Add TLS env wiring for LLM HTTPS transport (CA bundle + mTLS)

Author: johnteee

docs/acceptance.md

@@ -513,6 +513,7 @@ track p50/p95 latency across eval suites and detect regressions.*
 | `test_ultrawork_notify.py` | Webhook delivery, shell command, failure silence |
 | `test_eval_report.py` | HTML rendering, case names, pass/fail, judge scores |
 | `test_benchmark.py` | p50/p95/mean latency, regression detection, serialisation |
+| `test_llm_transport.py` | TLS env wiring: CA bundle + client cert passed into LLM HTTPS transport |
 
 ---
 
@@ -522,5 +523,4 @@ The following stories remain unimplemented.
 
 | ID | Story | Priority |
 |---|---|---|
-| AC-NEW-16 | HTTPS_PROXY / CA bundle / mTLS "just works" | P2 |
 | AC-NEW-20 | Local model (Ollama/vLLM) with full governance | P2 |

teaagent/llm/_adapters.py

@@ -13,7 +13,7 @@
     _first_choice_delta,
 )
 from teaagent.llm._retry import DEFAULT_RETRY_CONFIG, LLMRetryConfig, _call_with_retry
-from teaagent.llm._transport import UrllibHTTPTransport
+from teaagent.llm._transport import UrllibHTTPTransport, build_ssl_context_from_env
 from teaagent.llm._types import (
     HTTPTransport,
     LLMHTTPError,
@@ -205,7 +205,11 @@ def _complete_streaming(
             }
             req = urllib_request.Request(url, data=body, headers=headers, method='POST')
             try:
-                with urllib_request.urlopen(req, timeout=self.timeout) as resp:
+                ssl_context = build_ssl_context_from_env()
+                request_kwargs: dict[str, Any] = {'timeout': self.timeout}
+                if ssl_context is not None:
+                    request_kwargs['context'] = ssl_context
+                with urllib_request.urlopen(req, **request_kwargs) as resp:
                     lines = list(resp)
             except HTTPError as exc:
                 detail = exc.read().decode('utf-8', errors='replace')

teaagent/llm/_transport.py

@@ -1,13 +1,32 @@
 from __future__ import annotations
 
 import json
+import os
+import ssl
 from typing import Any
 from urllib import request as urllib_request
 from urllib.error import HTTPError, URLError
 
 from teaagent.llm._types import LLMHTTPError
 
 
+def build_ssl_context_from_env() -> ssl.SSLContext | None:
+    ca_bundle = os.environ.get('REQUESTS_CA_BUNDLE') or os.environ.get('SSL_CERT_FILE')
+    client_cert = os.environ.get('TEAAGENT_TLS_CLIENT_CERT')
+    client_key = os.environ.get('TEAAGENT_TLS_CLIENT_KEY')
+    if not ca_bundle and not client_cert:
+        return None
+    context = ssl.create_default_context()
+    if ca_bundle:
+        context.load_verify_locations(cafile=ca_bundle)
+    if client_cert:
+        if client_key:
+            context.load_cert_chain(certfile=client_cert, keyfile=client_key)
+        else:
+            context.load_cert_chain(certfile=client_cert)
+    return context
+
+
 class UrllibHTTPTransport:
     def post_json(
         self,
@@ -29,7 +48,11 @@ def post_json(
             method='POST',
         )
         try:
-            with urllib_request.urlopen(req, timeout=timeout) as response:
+            ssl_context = build_ssl_context_from_env()
+            request_kwargs: dict[str, Any] = {'timeout': timeout}
+            if ssl_context is not None:
+                request_kwargs['context'] = ssl_context
+            with urllib_request.urlopen(req, **request_kwargs) as response:
                 return json.loads(response.read().decode('utf-8'))
         except HTTPError as exc:
             detail = exc.read().decode('utf-8', errors='replace')

tests/test_llm_transport.py

@@ -0,0 +1,96 @@
+from __future__ import annotations
+
+import json
+import os
+import unittest
+from unittest.mock import MagicMock, patch
+
+from teaagent.llm._transport import UrllibHTTPTransport, build_ssl_context_from_env
+
+
+class _FakeHTTPResponse:
+    def __init__(self, payload: dict[str, object]) -> None:
+        self._payload = payload
+
+    def __enter__(self) -> '_FakeHTTPResponse':
+        return self
+
+    def __exit__(self, exc_type, exc, tb) -> None:
+        return None
+
+    def read(self) -> bytes:
+        return json.dumps(self._payload).encode('utf-8')
+
+
+class LLMTransportTests(unittest.TestCase):
+    def test_build_ssl_context_returns_none_without_tls_env(self) -> None:
+        with patch.dict(os.environ, {}, clear=True):
+            self.assertIsNone(build_ssl_context_from_env())
+
+    def test_build_ssl_context_loads_ca_bundle_from_requests_env(self) -> None:
+        context = MagicMock()
+        with (
+            patch.dict(os.environ, {'REQUESTS_CA_BUNDLE': '/tmp/ca.pem'}, clear=True),
+            patch(
+                'teaagent.llm._transport.ssl.create_default_context',
+                return_value=context,
+            ),
+        ):
+            result = build_ssl_context_from_env()
+
+        self.assertIs(result, context)
+        context.load_verify_locations.assert_called_once_with(cafile='/tmp/ca.pem')
+
+    def test_build_ssl_context_loads_client_cert_and_key(self) -> None:
+        context = MagicMock()
+        with (
+            patch.dict(
+                os.environ,
+                {
+                    'TEAAGENT_TLS_CLIENT_CERT': '/tmp/client.crt',
+                    'TEAAGENT_TLS_CLIENT_KEY': '/tmp/client.key',
+                },
+                clear=True,
+            ),
+            patch(
+                'teaagent.llm._transport.ssl.create_default_context',
+                return_value=context,
+            ),
+        ):
+            result = build_ssl_context_from_env()
+
+        self.assertIs(result, context)
+        context.load_cert_chain.assert_called_once_with(
+            certfile='/tmp/client.crt', keyfile='/tmp/client.key'
+        )
+
+    def test_transport_post_json_passes_ssl_context_when_tls_env_set(self) -> None:
+        context = MagicMock()
+        transport = UrllibHTTPTransport()
+
+        with (
+            patch.dict(os.environ, {'REQUESTS_CA_BUNDLE': '/tmp/ca.pem'}, clear=True),
+            patch(
+                'teaagent.llm._transport.ssl.create_default_context',
+                return_value=context,
+            ),
+            patch(
+                'teaagent.llm._transport.urllib_request.urlopen',
+                return_value=_FakeHTTPResponse({'ok': True}),
+            ) as mock_urlopen,
+        ):
+            result = transport.post_json(
+                'https://example.com/v1',
+                {'authorization': 'Bearer x'},
+                {'hello': 'world'},
+                timeout=5,
+            )
+
+        self.assertEqual(result, {'ok': True})
+        _, kwargs = mock_urlopen.call_args
+        self.assertEqual(kwargs['timeout'], 5)
+        self.assertIs(kwargs['context'], context)
+
+
+if __name__ == '__main__':
+    unittest.main()