diff --git a/src/test/java/com/yunhai/flowcenter/oapi/OapiFlowTasksByBizTest.java b/src/test/java/com/yunhai/flowcenter/oapi/OapiFlowTasksByBizTest.java
index 8ad9bd5..013e340 100644
--- a/src/test/java/com/yunhai/flowcenter/oapi/OapiFlowTasksByBizTest.java
+++ b/src/test/java/com/yunhai/flowcenter/oapi/OapiFlowTasksByBizTest.java
@@ -62,6 +62,33 @@ class OapiFlowTasksByBizTest extends FlowTestSupport {
         public com.yunhai.flowcenter.stub.StubUserClient stubUserClient() {
             return new com.yunhai.flowcenter.stub.StubUserClient();
         }
+
+        /** F01：来源主体由验签上下文解析，本契约测试不覆盖该链，固定返回测试主体 */
+        @Bean
+        @Primary
+        public com.yunhai.flowcenter.service.FlowSourcePrincipalResolver stubSourcePrincipalResolver() {
+            com.yunhai.flowcenter.service.FlowSourcePrincipalResolver resolver =
+                    org.mockito.Mockito.mock(com.yunhai.flowcenter.service.FlowSourcePrincipalResolver.class);
+            org.mockito.Mockito.when(resolver.resolve(org.mockito.ArgumentMatchers.any()))
+                    .thenReturn(new com.yunhai.flowcenter.service.FlowSourcePrincipalResolver.Principal(
+                            "11111111-2222-3333-4444-555555555555", 100018, APP_KEY, "svc-hall"));
+            return resolver;
+        }
+
+        /** F01：使用许可在专用测试中覆盖，本契约测试放行并以同一主体回填 */
+        @Bean
+        @Primary
+        public com.yunhai.flowcenter.service.FlowUsageGrantGuard stubUsageGrantGuard() {
+            com.yunhai.flowcenter.service.FlowUsageGrantGuard guard =
+                    org.mockito.Mockito.mock(com.yunhai.flowcenter.service.FlowUsageGrantGuard.class);
+            org.mockito.Mockito.when(guard.requireNewApplyGrant(
+                            org.mockito.ArgumentMatchers.anyLong(),
+                            org.mockito.ArgumentMatchers.any(),
+                            org.mockito.ArgumentMatchers.any(
+                                    com.yunhai.flowcenter.service.FlowSourcePrincipalResolver.Principal.class)))
+                    .thenReturn(100018);
+            return guard;
+        }
     }
 
     @BeforeEach
diff --git a/src/test/java/com/yunhai/flowcenter/service/OapiFlowApplyDefVersionTest.java b/src/test/java/com/yunhai/flowcenter/service/OapiFlowApplyDefVersionTest.java
index 6e804ea..7416516 100644
--- a/src/test/java/com/yunhai/flowcenter/service/OapiFlowApplyDefVersionTest.java
+++ b/src/test/java/com/yunhai/flowcenter/service/OapiFlowApplyDefVersionTest.java
@@ -42,12 +42,14 @@ class OapiFlowApplyDefVersionTest {
 
     private static final Long SCH_ID = 1L;
     private static final String FLOW_GUID = "g-assign";
+    private static final String SOURCE_ID = "11111111-2222-3333-4444-555555555555";
 
     private FlwDefRepository defRepository;
     private FlowInstanceService instanceService;
     private AssigneeResolver assigneeResolver;
     private OapiFlowService service;
     private FlwInstanceRepository instances;
+    private OpenApiAppClient appClient;
 
     @BeforeEach
     @SuppressWarnings("unchecked")
@@ -56,12 +58,26 @@ class OapiFlowApplyDefVersionTest {
         instanceService = mock(FlowInstanceService.class);
         assigneeResolver = mock(AssigneeResolver.class);
         instances = mock(FlwInstanceRepository.class);
+        appClient = mock(OpenApiAppClient.class);
+        com.fasterxml.jackson.databind.node.ObjectNode registered =
+                new ObjectMapper().createObjectNode()
+                        .put("id", 100009)
+                        .put("appCode", "flow-center")
+                        .put("sourcePrincipalId", SOURCE_ID);
+        when(appClient.getAppByKey(any())).thenReturn(registered);
         service = new OapiFlowService(defRepository, instances,
                 mock(FlwTaskRepository.class), mock(FlwCcRepository.class),
                 mock(FlwCallbackRegRepository.class), instanceService, mock(FlowTaskService.class),
                 mock(FlowEngine.class), assigneeResolver, new ObjectMapper(),
-                mock(OpenApiUserClient.class), mock(OpenApiAppClient.class),
+                mock(OpenApiUserClient.class), appClient,
                 mock(DiagramTokenService.class), mock(ObjectProvider.class));
+        // F01：来源解析与使用许可在真实装配中由 Spring 注入，单测按同一契约显式装配
+        org.springframework.test.util.ReflectionTestUtils.setField(
+                service, "sourcePrincipalResolver", new FlowSourcePrincipalResolver(appClient));
+        FlowUsageGrantGuard guard = mock(FlowUsageGrantGuard.class);
+        when(guard.requireNewApplyGrant(anyLong(), any(),
+                any(FlowSourcePrincipalResolver.Principal.class))).thenReturn(100009);
+        service.setUsageGrantGuard(guard);
         // 本校校验在单测里关闭（@Value 字段未注入=默认 false），引擎出参给一个既有办件
         when(instanceService.apply(any(FlowInstanceService.ApplyCommand.class)))
                 .thenReturn(new FlowInstanceService.ApplyOutcome(500L, false));