From e1869835772d8d04e97eb1355abdae72230564d3 Mon Sep 17 00:00:00 2001
From: agent-exec-transport <agent-exec-transport@localhost.invalid>
Date: Sun, 18 Oct 2026 15:08:53 +0000
Subject: [PATCH] agent-exec transport
 45fa6a1e5d496e8adf604119c65951e6/ba2407d4714c

---
 .../multi-instance/multi_instance_test.go     | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/tests/integration/multi-instance/multi_instance_test.go b/tests/integration/multi-instance/multi_instance_test.go
index efff349c..800d1ced 100644
--- a/tests/integration/multi-instance/multi_instance_test.go
+++ b/tests/integration/multi-instance/multi_instance_test.go
@@ -41,6 +41,7 @@ import (
 const (
 	aliceOwner = "mi_alice"
 	alicePass  = "mi-alice-pass-1"
+	rootPass   = "mi-root-pass-1"
 	httpWait   = 15 * time.Second
 )
 
@@ -455,7 +456,7 @@ func (e *env) killNine(t *testing.T, inst *instance) {
 func (e *env) loginAlice(t *testing.T) *userClient {
 	t.Helper()
 	// 空库先引导首个管理员（本地 pending 创建要求库内已有用户），再建 alice。
-	// 两步都签发一次性凭据，独占落临时 JSON 后即弃。
+	// 两步都签发一次性凭据，独占落临时 JSON；mi-root 的凭据随后用于初始化其账号。
 	rootCred := filepath.Join(t.TempDir(), "root-cred.json")
 	e.cliIn(t, e.a.dataDir, "user", "bootstrap-admin", "--dsn", e.dbDSN, "--owner", "mi-root", "--out-file", rootCred)
 	activation := filepath.Join(t.TempDir(), "activation.json")
@@ -476,7 +477,7 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 
 	apiKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "mi-acceptance")
 	// IAM U4 把建项目改为系统动作 project.create：由引导管理员经真实 API 授予 alice。
-	e.grantAliceProjectCreate(t)
+	e.grantAliceProjectCreate(t, rootCred)
 	uc := &userClient{
 		api:     &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
 		apiB:    &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
@@ -490,8 +491,23 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 
 // grantAliceProjectCreate 以 mi-root 身份经 admin API 为 alice 追加系统授权
 // project.create（保留其已有授权；PUT 为整体替换，按 authorityEpoch 乐观并发）。
-func (e *env) grantAliceProjectCreate(t *testing.T) {
+// bootstrap-admin 只签发一次性凭据，mi-root 未初始化前不能发 API key，故先照
+// alice 的方式 redeem 并设 rootPass。
+func (e *env) grantAliceProjectCreate(t *testing.T, rootCred string) {
 	t.Helper()
+	rootSecret := activationSecret(t, rootCred)
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sess := &http.Client{Timeout: httpWait, Jar: jar}
+	e.do(t, sess, "POST", "/api/auth/login-key/redeem", map[string]any{
+		"key": rootSecret,
+	}, nil)
+	e.do(t, sess, "POST", "/api/auth/password", map[string]any{
+		"next": rootPass,
+	}, nil)
+
 	rootKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", "mi-root", "--name", "mi-acceptance-root")
 	root := &http.Client{Timeout: httpWait, Transport: bearerRT{key: rootKey}}
 	var users []struct {