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 	}, nil)
 
 	apiKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "mi-acceptance")
+	// IAM U4 把建项目改为系统动作 project.create：由引导管理员经真实 API 授予 alice。
+	e.grantAliceProjectCreate(t)
 	uc := &userClient{
 		api:     &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
 		apiB:    &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
@@ -486,6 +488,46 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 	return uc
 }
 
+// grantAliceProjectCreate 以 mi-root 身份经 admin API 为 alice 追加系统授权
+// project.create（保留其已有授权；PUT 为整体替换，按 authorityEpoch 乐观并发）。
+func (e *env) grantAliceProjectCreate(t *testing.T) {
+	t.Helper()
+	rootKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", "mi-root", "--name", "mi-acceptance-root")
+	root := &http.Client{Timeout: httpWait, Transport: bearerRT{key: rootKey}}
+	var users []struct {
+		UserID string `json:"userId"`
+		Owner  string `json:"owner"`
+	}
+	e.do(t, root, "GET", "/api/admin/users", nil, &users)
+	userID := ""
+	for _, u := range users {
+		if u.Owner == aliceOwner {
+			userID = u.UserID
+		}
+	}
+	if userID == "" {
+		t.Fatalf("user %s not found in /api/admin/users", aliceOwner)
+	}
+	var grants struct {
+		Actions        []string `json:"actions"`
+		AuthorityEpoch int64    `json:"authorityEpoch"`
+	}
+	e.do(t, root, "GET", "/api/admin/users/"+userID+"/system-grants", nil, &grants)
+	actions := grants.Actions
+	has := false
+	for _, a := range actions {
+		has = has || a == "project.create"
+	}
+	if !has {
+		actions = append(actions, "project.create")
+	}
+	e.do(t, root, "PUT", "/api/admin/users/"+userID+"/system-grants", map[string]any{
+		"expectedAuthorityEpoch": grants.AuthorityEpoch,
+		"idempotencyKey":         "mi-alice-project-create",
+		"actions":                actions,
+	}, nil)
+}
+
 // bearerRT 为所有请求附加 Authorization: Bearer <key>。
 type bearerRT struct{ key string }