Queva OS: a working paper

Field notes on what I'm building, how it works, and what comes next.

Unless a source is marked, details come from my own build notes.

Summary

I'm building Queva OS as a business assistant on top of the open-source Hermes Agent from Nous Research. [1] It helps prepare everyday work, remembers owner preferences, and connects to selected business tools. Routine preparation can move ahead. Supported actions like publishing a draft or starting a reviewed email campaign ask for the owner's approval by text. It's been built and tested with test data, and it isn't yet tested on real client accounts. These are my field notes on what works in the build and what's next.

Why I started

I'm building this for small business owners and real estate team leads. The work I have in mind is familiar: replying to an inquiry, preparing a reminder, reviewing paperwork, and checking how marketing is doing. An assistant should help move that work along.

Drafting is a useful starting point. I also want Queva to take supported actions in the tools an owner already uses. That means getting the permissions right. Connecting an account shouldn't give an assistant permission to do everything inside it.

My approach is to let preparation move ahead and ask at the step that changes something important. The owner gets to review the action before it happens. Some steps stay with the owner, and some are blocked altogether. Those boundaries are part of how I'm building it.

What Queva OS is

Hermes provides the foundation: the assistant itself, memory, task instructions, scheduled work, and messaging. [2] Queva adds the business profile, private project folders and links, saved owner preferences, support controls, and rules for approving supported actions.

The business guidance covers inquiry drafts, payment reminders, reviews, paperwork, marketing, and dashboards. I keep the instructions separate from account access. Giving Queva a guide for payment reminders, for example, doesn't connect a payment app or give it permission to move money.

Hermes supports a standard way to plug in other apps. [5] Queva limits which parts of a connection the assistant can use. I distinguish between an app listed as a setup option and a connection with specific actions built into Queva. The table below shows those actions.

The choices I'm making

Designed so the owner owns it

The arrangement I'm designing for is an owner-owned server in Europe and an owner-owned OpenRouter key with a spending cap. OpenRouter supplies access to the AI models. The onboarding plan puts billing, data, and account credentials with the owner, and calls for removing my setup access at handoff.

Ownership also means being clear about where information goes. Project files can live on the owner's server, while model requests go to the model provider. Search queries, selected synced files, forwarded messages, and approved website files go to the services handling that work.

I want owners to understand those routes when we choose the setup. Having a private server is one part of the arrangement. Knowing which outside services receive information is another.

Text it where you already talk

I want owners to learn Queva by talking to it. The setup paths include iMessage through Photon, Telegram, WhatsApp, Slack, and Signal. Each needs its own platform setup and an approved account. For iMessage, the plan uses the owner's own account.

Setup includes a real message from the approved account. Unknown direct messages are ignored. The owner experience is a conversation, while the server and provider setup happen behind it.

Memory should help without hiding its costs

The standard setup has Hindsight long-term memory on. It gives the assistant ways to save, recall, and think through information from earlier conversations. Hindsight also supports automatic conversation capture. [3]

The selected setup stores memory locally and handles searching and ranking it locally. Turning conversations into saved information and making sense of that information still uses a model through OpenRouter. That work can add usage.

Queva also asks for approval before writing to Hermes' built-in memory. Hermes documents a review step for those writes. [4] Everyday business lists belong in project files. Saved preferences and project work have different jobs.

Prepare freely, ask at the risky step

Once an owner has agreed to a connection and its allowed uses, Queva can generally read, draft, and fill allowed forms without asking again each time. Supported sending, publication, and certain account changes pause for review.

Some boundaries are firm. Queva refuses money movement, purchases, bank and payment sites, personal inbox access, and bulk lead deletion. Its own AgentMail inbox can receive selected forwarded messages, but it can't send, reply, or forward. The owner sends those drafts from their own mail app.

The business instructions also tell Queva to refuse sensitive material such as patient records, legal case files, card numbers, bank logins, and recovery codes. Health checks and usage notices are handled separately from customer messages.

How approval by text works

Before a supported risky action, Queva sends the owner a preview and a short-lived, single-use code. Longer previews can link to the private page. The owner replies YES with the code to approve, or NO with the code to cancel.

For example, a request to publish a reviewed WordPress draft might read:

Publish this reviewed draft to the connected WordPress site? Reply YES 4821 to approve or NO 4821 to cancel. This request expires soon.

That's an example. The owner uses the code in the actual request, and only the configured owner's direct chat and identity can approve it.

Approval covers that action, its contents, and the connected account. Changing the connection cancels pending approvals. A changed browser page or form needs a fresh review. Queva then retries the same approved action; the assistant receives the approval result rather than the code.

Approving an action doesn't grant me server access. Temporary support access has its own separate approval process.

What it connects to

These are the connection paths built into Queva and the limits on each. Where a step says owner-only, the owner does it in the app. A text approval doesn't change that boundary.

GoHighLevel has separate development work behind it, but it isn't in this build's connection list. The wider Hermes app directory is a list of setup options, separate from the connections above.

Costs and monitoring

The owner sets the spending cap in OpenRouter. Queva checks and stores the key; the cap is set with the provider. Model calls, including memory work, contribute to usage.

The monitoring setup is built so I get alerts when a client's usage climbs or credit runs low. It watches selected client keys. There's also a separate usage check on the client server. Alerts help me keep an eye on spending; the spending cap belongs in the provider account.

What I've learned building it

The approval work went through 15 review rounds. Follow Up Boss had three separate rounds of fixes. The most useful lesson was straightforward: the preview has to match what will happen.

For an email campaign, that means reviewing the sending accounts and the whole sequence. For a website draft, it means checking the visible page and its settings. For a contact change, it means checking whether that change triggers outreach.

That's why I prefer specific app connections for consequential work. They let me define a smaller action and check the account, content, and expected result together. Browser access takes more care because clicking or typing can have effects beyond the visible button.

A separate development handoff records passing automated checks and desktop and phone browser checks with test data. In the lease example, the downloaded file matched the reviewed file, the signature stayed empty, approval worked once, and reuse was rejected. Focused checks also covered the usage monitor and confirmed TickTick's blocked access.

What's still open

These are the next checks and decisions:

• Installation and everyday use. Finish clean-server installation checks, connect a real CRM account, test owner chat, and check weekly delivery.
• TickTick. Fix the missing list of allowed tools, then test login and task changes.
• Browser behavior. Sites can attach hidden actions to clicks or typing. The approval gate covers steps Queva recognizes as risky. Review those effects and connected apps' automatic actions.
• Memory and data. Confirm how approval applies to Hindsight's automatic capture and how deletion works across memory, conversations, and backups. Set provider access and retention choices. Behavioral instructions alone don't guarantee sensitive information is filtered.
• Handover and backups. Confirm the installed software version, resolve provider setup differences, and test removal of my access. Finish general encrypted backups; a narrower database backup already exists.
• Operations. Test live alert delivery, coverage of memory and helper usage, and terminal session recording. Pausing new chat work is built in; stopping every background task needs separate checking.
• Documents and reporting. Continue electronic signatures, Word documents, profit-and-loss PDF reading, and scheduled CRM comparisons. Clarify what Follow Up Boss weekly outcomes mean. Cash reports measure money in and out, not revenue or profit.

Measured running costs, time saved, and business results belong here too. I'll add them as I gather the evidence and update these notes as the work moves forward.

Change log

0.1 · October 2026 · revised field notes

Sources

1. Hermes Agent on GitHub, Nous Research. MIT license.
2. Hermes Agent: official overview, Nous Research.
3. Hermes Agent: official Hindsight plugin documentation.
4. Hermes Agent: persistent memory documentation.
5. Hermes Agent: app connection documentation.