◉ COOLJAPAN
← All posts
April 26, 2026 • 10 min read

AmateRS 0.2.0 Released — UPDATE Queries, OCSP Revocation, JWT Expansion, GPU Detection, and the First End-to-End FHE Examples

AmateRS is a distributed database with Fully Homomorphic Encryption that computes on encrypted data without ever decrypting it server-side. 0.2.0 — our biggest changelog yet — adds UPDATE queries with atomic rollback, query-result caching, OCSP revocation, JWT algorithm expansion, GPU detection, graceful shutdown, and 3 end-to-end FHE examples.

release amaters fhe homomorphic-encryption database privacy rust tls distributed-systems

Your server should never need to read your data. AmateRS 0.2.0 makes that a complete, operable database — not just a promise.

Today we released AmateRS 0.2.0 — the distributed Fully Homomorphic Encryption database that computes on encrypted data without ever exposing plaintext to the server, now with mutable UPDATE queries, real-time certificate revocation, a full JWT algorithm suite, GPU detection, graceful shutdown, and the first three end-to-end FHE applications.

No C. No Fortran. No OpenSSL pulled in through the back door. The FHE incumbents — TFHE-rs wrappers around C, Microsoft SEAL, OpenFHE — and the cloud databases that still demand plaintext access all share the same unspoken assumption: that the server gets to read your data. AmateRS removes that assumption from the architecture, not from the marketing copy. It ships as a single static binary, it is 100% Pure Rust by default, it is now licensed Apache-2.0, and it serializes everything through oxicode — no bincode on the hot path, no surprise native toolchain. AmateRS is the rock cave (Iwato): your data stays inside a cryptographic shell while the computational light still shines.

Why AmateRS 0.2.0 is a game changer

FHE has had a brutal reputation: it could read, compare, and aggregate ciphertext, but the moment you wanted to change a record, run a production TLS handshake against revoked certs, or shut a node down without losing the last few writes, the abstraction leaked and you were back to plaintext databases. 0.2.0 closes those gaps. It is the largest changelog in the project’s history, and it turns AmateRS from “a remarkable storage-and-compute experiment” into “a database you can run.”

These are concrete wins, every one of them backed by code and by 1852 passing tests across the workspace.

Technical Deep Dive

Query Engine — mutation, caching, and SDK ergonomics

The headline is the UPDATE query. AmateRS selects rows by an FHE predicate and applies a mutation to them, and the whole operation is transactional: a failure anywhere in the update triggers an atomic rollback so the store is never left in a partially-mutated state. This is the piece that was missing for AmateRS to behave like a database rather than an append-and-read log.

Around the query path sits the new query-result cache — LRU eviction with write-through invalidation. Reads warm the cache; any write that touches the underlying data invalidates the relevant cached results, so correctness after a mutation is automatic rather than something you have to reason about.

On the client side, the SDK gains cursor-based pagination with a configurable page size and multi-field sorting. Large result sets are now paged through with a cursor instead of materialized whole, and you can sort by several fields at once — the kind of ergonomics that make AQL pleasant to build real applications on.

Security & TLS — revocation, algorithms, and key handling

The Network layer (Musubi, the Knot) got the deepest security work in the project so far. OCSP revocation checking implements RFC 6960 end to end: certificate validity is verified against the issuing authority’s responder, so a revoked cert is caught immediately instead of being honored until its natural expiry.

The JWT algorithm suite expands to cover HS384/HS512/RS384/RS512/ES384/EdDSA in addition to the original HS256/RS256/ES256 — a near-complete set spanning HMAC, RSA, ECDSA, and Edwards-curve signatures.

For mTLS configuration there is now a fluent TLS client builder: client certificate and key loading expressed as a readable chain rather than a struct full of optionals. And crucially, AmateRS can now load encrypted PEM keys — password-protected PKCS#8, plus legacy PKCS#1 and SEC1 formats — so the keys you already have, encrypted the way your security team requires, just work.

Network & Transport — meeting clients where they live

The TypeScript SDK gains a native HTTP/1.1 transport built directly on Node’s http/https modules. Until now the SDK was gRPC-only; the HTTP/1.1 path replaces that constraint and unlocks browser and edge runtimes where HTTP/2 gRPC is awkward or unavailable. It is opt-in — set AmateRSClientOptions.transport = "http1" — so existing deployments are untouched.

On the server, graceful shutdown hooks enforce an ordered teardown on SIGTERM/SIGINT: WAL flush → memtable compaction → connection drain. The sequence is deliberate — durability first, then storage consolidation, then disconnecting clients — and it is what prevents data loss when the orchestrator decides it is time for a node to go.

Storage & Consensus — reclaiming space, catching up faster

Down in the storage engine (Iwato, the Rock Cave), a background GC worker now runs periodic value-log compaction. AmateRS uses WiscKey-style value separation, where large values live in a separate log; over time, deleted and overwritten values leave dead space behind. The GC worker reclaims it in the background, so the value log doesn’t grow without bound.

In consensus (Ukehi, the Sacred Pledge), the Raft state machine now applies committed entries in batches and supports snapshotting, so a follower that has fallen behind can catch up from a snapshot instead of replaying the entire log. Batch-apply cuts the per-entry overhead under sustained write load; snapshotting bounds how far a lagging node can fall.

Getting Started

Add AmateRS to a Rust project, or pull in the SDK directly:

# As a library / facade crate
cargo add amaters

# Or pin the Rust SDK explicitly in Cargo.toml:
#   amaters-sdk-rust = "0.2.0"

# Start the server with a local data directory
cargo run --bin amaters-server -- start --data-dir ./data

# NEW in 0.2.0: generate shell completions
cargo run --bin amaters-cli -- completions bash > ~/.local/share/bash-completion/completions/amaters

A predicate-based UPDATE with atomic rollback, and a paginated, sorted read, from the Rust SDK:

use amaters_sdk_rust::AmateRSClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = AmateRSClient::connect("http://localhost:7878").await?;

    // UPDATE: select by an FHE predicate, mutate the matched rows.
    // If the update fails partway, the whole operation rolls back atomically.
    client
        .update("accounts")
        .filter("balance < 0")
        .set("status", "frozen")
        .execute()
        .await?;

    // Cursor-based pagination with multi-field sorting.
    let page = client
        .query("accounts")
        .filter("status == \"active\"")
        .sort_by(&["region", "created_at"])
        .page_size(100)
        .fetch()
        .await?;

    println!("fetched {} rows; next cursor: {:?}", page.len(), page.next_cursor());
    Ok(())
}

What’s New in 0.2.0

Query Engine

Security & TLS

Network & Transport

Distributed Systems

Storage & GC

CLI & Server

GPU

FHE Examples (3 end-to-end)

Changed

Fixed

Tips

Migration from 0.1.0

A short, honest list of what changes when you move from 0.1.0:

This is the foundation

AmateRS sits inside the COOLJAPAN ecosystem, and as of April 2026 that ecosystem is complete enough to lean on with confidence. Serialization runs through oxicode — Pure Rust, no bincode on the hot path — and compression is handled by OxiARC (LZ4 + DEFLATE), so AmateRS inherits the same C/Fortran-free discipline as the rest of the family rather than reinventing it. Everything stays a single static binary; everything stays sovereign.

Repository: https://github.com/cool-japan/amaters

Star the repo if you believe your data’s privacy should be a property of the architecture, not a clause in a terms-of-service agreement. 0.2.0 is the release where AmateRS stops being a promise and starts being a database — and the biggest changelog so far is just the floor.

— KitaSan at COOLJAPAN OÜ April 26, 2026

↑ Back to all posts