security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

agents/windows/EnrichOneMiner.ps1

@@ -23,6 +23,24 @@ function Invoke-MinerCommandRaw {
         [int]$TimeoutMs = 2500
     )
 
+    # This transport accepts only the exact queries used by this enrichment script.
+    # Validate before creating a socket; callers cannot reinterpret a write as a read.
+    $readCommands = @("summary", "devs", "edevs", "stats", "pools", "devdetails",
+        "version", "get_version", "get_miner_info")
+    # PowerShell containment operators use culture comparisons, even with -c.
+    # Match ordinally and serialize the canonical literal; never trim/normalize.
+    $approvedCommand = $null
+    foreach ($candidate in $readCommands) {
+        if ([string]::Equals($candidate, $Command, [StringComparison]::Ordinal)) {
+            $approvedCommand = $candidate
+            break
+        }
+    }
+    if ($Port -ne 4028 -or $null -eq $approvedCommand) {
+        throw "unsupported_diagnostic_operation_stage_a"
+    }
+    $requestJson = @{ cmd = $approvedCommand } | ConvertTo-Json -Compress
+
     $client = $null
 
     try {
@@ -38,7 +56,7 @@ function Invoke-MinerCommandRaw {
         $client.SendTimeout = $TimeoutMs
 
         $stream = $client.GetStream()
-        $payload = [System.Text.Encoding]::ASCII.GetBytes("{`"cmd`":`"$Command`"}`n")
+        $payload = [System.Text.Encoding]::ASCII.GetBytes($requestJson + "`n")
         $stream.Write($payload, 0, $payload.Length)
 
         try {