security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

backend/app/miner_control/service.py

@@ -1,7 +1,6 @@
 """Business rules for typed, Agent-routed miner controls."""
 
-from typing import Any
-from uuid import UUID, uuid4
+from uuid import UUID
 
 from app.miner_control.exceptions import (
     ControlledMinerNotFound,
@@ -16,6 +15,7 @@ from app.miner_control.models import (
     MinerControlProjection,
 )
 from app.miner_control.repository import MinerControlRepository
+from app.agent_commands.policy import PHYSICAL_CONTROL_DISABLED
 
 
 KNOWN_MODES = {"low", "normal", "high"}
@@ -29,33 +29,8 @@ class MinerControlService:
 
     @staticmethod
     def _capability(context: dict) -> ControlCapability:
-        if not context.get("agent_zone_id"):
-            return ControlCapability(state="unavailable", reason="agent_zone_unassigned")
-        if context.get("agent_zone_exists") is not True:
-            return ControlCapability(state="unavailable", reason="agent_zone_missing")
-        if context.get("agent_zone_enabled") is not True:
-            return ControlCapability(state="unavailable", reason="agent_zone_disabled")
-        if not context.get("agent_id"):
-            return ControlCapability(state="unavailable", reason="agent_unavailable")
-        if not context.get("current_ip"):
-            return ControlCapability(state="unavailable", reason="current_ip_missing")
-        if context.get("api3_supported") is False:
-            return ControlCapability(state="unavailable", reason="api3_unsupported")
-        if context.get("api3_supported") is not True:
-            return ControlCapability(state="unknown", reason="api3_support_unknown")
-
-        payload = context.get("last_payload") or {}
-        if payload.get("control_available") is False:
-            reason = payload.get("control_unavailable_reason")
-            return ControlCapability(
-                state="unavailable",
-                reason=reason if reason == "credentials_missing" else "agent_unavailable",
-            )
-        if payload.get("control_available") is not True:
-            return ControlCapability(
-                state="unknown", reason="agent_capability_unknown"
-            )
-        return ControlCapability(state="supported")
+        # Credentials and Zone routing are not physical identity authorization.
+        return ControlCapability(state="unavailable", reason=PHYSICAL_CONTROL_DISABLED)
 
     @staticmethod
     def _operation(miner_id: UUID, row: dict) -> MinerControlOperation:
@@ -120,50 +95,4 @@ class MinerControlService:
     ) -> MinerControlAccepted:
         if not actor_user_id:
             raise MinerControlActorRequired("Authenticated actor UUID is required")
-        context = self.repository.get_control_context(miner_id)
-        if not context:
-            raise ControlledMinerNotFound("Miner not found")
-        capability = self._capability(context)
-        if capability.state != "supported":
-            raise MinerControlUnavailable(
-                capability.reason or "control_capability_not_supported"
-            )
-
-        runtime = str(context.get("runtime_state") or "").strip().lower()
-        if action == "suspend" and runtime not in RUNNING_STATES:
-            raise MinerControlUnavailable("miner_not_factually_running")
-        if action == "resume" and runtime not in STOPPED_STATES:
-            raise MinerControlUnavailable("miner_not_factually_stopped")
-        if action == "performance_mode" and requested_value not in KNOWN_MODES:
-            raise MinerControlUnavailable("invalid_performance_mode")
-
-        operation_id = str(uuid4())
-        payload: dict[str, Any] = {
-            "schema_version": 1,
-            "miner_id": str(miner_id),
-            "action": action,
-            "requested_value": requested_value,
-            "ip_address": context["current_ip"],
-        }
-        operation = self.repository.enqueue_with_audit(
-            operation_id=operation_id,
-            miner_id=miner_id,
-            agent_id=context["agent_id"],
-            actor_user_id=actor_user_id,
-            actor_username=actor_username,
-            request_payload=payload,
-            audit_payload={
-                "operation_id": operation_id,
-                "miner_id": str(miner_id),
-                "action": action,
-                "requested_value": requested_value,
-            },
-        )
-        return MinerControlAccepted(
-            operation_id=operation["operation_id"],
-            miner_id=miner_id,
-            action=action,
-            requested_value=requested_value,
-            status=operation["status"],
-            created_at=operation["created_at"],
-        )
+        raise MinerControlUnavailable(PHYSICAL_CONTROL_DISABLED)