security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

agents/windows/MinerOpsApi3EnrichmentPoller.ps1

@@ -30,11 +30,57 @@ function Invoke-WhatsMinerApi3Read {
         [int] $TimeoutMs = 2500
     )
 
+    # Exact operation and parameter allowlist at the shared transport boundary.
+    # No extra keys (including credentials, command aliases, or parameter overrides)
+    # reach the wire, even when this function is called outside the poller loop.
+    $readCommands = @("get.device.info", "get.miner.setting", "get.miner.status",
+        "get.fan.setting", "get.device.custom_data")
+    $command = $Request["cmd"]
+    $approvedCommand = $null
+    if ($command -is [string]) {
+        foreach ($candidate in $readCommands) {
+            if ([string]::Equals($candidate, $command, [StringComparison]::Ordinal)) {
+                $approvedCommand = $candidate
+                break
+            }
+        }
+    }
+    if ($null -eq $approvedCommand) {
+        throw "unsupported_diagnostic_operation_stage_a"
+    }
+    $expectedKeys = @("cmd")
+    $wireRequest = [ordered]@{ cmd = $approvedCommand }
+    if ([string]::Equals($approvedCommand, "get.miner.status", [StringComparison]::Ordinal)) {
+        $expectedKeys += "param"
+        if ($Request["param"] -isnot [string] -or
+            -not [string]::Equals($Request["param"], "summary+pools+edevs", [StringComparison]::Ordinal)) {
+            throw "unsupported_diagnostic_operation_stage_a"
+        }
+        $wireRequest["param"] = "summary+pools+edevs"
+    }
+    if ($Request.Count -ne $expectedKeys.Count) {
+        throw "unsupported_diagnostic_operation_stage_a"
+    }
+    foreach ($key in $Request.Keys) {
+        $approvedKey = $false
+        if ($key -is [string]) {
+            foreach ($expectedKey in $expectedKeys) {
+                if ([string]::Equals($expectedKey, $key, [StringComparison]::Ordinal)) {
+                    $approvedKey = $true
+                    break
+                }
+            }
+        }
+        if (-not $approvedKey) {
+            throw "unsupported_diagnostic_operation_stage_a"
+        }
+    }
+
     $client = $null
     $stream = $null
 
     try {
-        $json = ($Request | ConvertTo-Json -Depth 20 -Compress)
+        $json = ($wireRequest | ConvertTo-Json -Depth 20 -Compress)
         $payload = [System.Text.Encoding]::ASCII.GetBytes($json)
         $length = [BitConverter]::GetBytes([Int32]$payload.Length)