Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/bosh-director/lib/clouds/external_cpi_response_wrapper.rb`:
- Around line 38-50: Reject CPI API v1 in the wrapper because `create_vm` and
`attach_disk` now assume v2-style responses and no longer adapt v1 behavior.
Update `check_cpi_api_support` (and any related version gating in
`ExternalCpiResponseWrapper`) so versions below 2 are treated as unsupported, or
otherwise restore the v1 response handling in `create_vm` and `attach_disk` to
match the director/CPI contract.
- Around line 47-50: Remove the redundant attach_disk delegator from
ExternalCpiResponseWrapper so the class only keeps the generic attach_disk
method already defined earlier; this duplicate definition is what triggers
Lint/DuplicateMethods. Update the attach_disk handling in
ExternalCpiResponseWrapper by deleting the stale method body that wraps
`@cpi.attach_disk` and returns cpi_response, and keep the single shared
implementation used for other CPI response wrappers.

In
`@src/bosh-director/spec/unit/bosh/director/deployment_plan/stages/update_stage_functional_spec.rb`:
- Line 74: The functional spec for UpdateStage is now using CPI API v2, but the
wrapper stub in the affected examples still returns the old single-value
create_vm result, so it no longer validates the v2 response shape. Update the
stubs in the UpdateStage spec to return the v2 create_vm tuple from the wrapper
double, and make sure the expectations in the examples that cover network
settings still exercise the returned value through the relevant helper methods
in UpdateStage.

In
`@src/bosh-director/spec/unit/bosh/director/deployment_plan/steps/create_vm_step_spec.rb`:
- Line 15: The create VM specs are still using the old 3-item wrapper shape even
though these contexts opt into CPI API v2. Update the `create_vm_response` in
`create_vm_step_spec` and the deep-copy example responses to use the v2 two-item
`create_vm` response shape, and make sure the examples tied to `CreateVmStep`
and `cpi_api_version` reflect the new API contract consistently.

In `@src/tasks/spec.rake`:
- Around line 88-90: The multitask prerequisites are duplicating the repo-root
unit suite because `spec:unit:release` and `spec:unit:integration_support` both
resolve to the same `rspec`/`parallel_rspec` execution path. Update the
`parallel` task in `spec.rake` so it references a distinct `integration_support`
task chain instead of reusing `spec:unit:release:parallel`, and make the
corresponding adjustment in the related
`spec:unit:release`/`spec:unit:integration_support` task definitions to ensure
each prerequisite runs a different suite.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/bosh-director/spec/unit/bosh/director/deployment_plan/stages/package_compile_stage_spec.rb`:
- Line 145: The package compile stage spec is still exercising the CPI v1 path
because only Config.preferred_cpi_api_version is changed and cloud.info remains
unstubbed. Update the setup around CloudFactory in package_compile_stage_spec to
stub cloud.info with a v2-compatible response so the factory actually selects
API version 2, and then adjust the create_vm expectations/stubs to use the v2
contract rather than the bare-CID v1 form.

In `@src/spec/integration_support/bin/dummy_cpi`:
- Line 66: The dummy CPI launcher now always instantiates DummyV2, which ignores
any configured API version and can silently run tests against the wrong
contract. Update the bin/dummy_cpi entrypoint to either route non-2 versions
through the existing version-specific CPI selection logic or explicitly fail
fast when the requested API version is not 2; use the version value from the
generated cpi_config/context path so IntegrationSupport::Sandbox overrides are
enforced consistently.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/spec/integration_support/dummy_cpi.rb`:
- Around line 381-384: Version sorting in the stemcell collection is effectively
doing nothing because the hashes built in `dummy_cpi.rb` use string keys from
YAML, while the final `sort` block in `latest_stemcell` reads `a[:version]` and
`b[:version]`. Update the sort logic to use the actual version key on those
result hashes (or normalize keys before sorting) so the list is ordered
numerically by version rather than by filesystem order. Refer to the
`latest_stemcell` collection pipeline and its final `sort` call when making the
change.
- Around line 141-150: The delete_vm flow in DummyCPI currently derives
agent_pid with vm_cid.to_i, which can turn malformed CIDs into 0 and
accidentally signal the current process group. Update delete_vm to resolve the
VM via `@vm_repo` first, and only call Process.kill in DummyCPI::delete_vm when a
matching record exists and its PID is valid. Keep the existing validation and
rescue behavior, but add a guard so invalid or missing VM CIDs never reach the
kill path.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/spec/integration_support/dummy_cpi.rb`:
- Line 390: The version sort in `latest_stemcell` inside `dummy_cpi.rb` is using
`to_i`, which collapses dotted versions like `1.9` and `1.10` to the same key.
Update the sorting logic to compare the full version string in a way that
preserves dotted semver-style ordering, so `latest_stemcell` no longer depends
on directory order. Use the existing `latest_stemcell`/`sort` path as the place
to adjust the version comparison.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/spec/integration_support/dummy_cpi.rb`:
- Around line 623-637: The delete-vm wait helpers in DummyCpi spin indefinitely
and need a bounded wait. Update wait_for_delete_vms and
wait_for_unpause_delete_vms to use a timeout when polling the marker files, and
raise or fail with a clear message if the expected file state never changes.
Keep the behavior tied to the existing `@cpi_commands` path markers and the
`@logger` debug calls so the timeout is enforced in both the pause and unpause
flows.
- Around line 358-363: The cleanup helper in kill_process still converts the PID
with agent_pid.to_i, so invalid VM identifiers can become 0 and be signaled
during Sandbox#stop and Sandbox#do_reset. Update kill_process in dummy_cpi to
validate the PID before calling Process.kill, and skip or safely ignore any
non-numeric/zero value so cleanup never signals PID 0 or the current process
group.

In `@src/tasks/spec.rake`:
- Around line 88-94: The unit-test aggregators are scheduling the
integration_support suite twice because `component_dir_names` already yields the
`spec:unit:src` task, which runs the `src/spec` tree including
`spec/integration_support/spec/`. Update the `multitask parallel` and `task
unit` definitions in `spec.rake` to remove the explicit
`spec:unit:integration_support` prerequisite and rely on the component-derived
tasks instead, keeping `spec:unit:release` as the only explicit prerequisite
there.

---

Duplicate comments:
In
`@src/bosh-director/spec/unit/bosh/director/deployment_plan/steps/create_vm_step_spec.rb`:
- Line 25: Finish the v2 create_vm tuple migration in create_vm_step_spec by
replacing the remaining legacy 3-item create_vm_response shapes with the 2-item
v2 form used elsewhere in the file. Update the affected examples in the
CreateVmStep spec so they all return the same [cid, result] tuple shape,
removing any wrapper-style response expectations that still reference the old
contract.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/bosh-director/lib/bosh/director/cloud_factory.rb`:
- Around line 61-63: The cloud version detection in CloudFactory is treating
missing or failing cloud.info responses as api_version 2, which can incorrectly
route legacy or broken CPIs into v2-only paths. Update the version parsing logic
around the info_response fetch/rescue in CloudFactory to fail closed instead of
defaulting to 2 when api_version is absent or an error occurs. Keep the existing
wrapper guard behavior intact so unknown CPI versions do not get silently
upgraded, and ensure callers like create_vm cannot proceed with a spoofed v2
version.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/bosh-director/spec/unit/bosh/director/deployment_plan/steps/create_vm_step_spec.rb`:
- Line 195: The `CreateVmStep` specs are stubbing `cloud_wrapper.create_vm` with
empty or fake CID values, so they no longer validate the persisted VM CID
contract. Update the affected `create_vm` stubs in `create_vm_step_spec.rb` to
return a real non-empty VM CID string instead of `''` or `env_id`, and keep the
existing return shape so the examples still exercise `CreateVmStep`’s use of
`create_vm_obj[0]`.