CORVUS & CRONOS = Wolf and Cronos — The Wolf Doesn't Get to Whisper Unchallenged

Qwen Cloud Hackathon 2026 · Track 3: Agentic AI

A deterministic multi-agent platform for detecting social engineering and manipulation in natural-language conversations — with cryptographically verifiable reasoning traces. Qwen narrates. It never judges.

Live: https://wolf-and-cronos.vercel.app · Code: https://github.com/annatchijova/wolf-and-cronos · Running on Alibaba Cloud ECS (US-Virginia)

The one sentence

Instead of asking an LLM whether a message is manipulative and trusting its answer, we split the problem in two: a deterministic multi-agent engine (CORVUS) decides, a tamper-evident reasoning recorder (CRONOS) seals every step of how it decided, and Qwen explains the sealed result to a human — mathematically unable to change the verdict it is describing.

Inspiration

Every scam that has ever worked has the same shape: it never opens with the ask. It opens with trust.

"Hi Anna! Great meeting you at the audit-tech conference last week. Your talk on tamper-evident logs was excellent."

Five messages later, the same friendly voice is telling you that you have two hours to wire a deposit or lose everything — dressed in urgency, guilt, and fear. Message one is pure rapport; no filter on earth flags it. By message five, it's too late.

We could have thrown this at an LLM and asked "is this a scam?" But that is exactly the wrong architecture for a decision that matters. A language model can read the same evidence correctly and still reach the wrong conclusion under narrative pressure — and when it's wrong, "the model said so" is not an answer anyone can act on, defend in an HR meeting, or take to court.

So we built it the other way around. The reasoning is deterministic and sealed before any language model is invoked. The model's only job is to put the already-decided result into human words. If the LLM cannot move the verdict by a single bit, it cannot be manipulated into moving it either.

🐺 What it does — the Wolf and the Watchdogs

CORVUS reads every message through six independent theoretical frameworks, in parallel, that don't know or trust each other:

Watchdog	What it listens for
L1 · Grice	Violations of conversational cooperation — saying more or less than the moment calls for
L2 · Carnegie / Cialdini	Influence levers — reciprocity, scarcity, authority, social proof
L3 · Aristotle	Ethos / Pathos / Logos out of balance — emotion crowding out reason
L4 · Berne	Transactional ego states — Adult-to-Adult, or Parent cornering Child?
L5 · Linguistics	Register shifts, complexity spikes, Zipf anomalies — the fingerprints of a scripted pitch
L6 · Peirce	Abductive synthesis — the simplest explanation that fits everything the other five saw

And the rule that makes this different from a paranoid filter: no single watchdog can raise the alarm alone. It takes a corroboration gate — at least two independent frameworks agreeing — before a verdict escalates past silence. One flag is noise; corroboration is signal.

Then CRONOS takes over. Every agent's vote, every piece of evidence, every discarded alternative, and the final sealed verdict become links in an append-only SHA-256 hash chain. Alter, insert, reorder, or drop any entry, and every hash after it breaks. You can delete the truth — you cannot hide that you deleted it.

Only after the verdict is sealed is Qwen invited in — to narrate the case in the reader's language (EN / ES / 中文), complete with an auto-generated devil's-advocate counter-argument, so the system argues against itself before the verdict is allowed to stand. Swap Qwen for any other model and the wording changes; the verdict underneath does not move.

Why CORVUS

Because a single classifier is a single point of failure — and a black-box score is not a reason.

No black-box score. CORVUS emits a sealed verdict with a recorded, inspectable reason, not a number you have to trust.
No single detector decides. Six independent frameworks, each grounded in a real theory of communication (Grice 1975, Cialdini, Aristotle, Berne, forensic linguistics, Peircean abduction). Manipulation that fools one lens rarely fools all six.
The gate is the mechanism. Corroboration isn't a filter bolted on top — it's the negotiation itself. Agents that fire below threshold have their hypothesis discarded, and that overrule is recorded, not hidden.
Exact arithmetic, zero floats. Every score is computed with fractions.Fraction. No floating-point drift means the same input produces the same sealed hash on any machine — a prerequisite for a verdict you can reproduce and audit.

Why CRONOS — the part we're proudest of

CORVUS decides well. CRONOS makes that decision inspectable, tamper-evident, and honest about its own uncertainty. This is the real innovation, and it turned out to be far bigger than CORVUS.

Tamper-evident by construction. Each entry hashes the previous one (SHA-256). Any retroactive edit is instantly detectable on verify.
Every hypothesis is recorded — including the ones killed. Most systems show you the winner. CRONOS shows you what the agent considered and rejected, with reasons. The discards are often more informative than the conclusion.
Contradiction detection. When evidence both supports and refutes the same hypothesis, CRONOS flags a Type A contradiction automatically. The agent cannot quietly resolve a genuine conflict in its own favor.
A confidence ceiling you cannot game. At seal time, CRONOS computes the trace's observational diversity and caps the stored confidence to what the evidence base actually supports. An agent that claims 95% certainty from a single kind of evidence gets its confidence lowered — automatically. This is the difference between a model that says "I'm sure" and one forced to admit it lacks evidence before raising its confidence.
Honest degradation. A reconstructed or unverifiable value is flagged, never dressed up as a real one. PASS / WARN / FAIL, never a silent PASS.

How they work together

TEXT → CORVUS (6 frameworks, parallel) → CORROBORATION GATE → SEALED VERDICT
                     │                                              │
                     └──────────→ CRONOS traces (SHA-256 chain) ←───┘
                                              │
                                     QWEN NARRATOR (read-only)

One pipeline, one codebase, one process. The only external call in the entire flow is the Qwen narration step — and it happens after the verdict is already sealed. That ordering is the whole architecture: the LLM is permanently outside the decision path.

Why Qwen, and why Alibaba Cloud

Qwen isn't a checkbox here — it plays two distinct, honest roles:

qwen-max is the Wolf. In the live demo it plays the social engineer, improvising the attack message by message (--live-wolf) — a red-team fixture that proves the detector against a live adversary, not a canned script.
qwen-plus is the narrator. It reads the sealed verdict and writes the human-readable case in the caller's language — the one thing a deterministic engine genuinely cannot do: explain, warmly and clearly, why message four smells like a scam.

Both run through the Alibaba Cloud DashScope international endpoint, called directly over requests (no openai SDK). The whole product is deployed and running on Alibaba Cloud ECS (US-Virginia, Docker, port 8022): POST /analyze returns the sealed verdict + trace ids + qwen-plus narration; POST /chat is a live conversation with qwen-plus; /verify recomputes the chain. We have the ECS console, the Docker build, and the live /health (qwen_narration: configured) as evidence in the repo.

The insight that changes everything: CRONOS isn't tied to CORVUS

Halfway through, we realized CORVUS is just one detector plugged into CRONOS. CRONOS is domain-agnostic infrastructure for auditable agent reasoning. Any MCP-capable agent — not just ours, not just Claude — can record its own black box through the ten cronos_* tools.

To prove it, we drove CRONOS with Qwen Plus (via opencode + the CRONOS MCP server — a real MCP agent, not our own code) on three deliberately different tasks, and rendered each sealed trace read-only:

Forensic — evidence for cause. Qwen found behavioral MALICE (fabricated evidence against an employee) but, faced with a self-supplied chain of custody, capped the verdict at SUSPICION under the Daubert standard instead of over-concluding. cronos-1
Security — insider or intruder? The incriminating access evidence and an airtight flight alibi both pointed at the same suspect. CRONOS flagged a Type A contradiction, and the verdict was held at SUSPICION — never confirmed. cronos-3
Engineering — a nightly job went silent. A pure root-cause diagnosis with nothing forensic in it at all: a timezone bug, plus a swallowed exception. Same discipline; confidence capped 19/20 → 3/5 by diversity. cronos-2

The mechanism translates to medicine without changing a line: a diagnostic agent registers differential hypotheses, ties each clinical finding to the one it supports or refutes, gets a contradiction flagged the moment symptoms point two ways, and a confidence that cannot be inflated beyond what the real diversity of data (history + labs + imaging, not just one) supports. There, the diversity ceiling isn't a curiosity — it's the difference between a model that says "95% sure" from a single data point and one obligated to admit it lacks evidence first.

Anywhere an agent reasons toward a high-stakes decision — clinicians, students, researchers, engineers, auditors — CRONOS makes that reasoning inspectable and honest about its own uncertainty.

Advantages at a glance

Deterministic core, LLM out of the decision path — the verdict is sealed before any model speaks.
Cryptographically verifiable — SHA-256 chain; tampering is detectable, not just discouraged.
Honest by construction — confidence capped by evidence diversity; contradictions surfaced automatically; discards preserved.
Reproducible — exact Fraction arithmetic, zero floats in the sealed path.
Model-agnostic & domain-agnostic — works with any MCP agent (proven with Qwen, not just Claude), on any reasoning task.
Multilingual & deployable — trilingual EN/ES/中文, hosted API on Alibaba Cloud, offline deterministic fallback.
Adversarially hardened — two rounds of red-team audit against our own gate (RT-01…RT-10), including a drip-feed defense.

Use cases

Anti–social-engineering / anti-phishing — the flagship: flag scams with an auditable reason, as a hosted /analyze API.
Medical differential diagnosis — multiple hypotheses, contradiction flags, confidence capped by real data diversity.
Legal case analysis — evidence tied to claims, chain-of-custody-aware verdicts, tamper-evident record.
Financial risk assessment — reasoning that can be re-verified after the fact by a third party.
Engineering incident / root-cause analysis — rival hypotheses, honest discards, a sealed conclusion (proven, non-forensic).
AI-safety & agent auditing — a black-box recorder for any agent's reasoning, so high-stakes decisions become inspectable.

How we built it

Two engines, vendored into one self-contained repo. corvus/ (six detectors + verdict engine + behavioral memory, 95 tests) and cronos/ (hash-chain + quality/diversity scoring + contradiction detector + MCP server, 165 tests), wired by corvus_cronos/ (the bridge + product layer, 118 tests + 51 subtests).
Deterministic invariants everywhere it matters. fractions.Fraction for all scoring; canonical, key-sorted, type-tagged JSON before hashing; SHA-256 seals with chain-of-custody metadata kept outside the sealed payload; a stdlib-only verifier.
Qwen via DashScope, no SDK. A thin requests client with exponential-backoff retry; qwen-plus for narration, qwen-max for the live Wolf.
MCP-native. CRONOS and CORVUS both ship as Model Context Protocol servers, so any agent — Claude, a Qwen agent via opencode, a CI pipeline — can drive them.
Hosted & deployed. FastAPI + Uvicorn, Dockerized, running on Alibaba Cloud ECS behind a token-guarded API; a self-contained trilingual frontend on Vercel.
A report renderer turns any sealed trace into a Markdown audit trail + a visual HTML report — read-only from the cryptographic chain, so a Qwen-driven trace and a Claude-driven one render identically.

Challenges we ran into

Keeping the LLM out of the decision path — and proving it. The test we hold ourselves to: swapping the narrator backend must change only the wording, never the verdict, seal, or chain. If it can change the outcome, the architecture is wrong.
A confidence you can't inflate. Designing the observational-diversity ceiling so an agent physically cannot claim more certainty than its recorded evidence earns — and making it fire on real Qwen runs (13/20 → 3/5, 19/20 → 3/5).
The drip-feed attacker. We red-teamed our own gate: an attacker who spreads one tactic per message never trips a single-message corroboration threshold. Our fix (RT-10) accumulates frameworks across a bounded per-user window — same philosophy, widened from one message to a short history — without modifying CORVUS's own gate.
Determinism across machines. Chasing every stray float, set/dict ordering, and unpinned timestamp out of the sealed path so the hash is bit-for-bit reproducible.

Accomplishments we're proud of

CRONOS caps its own confidence — and we watched a Qwen agent get its confidence lowered, live, because its evidence base was too narrow.
CRONOS flagged a Type A contradiction on a real run and refused to let the verdict escalate to MALICE.
We proved CRONOS is general infrastructure by driving it with a non-Claude agent on a task with nothing forensic in it.
It's actually deployed on Alibaba Cloud, with the console, the Docker build, and the live /chat responding from qwen-plus as evidence.

What we learned

The recorder mattered more than the detector. We started building a scam catcher and ended up building auditable, uncertainty-honest infrastructure for agent reasoning — the thing that makes an AI decision defensible, not just plausible. And the strongest guarantee wasn't "the model is smart"; it was "the model is structurally unable to overstate what it knows."

What's next

Publish measured FPR/FNR from the nightly red-team job (live qwen-max-generated adversarial corpus, sealed into CRONOS) now that we're on ECS.
The first end-to-end QwenCronosAgent run (Qwen driving the full reasoning loop via DashScope function calling, not just narration).
A medical differential-diagnosis reference agent, to make the domain-agnostic claim concrete for a second field.

Built with

Qwen Cloud (qwen-plus, qwen-max via Alibaba Cloud DashScope), Alibaba Cloud ECS (Docker + Caddy), Python 3.12, fractions.Fraction, SHA-256 hash chains, FastAPI + Uvicorn, the Model Context Protocol (MCP), requests, opencode (for the Qwen-driven CRONOS runs), and a self-contained trilingual frontend on Vercel.

Links and enjoy:

principal: https://wolf-and-cronos.vercel.app/ github: https://github.com/annatchijova/wolf-and-cronos all links: https://wolf-and-cronos.vercel.app/cronos.html https://wolf-and-cronos.vercel.app/demo.html https://wolf-and-cronos.vercel.app/dashboard.html https://wolf-and-cronos.vercel.app/overview.html https://annatchijova.github.io/vigia/wolf-and-cronos.html https://annatchijova.github.io/vigia/cronos.html https://annatchijova.github.io/vigia/diagrama.html Results: https://annatchijova.github.io/vigia/cronos-1.html https://annatchijova.github.io/vigia/cronos-3.html https://annatchijova.github.io/vigia/cronos-2.html

alibaba: http://47.85.85.16:8022/ It's possible that the HTTPS connection might go down at some point if I can't continue making payments. My apologies; I left the demo ready, and you can also clone the repository.

Qwen narrates. It never judges. Every verdict is computed deterministically before any LLM is invoked.

Built With

alibaba
fraction.fraction
mcp
multi-agent
opencode
python
qwen-cloud
qwen-plus
sha-256

Wolf and Cronos | Corvus & Cronos MCP and multi-agent