7.0 HydraSIM
A sovereign eSIM with six-bearer failover.
Instant eSIM with global data and six-bearer failover, engineered to keep you reachable when a network disappears.
Carrier provisioning and automated number rotation are not enabled yet.
- eSIM provisioning — coming soon
- Number rotation — in development
- Self-capping privacy audit
- Session floor ML-KEM-1024 + X25519
- AEAD ChaCha20-Poly1305
- 6-bearer registry HYDRA
- Honest rung rotationReal:false
01 / THE FAILOVER LADDER — IN MOTION
Take a bearer down. The message keeps moving.
One eSIM. Six ways to stay reachable.
Tap a bearer to take it down. The ladder re-ranks and the message keeps moving — when every bearer is gone, sends queue and deliver on the first one back.
Authored demo states — no coverage or telemetry is drawn here. The six bearers are the HYDRA transport registry. Automated number rotation is in development.
CELLULAR is carrying. 0 of six bearers down.
02 / THE SIM — LETTERED
Read the SIM, section by section.
The failover ladder
When one bearer dies, your traffic demotes to the next — down to radio meshes and ultrasound — without you touching anything. The six bearers are the HYDRA transport registry.
- Cellular
- multi-MNO eSIM data
- Wi-Fi Direct
- peer link, no tower
- Satellite
- sky bearer, ground optional
- Epius mesh
- LoRa long-range mesh
- Bluetooth
- near-field hop
- QSONAR
- ultrasonic, when all RF is gone
When every bearer is gone, sends queue and deliver on the first one back.
The audit that caps its own score
The app runs a cellular privacy audit on itself. While the server
reports rotationReal: false, the audit caps its own score
at 94 of 1001
— the score cannot reach the rotation-dependent ceiling until number
rotation is real. The cap is enforced in the code, not in
marketing copy.
- Server rung
- rotationReal: false
- Score ceiling
- 94 / 100 while rotation is off
- Enforced in
- the cellular privacy audit
No fabricated session, ever
Capability arrives as a server-reported rung. Where carrier provisioning is not enabled on a server, the courier client renders its switching-on panel in exactly these words — and shows you no session:
Live carrier provisioning is not enabled on this server yet.
Number rotation follows the same law: it is roadmap, stated as roadmap, and the app itself says so.
What the cellular layer changes
The SIM layer is the classic compromise vector — SS7 lookups, IMSI catchers, SIM-swap, lawful-intercept gateways all key on your home-carrier binding. HydraSIM is designed to remove that binding: a cellular identity that answers to no home carrier.
It does not make cellular metadata vanish. Tower-side records exist wherever phones do — we say so — and QERYX traffic stays sealed under ML-KEM-1024 + X25519 hybrid keys with ChaCha20-Poly1305, regardless of bearer.
What the eSIM layer holds
Provisioning records for the eSIM service exist and can be produced under legal process. QERYX message content stays end-to-end sealed regardless of bearer — reading a session requires breaking both X25519 and ML-KEM-1024.
The app caps its own score until the capability is real.
An audit that refuses to flatter you
Privacy scores are usually marketing. This one is a witness: it reads the server's capability rungs and locks its own ceiling below 100 while rotation is off.
When rotation arrives, the cap lifts — in code, on the same screen.
The courier tells you the truth
The client never invents a session to look finished. Every capability it shows you arrived as a rung the server actually reported.
03 / THE NUMBERS — FOOTNOTED
Check every number against its receipt.
94/1001
the ceiling the app enforces on its own privacy score until number rotation is real
62
bearers in the HYDRA transport registry
03
coverage figures invented for this page
| Parameter | Value | Where it lives |
|---|---|---|
| rotationReal | false — server-reported | capability rung, read by the client |
| Score ceiling | 94 / 100 while rotation is off | the privacy audit |
| Switching-on panel | rendered when the provisioning rung is off | the courier client |
| Session floor | ML-KEM-1024 + X25519 · ChaCha20-Poly1305 | crypto-core |
04 / THE LAYER BENEATH — WHAT RIDES ON IT
Trace what rides on top of the bearer.
The layers above the SIM, with their own status
- QLEAP · THREE HOPS ABOVE ANY BEARER — The onion tunnel is built to ride whichever bearer is carrying, under a separate key per hop. In development — QLEAP arrives in a later update.
- Q-RATCHET · SEALED REGARDLESS OF BEARER — Messages stay end-to-end sealed on cellular, mesh, or ultrasound; the bearer never touches the plaintext.
- CRYPTO-CORE · ONE RUST CORE — The same audited library seals every blob before any bearer sees it.
05 / THE VERDICT — CATEGORY COLUMNS
Set a sovereign eSIM against the categories it replaces.
| QERYX HydraSIM | Classical carrier SIM | Travel eSIM class | |
|---|---|---|---|
| Real workloads | |||
| Network loss | Six-bearer demotion, down to radio meshes | Dead until coverage returns | Dead until coverage returns |
| Home-carrier binding | None | Total | Partial |
| Honesty about capability | Self-capping audit, server-reported rungs | Marketing copy | Marketing copy |
| Provider subpoenaed | Provisioning records; message content stays sealed | Full call records; content where lawful intercept applies | Provider-dependent |
| Number rotation | In development — said plainly | Not included | Not included |
06 / THE HARD QUESTIONS
Ask what the carrier still sees.
Does my number rotate?
Not yet. Rotation is in development, and the app refuses to pretend: its own privacy score is capped below the rotation ceiling until the capability is real.
What does six-bearer failover mean?
When one bearer dies, traffic demotes to the next — down to radio meshes — without you touching anything.
Does HydraSIM hide me from the carrier?
It removes your home-carrier binding; it does not make cellular metadata vanish. Tower-side records exist wherever phones do — we say so — and QERYX traffic stays sealed.
What can be handed over under subpoena?
Provisioning records for the eSIM service. QERYX message content stays end-to-end sealed regardless of bearer.
Why does a messenger carry a SIM?
The session floor: your counterparty's weakest layer is your session's ceiling. The cellular layer needed to come inside the trust boundary.