feat(runtime-v2): Wave 4 — remove transitional paths, backend conformance, proof-carrying recovery, transport parity

- vz-l56: Replace boot_shared_vm/create_in_stack with sandbox-scoped ContainerRuntime trait methods
- vz-td9: Add 14 new RuntimeBackend trait methods with default stubs + conformance test suite (59 tests)
- vz-v2n.3: Add reconcile_audit_log table with proof-carrying recovery and fault-injection tests (498 tests)
- vz-axl: Add cross-transport parity tests (OpenAPI ↔ gRPC) and proto consistency validation (57 tests)

Closes: vz-l56, vz-td9, vz-v2n.3, vz-v2n.3.1, vz-v2n.3.2, vz-v2n.3.3, vz-v2n.2.3, vz-axl

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lightsofapollo

.beads/issues.jsonl

@@ -389,4 +389,171 @@ mod tests {
         let _ = NetworkSetupResponse {};
         let _ = NetworkTeardownResponse {};
     }
+
+    // ── Runtime V2 proto-contract consistency tests ──────────────
+
+    #[test]
+    fn runtime_v2_services_cover_all_entity_types() {
+        use crate::runtime_v2::*;
+
+        // Verify key request message types exist by constructing defaults.
+        let _ = CreateSandboxRequest::default();
+        let _ = OpenLeaseRequest::default();
+        let _ = CreateContainerRequest::default();
+        let _ = CreateExecutionRequest::default();
+        let _ = CreateCheckpointRequest::default();
+        let _ = StartBuildRequest::default();
+        let _ = ListEventsRequest::default();
+        let _ = GetCapabilitiesRequest::default();
+
+        // Verify response types.
+        let _ = SandboxResponse::default();
+        let _ = LeaseResponse::default();
+        let _ = ContainerResponse::default();
+        let _ = ExecutionResponse::default();
+        let _ = CheckpointResponse::default();
+        let _ = BuildResponse::default();
+        let _ = ListEventsResponse::default();
+        let _ = GetCapabilitiesResponse::default();
+
+        // Verify payload types used in responses.
+        let _ = SandboxPayload::default();
+        let _ = LeasePayload::default();
+        let _ = ContainerPayload::default();
+        let _ = ExecutionPayload::default();
+        let _ = CheckpointPayload::default();
+        let _ = BuildPayload::default();
+
+        // Verify list responses.
+        let _ = ListSandboxesResponse::default();
+        let _ = ListLeasesResponse::default();
+        let _ = ListContainersResponse::default();
+        let _ = ListExecutionsResponse::default();
+        let _ = ListCheckpointsResponse::default();
+        let _ = ListBuildsResponse::default();
+
+        // Verify streaming types.
+        let _ = ExecOutputEvent::default();
+        let _ = BuildEvent::default();
+        let _ = RuntimeEvent::default();
+    }
+
+    #[test]
+    fn runtime_v2_request_metadata_fields() {
+        use crate::runtime_v2::RequestMetadata;
+        let meta = RequestMetadata {
+            request_id: "req-123".into(),
+            idempotency_key: "idem-456".into(),
+            trace_id: "trace-789".into(),
+        };
+        assert_eq!(meta.request_id, "req-123");
+        assert_eq!(meta.idempotency_key, "idem-456");
+        assert_eq!(meta.trace_id, "trace-789");
+    }
+
+    #[test]
+    fn runtime_v2_error_detail_fields() {
+        use crate::runtime_v2::ErrorDetail;
+        let err = ErrorDetail {
+            code: "not_found".into(),
+            message: "sandbox not found".into(),
+            request_id: "req-abc".into(),
+        };
+        assert_eq!(err.code, "not_found");
+        assert_eq!(err.message, "sandbox not found");
+        assert_eq!(err.request_id, "req-abc");
+    }
+
+    #[test]
+    fn runtime_v2_all_rpc_request_types_have_metadata() {
+        use crate::runtime_v2::*;
+
+        // Every mutation/query request should have an optional metadata field.
+        // Constructing defaults ensures the field exists (it will be None).
+        let create_sandbox = CreateSandboxRequest::default();
+        assert!(create_sandbox.metadata.is_none());
+
+        let open_lease = OpenLeaseRequest::default();
+        assert!(open_lease.metadata.is_none());
+
+        let create_container = CreateContainerRequest::default();
+        assert!(create_container.metadata.is_none());
+
+        let create_execution = CreateExecutionRequest::default();
+        assert!(create_execution.metadata.is_none());
+
+        let create_checkpoint = CreateCheckpointRequest::default();
+        assert!(create_checkpoint.metadata.is_none());
+
+        let start_build = StartBuildRequest::default();
+        assert!(start_build.metadata.is_none());
+
+        let list_events = ListEventsRequest::default();
+        assert!(list_events.metadata.is_none());
+
+        let get_caps = GetCapabilitiesRequest::default();
+        assert!(get_caps.metadata.is_none());
+
+        // GET/single-entity requests.
+        let get_sandbox = GetSandboxRequest::default();
+        assert!(get_sandbox.metadata.is_none());
+
+        let get_lease = GetLeaseRequest::default();
+        assert!(get_lease.metadata.is_none());
+
+        let get_container = GetContainerRequest::default();
+        assert!(get_container.metadata.is_none());
+
+        let get_execution = GetExecutionRequest::default();
+        assert!(get_execution.metadata.is_none());
+
+        let get_checkpoint = GetCheckpointRequest::default();
+        assert!(get_checkpoint.metadata.is_none());
+
+        let get_build = GetBuildRequest::default();
+        assert!(get_build.metadata.is_none());
+    }
+
+    #[test]
+    fn runtime_v2_sandbox_payload_round_trip() {
+        use crate::runtime_v2::SandboxPayload;
+        let payload = SandboxPayload {
+            sandbox_id: "sbx-test".into(),
+            backend: "macos_vz".into(),
+            state: "ready".into(),
+            cpus: 4,
+            memory_mb: 2048,
+            created_at: 1700000000,
+            updated_at: 1700000100,
+            labels: [("env".to_string(), "staging".to_string())]
+                .into_iter()
+                .collect(),
+        };
+        let encoded = payload.encode_to_vec();
+        let decoded = SandboxPayload::decode(encoded.as_slice()).unwrap();
+        assert_eq!(decoded.sandbox_id, "sbx-test");
+        assert_eq!(decoded.backend, "macos_vz");
+        assert_eq!(decoded.cpus, 4);
+        assert_eq!(decoded.memory_mb, 2048);
+        assert_eq!(decoded.labels.get("env").unwrap(), "staging");
+    }
+
+    #[test]
+    fn runtime_v2_checkpoint_payload_round_trip() {
+        use crate::runtime_v2::CheckpointPayload;
+        let payload = CheckpointPayload {
+            checkpoint_id: "ckpt-test".into(),
+            sandbox_id: "sbx-test".into(),
+            parent_checkpoint_id: "ckpt-parent".into(),
+            checkpoint_class: "fs_quick".into(),
+            state: "ready".into(),
+            compatibility_fingerprint: "kernel-6.1-arm64".into(),
+            created_at: 1700000000,
+        };
+        let encoded = payload.encode_to_vec();
+        let decoded = CheckpointPayload::decode(encoded.as_slice()).unwrap();
+        assert_eq!(decoded.checkpoint_id, "ckpt-test");
+        assert_eq!(decoded.compatibility_fingerprint, "kernel-6.1-arm64");
+        assert_eq!(decoded.parent_checkpoint_id, "ckpt-parent");
+    }
 }