WP-01 · Stealth edition

Queva: a single-tenant, message-native agent runtime for small-business operations

Abstract. Queva is an agent runtime that gives a small-business owner a persistent, policy-constrained operator reachable over ordinary text messaging. Each deployment is single-tenant and owner-held. Untrusted inputs are processed under least privilege, side-effecting actions are gated on explicit human approval, and generated artifacts are grounded in owner-supplied facts. This edition states the design principles only.

Status: in stealth. Queva is under active development and in private demos with small businesses. Architecture, prompts, model choices, thresholds, evaluation data and costs are withheld until release. The full paper will be published then.

Fig. 1 · Trust boundaries, simplified

Queva at the level of trust boundariesThe owner sends plain-language requests to Queva, which runs inside an isolated tenant the owner holds. Actions on the owner's tools pass an approval step.Ownerplain-language messagesISOLATED TENANT · OWNER-HELDQuevadetails withheld while in stealthThe owner's toolsweb, apps, pagesapprovalrequestanswer
Everything inside the lilac boundary belongs to one owner. Nothing crosses into the owner's tools without passing the approval step.

1. Problem

Owners of one to twenty-five person businesses lose their highest-value hours to low-value coordination: repeated questions, follow-ups, data entry and inbox triage. General-purpose assistants add another interface to learn, hold no durable context about the business, and run on infrastructure the owner neither controls nor can audit.

2. Design principles

  1. Single-tenant isolation. One deployment per owner, on infrastructure held in the owner's account. No shared runtime, no cross-tenant memory.
  2. Message-native interface. The control surface is the owner's existing text thread. No new application, no dashboard to learn; long outputs are rendered to private pages and returned as links.
  3. Least-privilege ingestion. Untrusted content, such as forwarded email, is treated as data, never as instructions, and is handled by components that cannot act.
  4. Human-in-the-loop on side effects. Outbound and destructive actions require explicit owner approval by default. The policy can be relaxed per owner; every action is written to an audit log the owner can read.
  5. Grounded generation. Generated artifacts may only assert facts the owner supplied. Missing inputs trigger a question instead of a guess.
  6. Owner-held credentials. Secrets never transit the conversation channel and are stored encrypted inside the tenant.
  7. Durable context. The runtime keeps long-term memory of the business, so instructions compound instead of resetting each session.

3. Status

Queva is being built privately with a small set of design partners and is not generally available. The full paper, with architecture, evaluation and failure analysis, will be published at release. To be considered as a design partner, book a 15 minute call.