feat: add Qwen Cloud hackathon proof bundle

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Poly186-AI-DAO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

hackathon/README.md

@@ -0,0 +1,39 @@
+# Qwen Cloud Global AI Hackathon Proof Bundle
+
+## Project
+**Poly Autopilot Workforce for Qwen Cloud**, Autopilot Agent track.
+
+Poly is a governed digital workforce pattern for real business operations. A Qwen-backed planner turns an operator objective into tasks, routes work to specialized workers and tools, verifies source evidence, persists a receipt, and holds external sends or spend behind human approval.
+
+This directory is a bounded proof bundle. It does not claim a live Qwen deployment without credentials. The integration seam is executable when `QWEN_API_KEY` and `QWEN_BASE_URL` are supplied by the operator.
+
+## Evidence map
+
+- [`qwen_integration.py`](qwen_integration.py): OpenAI-compatible Qwen Cloud adapter. Fails closed when credentials are absent.
+- [`deployment_proof.md`](deployment_proof.md): placeholder-safe live deployment receipt template. It remains explicitly unverified until a real provider response exists.
+- [`architecture.svg`](architecture.svg): rendered architecture diagram.
+- [`demo_script.md`](demo_script.md): three-minute recording plan.
+- [`../LICENSE`](../LICENSE): MIT license for the repository.
+
+## Run the integration proof
+
+```bash
+export QWEN_API_KEY='your-key-from-a-secret-store'
+export QWEN_BASE_URL='https://your-qwen-compatible-endpoint/v1'
+export QWEN_MODEL='qwen-plus'  # optional
+python hackathon/qwen_integration.py
+```
+
+Do not commit credentials. A live run requires a valid Qwen Cloud endpoint, API key, network access, and the OpenAI-compatible Python client. No such credentials are included in this repository.
+
+## Architecture and claims boundary
+
+The demo is designed to show: planning, tool routing, source grounding, durable artifact creation, verification, and a human checkpoint before external action. It does not claim that this repository alone contains Poly's production runtime, CRM, or cloud deployment. Those are described as integration targets in the submission packet and must be demonstrated with separate, verifiable links before Devpost submission.
+
+## Local validation
+
+```bash
+python -m py_compile hackathon/qwen_integration.py
+```
+
+Expected behavior without credentials is a clear `QwenCloudError`, not a fabricated response. This is intentional receipt-first behavior. See [`deployment_proof.md`](deployment_proof.md) for the exact evidence still required for a live claim.

hackathon/demo_script.md

@@ -0,0 +1,24 @@
+# Three-minute demo recording plan
+
+## 0:00-0:20, problem
+State that business automation often stops at a generated answer. Poly closes the loop from objective to evidence, action, and receipt, while keeping risky external actions governed.
+
+## 0:20-1:00, objective and planning
+Enter one bounded objective: qualify an opportunity, collect source evidence, draft the next action, and save a handoff. Show the Qwen Cloud model configuration without revealing secrets. Show the planner output and selected worker lane.
+
+## 1:00-2:00, execution and evidence
+Show the research/tool step, the grounded source snippets, the structured internal record, and the durable artifact receipt. Call out that unsupported claims are excluded and that the run is resumable from its artifacts.
+
+## 2:00-2:35, governance
+Show the external-action decision. The system classifies a send, spend, or submission as requiring approval and pauses. Show the approval payload, not a real external submission.
+
+## 2:35-3:00, Qwen tie-in
+Show `hackathon/qwen_integration.py`, the architecture diagram, and the successful local validation. If a live Qwen credential is available, show the actual model response and timestamped request receipt. Otherwise state plainly that the repository contains the integration proof seam and that live deployment proof remains a pre-submission blocker.
+
+## Recording checklist
+
+- Use a clean browser/terminal capture and crop secrets.
+- Capture the repository URL, LICENSE, README, integration code, architecture diagram, and validation output.
+- If live deployment is shown, retain the request/response receipt and endpoint evidence.
+- Upload as a public or unlisted video to an accepted host before Devpost submission.
+- Do not claim a live deployment, public video, or accepted submission until the corresponding URL or receipt exists.

hackathon/deployment_proof.md

@@ -0,0 +1,41 @@
+# Qwen Cloud deployment proof record
+
+> **Status: NOT VERIFIED.** This file is a submission-safe template. It contains no API key, endpoint secret, fabricated response, or claim of a live Alibaba Cloud/Qwen deployment.
+
+## What must be recorded before Devpost submission
+
+Complete every field from the actual run and attach the resulting receipt or public evidence. Do not replace `NOT VERIFIED` with `VERIFIED` based on a local compile or a mocked response.
+
+| Field | Value |
+| --- | --- |
+| Deployment status | `NOT VERIFIED` |
+| Qwen service / model | `[record the service and model returned by the provider]` |
+| Base URL host | `[record host only, never the API key or query secrets]` |
+| Request timestamp (UTC) | `[ISO-8601 timestamp from the real run]` |
+| Request receipt / provider request ID | `[provider-returned ID, if available]` |
+| Response verification | `[record the observed response and validation method]` |
+| Public evidence URL | `[public URL to an accepted proof artifact, or leave NOT AVAILABLE]` |
+
+## Reproducible run
+
+The live proof requires credentials supplied out-of-band. Do not commit them or paste them into an issue, pull request, recording, or this file.
+
+```bash
+export QWEN_API_KEY='[from a secret manager; do not commit]'
+export QWEN_BASE_URL='[provider-issued OpenAI-compatible endpoint]/v1'
+export QWEN_MODEL='qwen-plus'  # optional; use the model enabled for the account
+python hackathon/qwen_integration.py
+```
+
+A successful local compile proves only that the adapter parses. A run without both required variables must fail closed with `QwenCloudError`; it is not deployment evidence.
+
+## Evidence checklist
+
+- [ ] A real Qwen Cloud endpoint and API key were supplied out-of-band.
+- [ ] The request reached the provider and returned a response.
+- [ ] The provider response or request ID was saved as an auditable receipt.
+- [ ] Secrets were removed from logs, screenshots, and video.
+- [ ] The public evidence URL resolves without exposing credentials.
+- [ ] The Devpost packet links this record and the public repository.
+
+Until all applicable boxes are checked, retain `Deployment status: NOT VERIFIED` and describe the remaining blocker rather than claiming live deployment.

hackathon/qwen_integration.py

@@ -0,0 +1,52 @@
+"""Minimal Qwen Cloud integration proof for the hackathon demo.
+
+This adapter uses an OpenAI-compatible endpoint, which keeps model routing
+separate from the worker runtime. It intentionally fails closed when the
+credentials are absent; no fake completion is returned.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+
+
+class QwenCloudError(RuntimeError):
+    """Raised when Qwen Cloud is not configured or the request fails."""
+
+
+def qwen_chat(messages: list[dict[str, str]], *, model: str | None = None) -> dict[str, Any]:
+    """Call Qwen Cloud through its OpenAI-compatible API.
+
+    Required environment variables:
+      QWEN_API_KEY: API key (never committed)
+      QWEN_BASE_URL: OpenAI-compatible base URL
+
+    The function is a small, auditable proof seam for the Poly worker runtime.
+    It does not claim a live deployment until a real key and endpoint are used.
+    """
+    api_key = os.getenv("QWEN_API_KEY")
+    base_url = os.getenv("QWEN_BASE_URL")
+    if not api_key or not base_url:
+        raise QwenCloudError(
+            "Qwen Cloud is not configured. Set QWEN_API_KEY and QWEN_BASE_URL "
+            "to run the live proof; no credentials are bundled."
+        )
+
+    try:
+        from openai import OpenAI
+    except ImportError as exc:  # pragma: no cover - environment dependent
+        raise QwenCloudError("Install the OpenAI-compatible client before running the live proof") from exc
+
+    client = OpenAI(api_key=api_key, base_url=base_url)
+    response = client.chat.completions.create(
+        model=model or os.getenv("QWEN_MODEL", "qwen-plus"),
+        messages=messages,
+        temperature=0,
+    )
+    return response.model_dump() if hasattr(response, "model_dump") else response.to_dict()
+
+
+if __name__ == "__main__":
+    result = qwen_chat([{"role": "user", "content": "Return the word READY."}])
+    print(result)