Risky behavior now covered

• Mobile pairing tickets: version, host, port, cert pin, SPKI, identity, nonce, and expiry checks, plus wire-format rejection (prefix, base32, UTF-8, unknown JSON fields, scheme case). A live nonce must match in full and must not be accepted after expiry.
• Bedrock container credentials: cleartext HTTP is limited to loopback, ECS 169.254.170.2, and EKS Pod Identity 169.254.170.23 / fd00:ec2::23. Metadata, private, and lookalike hosts are refused before a fetch. Credential JSON must be successful and complete.
• Bedrock routing: only official bedrock-runtime hosts yield to a configured region or profile. Lookalike hosts stay explicit. IMDS is advertised only behind an EC2 hint, and blank container URI env vars are not credential sources.

No production behavior changes.

Test files added/updated

• crates/cowork-server/src/mobile_h3/ticket.rs
• crates/cowork-providers/src/bedrock/auth.rs

Why these tests materially reduce regression risk

Pairing tickets are the trust boundary for a paired device, and the container-credential URI decides where AWS role credentials are fetched. Both paths previously locked little more than the happy path, so a loosened pin check, an extra ticket field, or a widened HTTP allowlist could ship without a failing test. These cases fail closed on the current rules.

Validation

• cargo test -p cowork-server --lib mobile_h3::ticket::tests — 4 passed
• cargo test -p cowork-providers --lib credential_boundary_tests — 4 passed
• cargo fmt -p cowork-server -p cowork-providers -- --check
• cargo clippy -p cowork-providers -p cowork-server --all-targets -- -D warnings