fix: harden Qwen Cloud proof entry point

hackathon/qwen_integration.py

@@ -7,10 +7,14 @@
 
 from __future__ import annotations
 
+import logging
 import os
 from typing import Any
 
 
+logger = logging.getLogger(__name__)
+
+
 class QwenCloudError(RuntimeError):
     """Raised when Qwen Cloud is not configured or the request fails."""
 
@@ -47,6 +51,21 @@ def qwen_chat(messages: list[dict[str, str]], *, model: str | None = None) -> di
     return response.model_dump() if hasattr(response, "model_dump") else response.to_dict()
 
 
+def main() -> int:
+    """Run the bounded proof entry point with structured, non-secret logging."""
+    try:
+        response = qwen_chat([{"role": "user", "content": "Return the word READY."}])
+    except QwenCloudError as exc:
+        logger.error("qwen_cloud_proof_failed", extra={"reason": str(exc)})
+        return 1
+
+    logger.info(
+        "qwen_cloud_proof_succeeded",
+        extra={"response_keys": sorted(response.keys())},
+    )
+    return 0
+
+
 if __name__ == "__main__":
-    result = qwen_chat([{"role": "user", "content": "Return the word READY."}])
-    print(result)
+    logging.basicConfig(level=logging.INFO, format="%(levelname)s %(message)s")
+    raise SystemExit(main())

tests/test_qwen_integration.py

@@ -0,0 +1,39 @@
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from hackathon.qwen_integration import QwenCloudError, qwen_chat
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_qwen_chat_fails_closed_without_credentials(monkeypatch):
+    monkeypatch.delenv("QWEN_API_KEY", raising=False)
+    monkeypatch.delenv("QWEN_BASE_URL", raising=False)
+
+    with pytest.raises(QwenCloudError, match="not configured"):
+        qwen_chat([{"role": "user", "content": "READY"}])
+
+
+def test_cli_fails_closed_without_credentials():
+    env = os.environ.copy()
+    env.pop("QWEN_API_KEY", None)
+    env.pop("QWEN_BASE_URL", None)
+
+    result = subprocess.run(
+        [sys.executable, "hackathon/qwen_integration.py"],
+        cwd=ROOT,
+        env=env,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    assert result.returncode == 1
+    assert "qwen_cloud_proof_failed" in result.stderr
+    assert "QWEN_API_KEY" in result.stderr
+    assert "{'" not in result.stdout