diff --git a/scripts/src/cicd-delivery-authority.test.ts b/scripts/src/cicd-delivery-authority.test.ts
index 62ca14f3..262f91ae 100644
--- a/scripts/src/cicd-delivery-authority.test.ts
+++ b/scripts/src/cicd-delivery-authority.test.ts
@@ -51,9 +51,9 @@ const pacEvaluator = createRequire(import.meta.url)("../native/cicd/pac-status-e
 describe("YAML 组合的 CI/CD delivery authority", () => {
   test("组合 PaC 与 Gitea YAML，覆盖所有实际 consumer 且 id 唯一", () => {
     const catalog = readCicdDeliveryAuthorityCatalog();
-    expect(catalog.consumers).toHaveLength(8);
-    expect(new Set(catalog.consumers.map((item) => item.consumerId)).size).toBe(8);
-    for (const consumerId of ["agentrun-nc01-v02", "hwlab-nc01-v03", "sentinel-nc01-v03", "unidesk-host", "platform-infra-gitea-nc01"]) {
+    expect(catalog.consumers).toHaveLength(9);
+    expect(new Set(catalog.consumers.map((item) => item.consumerId)).size).toBe(9);
+    for (const consumerId of ["agentrun-nc01-v02", "hwlab-nc01-v03", "sentinel-nc01-v03", "unidesk-host", "platform-infra-gitea-nc01", "platform-infra-sub2rank-nc01"]) {
       const authority = resolveCicdDeliveryAuthority({ consumerId });
       expect(authority.kind).toBe("pac-pr-merge");
       expect(authority.mutationHintsAllowed).toBe(false);
diff --git a/scripts/src/platform-infra-pac-provenance.test.ts b/scripts/src/platform-infra-pac-provenance.test.ts
index e85d7ab4..872d49f0 100644
--- a/scripts/src/platform-infra-pac-provenance.test.ts
+++ b/scripts/src/platform-infra-pac-provenance.test.ts
@@ -59,7 +59,7 @@ test("versioned admission desired state protects controller proof, candidate ide
     toState: "started",
   }]);
   expect(contract.child.enabled).toBe(false);
-  expect(contract.consumers.map((item) => item.id)).toEqual(["agentrun-nc01-v02"]);
+  expect(contract.consumers.map((item) => item.id)).toEqual(["agentrun-nc01-v02", "platform-infra-sub2rank-nc01"]);
   const items = documents(renderPacAdmissionDesiredFragment("NC01"));
   expect(items.map((item) => item.kind)).toEqual(["ValidatingAdmissionPolicy", "ValidatingAdmissionPolicyBinding"]);
   const policy = items[0];
@@ -117,16 +117,20 @@ test("versioned admission desired state protects controller proof, candidate ide
   expect(queueGuard.expression).not.toContain('== "Cancelled"');
 });
 
-test("required consumer default RBAC has one automatic desired owner and no Tekton mutation verbs", () => {
+test("required consumers have one automatic desired owner per namespace and no Tekton mutation verbs", () => {
   const rbac = documents(renderPacConsumerRbacDesiredFragment("NC01"));
-  expect(rbac.map((item) => item.kind)).toEqual(["Role", "RoleBinding"]);
-  const role = rbac[0];
-  expect(role.metadata.annotations["argocd.argoproj.io/sync-wave"]).toBe("-1");
-  expect(role.metadata.annotations["unidesk.ai/effective-config-sha256"]).toBe(pacConsumerRbacDesiredIdentity("NC01").configSha256);
-  const verbs = role.rules.flatMap((rule: any) => rule.verbs);
-  for (const verb of ["create", "patch", "update", "delete", "deletecollection"]) expect(verbs).not.toContain(verb);
+  expect(rbac.map((item) => item.kind)).toEqual(["Role", "RoleBinding", "Role", "RoleBinding"]);
+  expect(rbac.map((item) => item.metadata.namespace)).toEqual(["agentrun-ci", "agentrun-ci", "devops-infra", "devops-infra"]);
+  for (const role of rbac.filter((item) => item.kind === "Role")) {
+    expect(role.metadata.annotations["argocd.argoproj.io/sync-wave"]).toBe("-1");
+    expect(role.metadata.annotations["unidesk.ai/effective-config-sha256"]).toBe(pacConsumerRbacDesiredIdentity("NC01").configSha256);
+    const verbs = role.rules.flatMap((rule: any) => rule.verbs);
+    for (const verb of ["create", "patch", "update", "delete", "deletecollection"]) expect(verbs).not.toContain(verb);
+  }
   const desiredKinds = documents(renderPlatformInfraGiteaDesiredFragments("NC01")).map((item) => item.kind);
   expect(desiredKinds).toEqual([
+    "Role",
+    "RoleBinding",
     "Role",
     "RoleBinding",
     "ValidatingAdmissionPolicy",
diff --git a/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts b/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts
index 7ffdca93..f5550b76 100644
--- a/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts
+++ b/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts
@@ -587,6 +587,7 @@ function embeddedPipelineRun(binding: PacSourceArtifactBinding, desiredSpec: Rec
       labels: pipelineRunLabels(binding, provenance.renderer === "sub2rank-platform-service" ? "sub2rank" : "agentrun"),
     },
     spec: {
+      timeouts: { pipeline: binding.repository.params.pipeline_timeout },
       pipelineSpec: desiredSpec,
       taskRunTemplate: taskRunTemplate(binding),
       params: pipelineRunParams(binding, desiredSpec),