feat(llm): add bounded Anthropic Messages transport

Cargo.toml

@@ -52,6 +52,7 @@ gfa-store = { version = "0.1.0", path = "crates/adapters/gfa-store" }
 gfa-server = { version = "0.1.0", path = "crates/apps/gfa-server" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+reqwest = { version = "0.13.5", default-features = false, features = ["rustls"] }
 schemars = "0.8.22"
 thiserror = "2"
 jsonschema = { version = "0.29", default-features = false }

THIRD_PARTY_LICENSES

@@ -10,3 +10,71 @@ shakmaty 0.30.1
 
 Cargo.lock pins Rust dependencies. cargo deny checks all transitive Rust licenses
 and advisories in CI; deny.toml lists the accepted licenses.
+
+webpki-root-certs 1.0.9
+  Source: https://github.com/rustls/webpki-roots
+  License: CDLA-Permissive-2.0
+  Purpose: Mozilla root-certificate data used by rustls-platform-verifier.
+  Include the agreement below when distributing the certificate data.
+
+# Community Data License Agreement - Permissive - Version 2.0
+
+This is the Community Data License Agreement - Permissive, Version
+2.0 (the "agreement"). Data Provider(s) and Data Recipient(s) agree
+as follows:
+
+## 1. Provision of the Data
+
+1.1. A Data Recipient may use, modify, and share the Data made
+available by Data Provider(s) under this agreement if that Data
+Recipient follows the terms of this agreement.
+
+1.2. This agreement does not impose any restriction on a Data
+Recipient's use, modification, or sharing of any portions of the
+Data that are in the public domain or that may be used, modified,
+or shared under any other legal exception or limitation.
+
+## 2. Conditions for Sharing Data
+
+2.1. A Data Recipient may share Data, with or without modifications, so
+long as the Data Recipient makes available the text of this agreement
+with the shared Data.
+
+## 3. No Restrictions on Results
+
+3.1. This agreement does not impose any restriction or obligations
+with respect to the use, modification, or sharing of Results.
+
+## 4. No Warranty; Limitation of Liability
+
+4.1. All Data Recipients receive the Data subject to the following
+terms:
+
+THE DATA IS PROVIDED ON AN "AS IS" BASIS, WITHOUT REPRESENTATIONS,
+WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED
+INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+NO DATA PROVIDER SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING
+WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE DATA OR RESULTS,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+## 5. Definitions
+
+5.1. "Data" means the material received by a Data Recipient under
+this agreement.
+
+5.2. "Data Provider" means any person who is the source of Data
+provided under this agreement and in reliance on a Data Recipient's
+agreement to its terms.
+
+5.3. "Data Recipient" means any person who receives Data directly
+or indirectly from a Data Provider and agrees to the terms of this
+agreement.
+
+5.4. "Results" means any outcome obtained by computational analysis
+of Data, including for example machine learning models and models'
+insights.

crates/players/gfa-llm/Cargo.toml

@@ -9,6 +9,12 @@ serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
 thiserror.workspace = true
+reqwest.workspace = true
+
+[dev-dependencies]
+axum.workspace = true
+tokio.workspace = true
+futures-util.workspace = true
 
 [lints]
 workspace = true

crates/players/gfa-llm/README.md

@@ -1,13 +1,21 @@
 # LLM players
 
-Provider-neutral configuration and accounting for built-in models, including user-hosted models. The host selects a provider and holds its credentials. The serialized player settings, requests, and responses have no credential field.
+Provider-neutral configuration and accounting for built-in models, plus an Anthropic Messages HTTP transport. Other providers, including user-hosted models, can implement the same trait. The host selects a provider and holds its credentials. The serialized player settings, requests, and responses have no credential field.
 
 A player identity hashes its complete settings and allowed assists, so different model versions, play modes, effort, prompts, or resource limits do not share a rating accidentally. Defaults follow the PRD's Anthropic example; setting `provider` and `model` supports an external model without changing the game engine.
 
 Messages preserve opaque content blocks so provider thinking signatures and tool transcripts can be replayed unchanged. Refusal and output limits are completion outcomes that the move loop must handle as failed attempts.
 
 Usage separates uncached input, output, cache reads, and the two cache write lifetimes. Pricing is an explicit versioned host record with integer micro-USD rates per million tokens. Arithmetic rejects overflow and rounds cost upward. Budget checks are pure arithmetic: the host must reserve and settle them transactionally for matches, runs, and API keys before network calls.
 
-This crate currently defines the contract; provider transports, durable reservations, and move-loop integration are separate units. It makes no API calls and does not enable a model by itself.
+`AnthropicProvider::new(api_key)` creates a client for the fixed HTTPS Messages endpoint. The key remains in a sensitive header and is excluded from debug output, serializable configuration, and sanitized errors. Constructing a client makes no API calls. Calling `LlmProvider::complete` sends one request; the host must reserve budget first. Durable reservations and match move-loop integration are separate units, so adding this crate alone does not enable an opponent.
 
-Dependencies reuse the workspace's serde/serde_json, SHA-256, and thiserror: serialization, stable agent fingerprints, and typed credential-free errors. No game implementation or transport adapter is imported.
+The transport sends explicit effort and defaults to adaptive thinking with a returned summary. Models without these capabilities can use `thinking: "disabled"` or `context_editing: false`; both settings contribute to agent identity. Unsupported model/settings combinations are returned as configuration errors, with no silent fallback. Direct mode uses the action/reasoning JSON schema. Tools mode uses strict tool definitions, automatic tool choice, and server-side clearing of older tool results. The immutable system briefing has a five-minute prompt-cache breakpoint; tool definitions precede it. The local history and opaque thinking signatures remain unchanged.
+
+Requests and responses are capped at 4 MiB. The configured timeout covers the network request and response body. Redirects, ambient proxies, and automatic retries are disabled. A cancellation, timeout, or malformed response can leave provider billing unknown; hosts must retain the pending reservation conservatively and reconcile it, rather than treating the call as free. Refusal, output exhaustion, and other provider stop reasons remain ordinary completions with usage. The game loop decides whether they yield a valid action.
+
+Unit and loopback HTTP tests cover both wire formats, signed history, cache accounting, response limits, timeout/cancellation, redirection, sanitized errors, and the absence of hidden retries. They use test credentials and make no paid provider calls. Live model compatibility requires a separately configured integration run.
+
+Protocol references: [thinking](https://platform.claude.com/docs/en/build-with-claude/thinking), [structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs), [prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching), and [context editing](https://platform.claude.com/docs/en/build-with-claude/context-editing).
+
+Dependencies reuse serde/serde_json, SHA-256, and thiserror for serialization, stable agent fingerprints, and typed errors. Reqwest with Rustls supplies asynchronous HTTPS without a system OpenSSL dependency; Axum, Tokio, and futures-util are test-only dependencies for loopback fixtures. No game implementation or application transport adapter is imported.