From aa576656c21f535cb28a786a2434750d92f476c6 Mon Sep 17 00:00:00 2001
From: Igor Lins e Silva <4753812+igorls@users.noreply.github.com>
Date: Sat, 30 May 2026 16:58:36 -0300
Subject: [PATCH] feat: migrate to the pure-Rust rs_abieos backend
 (cross-platform)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch the rs_abieos dependency to 0.5.0 with the pure-Rust `rust-backend`
(default-features = false). The backend is API-compatible, so this needs zero
code changes — but it removes the C++ toolchain / clang / libclang / git build
requirements and makes fleet-router build and run on Linux, macOS, and Windows.

- Cargo.toml: rs_abieos = { version = "0.5.0", default-features = false,
  features = ["rust-backend"] }. MSRV raised to 1.95 (rs_abieos uses `if let`
  guards, stable since 1.95). Cargo.lock drops bindgen/cc/clang-sys/sys-info.
- CI: replace the single Linux job (which installed clang/libclang) with a
  Linux/macOS/Windows test matrix; MSRV job -> 1.95; bump actions to Node 24.
- release.yml: build cross-platform release binaries (linux x86_64, macOS
  arm64/x86_64, windows x86_64) alongside the crates.io publish and GHCR image.
- Dockerfile: drop the clang/libclang install; builder is rust:1.95-bookworm.
- tests: locate the binary via CARGO_BIN_EXE_fleet-router so the e2e and
  operational suites run on Windows/macOS too.
- docs: README/CONTRIBUTING/SECURITY/bug-report updated for pure-Rust,
  cross-platform builds; CHANGELOG entry.

Verified: native Windows build + full test suite; Linux fmt/clippy/test/
cargo-deny; MSRV 1.95; docker build (pure Rust, no clang).
---
 .github/ISSUE_TEMPLATE/bug_report.yml |  11 +--
 .github/workflows/ci.yml              |  55 ++++++-----
 .github/workflows/release.yml         |  48 ++++++----
 CHANGELOG.md                          |   3 +
 CONTRIBUTING.md                       |  34 ++-----
 Cargo.lock                            | 128 +-------------------------
 Cargo.toml                            |   4 +-
 Dockerfile                            |   9 +-
 README.md                             |  24 +----
 SECURITY.md                           |   4 +-
 tests/e2e_proxy.rs                    |  17 +---
 tests/operational.rs                  |  10 +-
 12 files changed, 99 insertions(+), 248 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index af93bf4..9290184 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -12,7 +12,7 @@ body:
         - For security vulnerabilities, do **not** open a public issue. Use private reporting per [SECURITY.md](../../SECURITY.md).
         - For questions or usage help, please use Discussions instead.
 
-        fleet-router currently supports **Linux x86_64 only**. macOS/Windows are not supported for native builds; use the Docker image (`ghcr.io/eosrio/fleet-router`) there.
+        fleet-router is pure Rust and runs on Linux, macOS, and Windows (x86_64 and arm64). A prebuilt Docker image is also available (`ghcr.io/eosrio/fleet-router`).
 
   - type: input
     id: version
@@ -39,7 +39,7 @@ body:
     id: os-arch
     attributes:
       label: OS and architecture
-      description: "Distribution/version and CPU architecture. Remember: only Linux x86_64 is supported."
+      description: "Operating system, distribution/version, and CPU architecture."
       placeholder: "Ubuntu 24.04, x86_64"
     validations:
       required: true
@@ -47,11 +47,10 @@ body:
   - type: input
     id: build-env
     attributes:
-      label: Rust version and build toolchain (for build issues)
+      label: Rust version (for build issues)
       description: >-
-        Output of `rustc --version` (MSRV is 1.85), and whether clang + libclang-dev were installed
-        (required by bindgen). Leave blank if this is not a build issue.
-      placeholder: "rustc 1.85.0; clang/libclang-dev installed: yes"
+        Output of `rustc --version` (MSRV is 1.95). Leave blank if this is not a build issue.
+      placeholder: "rustc 1.95.0"
     validations:
       required: false
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 86e3ef1..5dbff91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,45 +15,44 @@ env:
 
 jobs:
   test:
-    name: Build, Test, and Lint
-    runs-on: ubuntu-latest
+    name: Build & Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
-
-      # rs_abieos builds vendored C++ via bindgen, which needs a C++ toolchain
-      # and libclang at build time.
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      - uses: actions/checkout@v5
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Build
+        run: cargo build --workspace --locked --verbose
+      - name: Test
+        run: cargo test --workspace --locked --verbose
 
-      - name: Install stable Rust
+  lint:
+    name: Format & Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
-
-      - name: Cache cargo registry and target
-        uses: Swatinem/rust-cache@v2
-
+      - uses: Swatinem/rust-cache@v2
       - name: Check formatting
         run: cargo fmt --all -- --check
-
       - name: Clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
-      - name: Build
-        run: cargo build --workspace --locked --verbose
-
-      - name: Test
-        run: cargo test --workspace --locked --verbose
-
   msrv:
-    name: Minimum Supported Rust Version (1.85)
+    name: Minimum Supported Rust Version (1.95)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
-      - name: Install Rust 1.85
-        uses: dtolnay/rust-toolchain@1.85
+      - uses: actions/checkout@v5
+      - name: Install Rust 1.95
+        uses: dtolnay/rust-toolchain@1.95
       - uses: Swatinem/rust-cache@v2
       - name: Check (MSRV)
         run: cargo check --workspace --locked
@@ -62,7 +61,7 @@ jobs:
     name: Supply-chain audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: cargo-deny (advisories, bans, licenses, sources)
         uses: EmbarkStudios/cargo-deny-action@v2
         with:
@@ -72,6 +71,6 @@ jobs:
     name: Docker image builds
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build image
         run: docker build -t fleet-router:ci .
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 832c05d..1602a81 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,38 +16,54 @@ jobs:
     name: Publish to crates.io
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Publish
-        run: cargo publish -p fleet-router --locked --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish --locked --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
-  binary:
-    name: Build Linux release binary
-    runs-on: ubuntu-latest
+  binaries:
+    name: Release binary (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
     steps:
-      - uses: actions/checkout@v4
-      - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang libclang-dev
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
       - uses: Swatinem/rust-cache@v2
       - name: Build
-        run: cargo build --release --locked
-      - name: Package (x86_64-unknown-linux-gnu)
-        run: tar -C target/release -czf fleet-router-${{ github.ref_name }}-x86_64-unknown-linux-gnu.tar.gz fleet-router
-      - name: Create GitHub Release
+        run: cargo build --release --locked --target ${{ matrix.target }}
+      - name: Package (Unix)
+        if: runner.os != 'Windows'
+        run: tar -C target/${{ matrix.target }}/release -czf fleet-router-${{ github.ref_name }}-${{ matrix.target }}.tar.gz fleet-router
+      - name: Package (Windows)
+        if: runner.os == 'Windows'
+        run: Compress-Archive -Path target/${{ matrix.target }}/release/fleet-router.exe -DestinationPath fleet-router-${{ github.ref_name }}-${{ matrix.target }}.zip
+      - name: Upload to GitHub Release
         uses: softprops/action-gh-release@v2
         with:
-          files: fleet-router-*.tar.gz
+          files: |
+            fleet-router-*.tar.gz
+            fleet-router-*.zip
           generate_release_notes: true
 
   docker:
     name: Build and push image to GHCR
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
         uses: docker/login-action@v3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9bb9cdd..fcab409 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -39,6 +39,9 @@ First public release on crates.io and GitHub.
 
 ### Changed
 
+- Build on the pure-Rust `rs_abieos` backend (`rust-backend`): fleet-router now
+  compiles on **Linux, macOS, and Windows** (x86_64 and arm64) with no C/C++
+  toolchain, `clang`, or `libclang`.
 - The CLI `--version` now derives from `Cargo.toml` (`CARGO_PKG_VERSION`).
 - The connection counter is now an atomic, decremented synchronously and
   underflow-safely when a connection ends.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7d72b90..eb35152 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,27 +13,14 @@ project spaces and interactions.
 
 ## Prerequisites
 
-fleet-router builds on **Linux x86_64 only**. The `rs_abieos` build script
-panics with "Unsupported OS" on macOS and Windows. On those platforms, use the
-published Docker image (`ghcr.io/eosrio/fleet-router`) instead of a native
-build.
+fleet-router is pure Rust and builds on **Linux, macOS, and Windows** (x86_64
+and arm64) — no C/C++ toolchain, `clang`, or `libclang` required. See the
+[Requirements section in the README](README.md#requirements-and-supported-platforms).
 
-You need the following to build from source. See the
-[Requirements section in the README](README.md#requirements-and-supported-platforms) for the full
-rationale.
+You need:
 
-- Linux x86_64
+- Rust **1.95+** (the Minimum Supported Rust Version, required by `rs_abieos`)
 - `git`
-- A C/C++ toolchain plus `clang` and `libclang-dev` (the `rs_abieos` build
-  script compiles vendored C++ and uses `bindgen`, which needs `libclang`)
-- Rust **1.85+** (the Minimum Supported Rust Version — a transitive dependency
-  uses the 2024 edition)
-
-On Debian/Ubuntu, install the system packages with:
-
-```bash
-sudo apt-get install -y git clang libclang-dev build-essential
-```
 
 Install Rust via [rustup](https://rustup.rs/) if you do not already have a
 toolchain:
@@ -52,10 +39,8 @@ cd fleet-router
 cargo build
 ```
 
-The first build compiles the vendored C++ in `rs_abieos`, so expect it to take
-longer than a typical Rust build. `Cargo.lock` is committed; CI and releases
-build with `--locked`, so do not delete or regenerate it unless your change
-intentionally updates dependencies.
+`Cargo.lock` is committed; CI and releases build with `--locked`, so do not
+delete or regenerate it unless your change intentionally updates dependencies.
 
 ## Testing
 
@@ -99,8 +84,9 @@ Notes:
 - `cargo fmt --all` reformats your changes. CI runs `cargo fmt --all -- --check`
   and fails if anything is unformatted.
 - Clippy must be clean: `-D warnings` turns every warning into an error.
-- CI runs these commands with `--locked` and also runs an MSRV check against
-  Rust 1.85, a `cargo-deny` supply-chain scan (advisories, bans, licenses,
+- CI runs these commands with `--locked` across Linux, macOS, and Windows, and
+  also runs an MSRV check against Rust 1.95, a `cargo-deny` supply-chain scan
+  (advisories, bans, licenses,
   sources), and a Docker image build. Keeping the three commands above green
   locally covers the parts you are most likely to break.
 
diff --git a/Cargo.lock b/Cargo.lock
index 6dab983..3c60c5a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -94,26 +94,6 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
-[[package]]
-name = "bindgen"
-version = "0.72.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
-dependencies = [
- "bitflags",
- "cexpr",
- "clang-sys",
- "itertools",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex 1.3.0",
- "syn",
-]
-
 [[package]]
 name = "bitflags"
 version = "2.11.1"
@@ -148,18 +128,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
 dependencies = [
  "find-msvc-tools",
- "jobserver",
- "libc",
- "shlex 2.0.1",
-]
-
-[[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom",
+ "shlex",
 ]
 
 [[package]]
@@ -181,17 +150,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "clang-sys"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
-dependencies = [
- "glob",
- "libc",
- "libloading",
-]
-
 [[package]]
 name = "clap"
 version = "4.6.1"
@@ -334,12 +292,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "either"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
-
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -576,12 +528,6 @@ dependencies = [
  "wasip3",
 ]
 
-[[package]]
-name = "glob"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
-
 [[package]]
 name = "h2"
 version = "0.4.14"
@@ -895,31 +841,12 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
-[[package]]
-name = "itertools"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
-[[package]]
-name = "jobserver"
-version = "0.1.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
-dependencies = [
- "getrandom 0.3.4",
- "libc",
-]
-
 [[package]]
 name = "js-sys"
 version = "0.3.99"
@@ -950,16 +877,6 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
-[[package]]
-name = "libloading"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
-dependencies = [
- "cfg-if",
- "windows-link",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -1271,18 +1188,6 @@ dependencies = [
  "bitflags",
 ]
 
-[[package]]
-name = "regex"
-version = "1.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
 [[package]]
 name = "regex-automata"
 version = "0.4.14"
@@ -1356,20 +1261,9 @@ dependencies = [
 
 [[package]]
 name = "rs_abieos"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "323965b3f6a82e210c8c500efc3c61307af25a47e9d0f2a60a79af70e12afcdb"
-dependencies = [
- "bindgen",
- "cc",
- "sys-info",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "2.1.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "e5395074aa1a04cf96dc8321dd137ad3eb92afebf35fea9d187502931083a1c5"
 
 [[package]]
 name = "rustix"
@@ -1548,12 +1442,6 @@ dependencies = [
  "lazy_static",
 ]
 
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -1641,16 +1529,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "sys-info"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b3a0d0aba8bf96a0e1ddfdc352fc53b3df7f39318c71854910c3c4b024ae52c"
-dependencies = [
- "cc",
- "libc",
-]
-
 [[package]]
 name = "system-configuration"
 version = "0.7.0"
diff --git a/Cargo.toml b/Cargo.toml
index f62c4de..5637b9b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ members = [".", "mock-ship"]
 name = "fleet-router"
 version = "0.2.0"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.95"
 description = "Reverse proxy and load balancer for the Antelope SHiP (State History Plugin) WebSocket protocol."
 authors = ["Igor Lins e Silva", "EOS Rio"]
 repository = "https://github.com/eosrio/fleet-router"
@@ -33,7 +33,7 @@ chrono = "0.4.37"
 clap = { version = "4.5.4", features = ["derive", "string", "wrap_help", "unicode"] }
 color-print = "0.3.5"
 futures = { version = "0.3.30", features = ["compat"] }
-rs_abieos = "0.3.0"
+rs_abieos = { version = "0.5.0", default-features = false, features = ["rust-backend"] }
 serde = { version = "1.0.197", features = ["derive"] }
 serde_json = "1.0.115"
 tokio = { version = "1.37.0", features = ["full"] }
diff --git a/Dockerfile b/Dockerfile
index 20dcca5..45b1187 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,5 @@
-# Fleet Router — multi-stage build.
-# Note: builds on Linux only (rs_abieos compiles vendored C++ via bindgen and
-# requires clang/libclang).
-FROM rust:1.85-bookworm AS builder
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends clang libclang-dev && \
-    apt-get clean && rm -rf /var/lib/apt/lists/*
+# Fleet Router — multi-stage build. Pure-Rust: no C/C++ toolchain required.
+FROM rust:1.95-bookworm AS builder
 WORKDIR /build
 COPY . .
 RUN cargo build --release --locked
diff --git a/README.md b/README.md
index ba2bf9d..f4876a9 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ A reverse proxy and load balancer for the Antelope **SHiP** (State History Plugi
 
 Use it when you run more than one SHiP node and want clients (Hyperion, dfuse-style indexers, custom consumers) to see a single, resilient endpoint with load balancing and automatic failover, instead of pinning each consumer to one node.
 
-It is written in Rust on [tokio](https://tokio.rs/) and [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite), and uses [rs_abieos](https://github.com/eosrio/rs-abieos) (C++ FFI) for ABI handling.
+It is written in Rust on [tokio](https://tokio.rs/) and [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite), and uses [rs_abieos](https://github.com/eosrio/rs-abieos) (pure-Rust backend) for ABI handling.
 
 ## Features
 
@@ -42,25 +42,13 @@ A client connects over WebSocket. The router selects an upstream (range-aware, t
 
 ## Requirements and supported platforms
 
-**Linux x86_64 only.** The `rs_abieos` build script panics with *"Unsupported OS"* on macOS and Windows. On those platforms, use the [Docker image](#docker) instead of a native build.
-
-A native build compiles vendored C++ via a build script and uses `bindgen`, so you need a C/C++ toolchain plus `clang`/`libclang`:
+fleet-router is **pure Rust** and builds on **Linux, macOS, and Windows** (x86_64 and arm64) — no C/C++ toolchain, `clang`, or `libclang` required. The only prerequisite is a Rust toolchain.
 
 | Requirement | Notes |
 |---|---|
-| Linux x86_64 | Only supported native target |
-| Rust ≥ 1.85 (MSRV) | A transitive dependency uses the Rust 2024 edition |
-| `git` | To clone and build from source |
-| C/C++ toolchain | Debian/Ubuntu: `build-essential` |
-| `clang` + `libclang-dev` | Required by `bindgen` |
-
-On Debian/Ubuntu, install the prerequisites with:
-
-```bash
-sudo apt-get install -y git clang libclang-dev build-essential
-```
+| Rust ≥ 1.95 (MSRV) | Required by `rs_abieos` (uses `if let` guards, stabilized in Rust 1.95) |
 
-If you do not already have Rust:
+If you do not already have Rust, install it via [rustup](https://rustup.rs/):
 
 ```bash
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
@@ -68,8 +56,6 @@ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
 
 ## Installation
 
-> Native builds (crates.io or from source) require the [prerequisites above](#requirements-and-supported-platforms) to be installed first. macOS/Windows users should use the Docker image.
-
 ### From crates.io
 
 ```bash
@@ -268,7 +254,7 @@ The image runs as a non-root user and defines a `HEALTHCHECK` against port `1700
 
 - Transport is **plaintext `ws://`** on both the client listener and the upstream connections. No TLS / `wss://` is compiled in.
 - The client listener is **unauthenticated** — anyone who can reach the port can stream data.
-- `rs_abieos` parses untrusted upstream bytes through C++ FFI. Treat your upstreams as part of the trust boundary.
+- `rs_abieos` (pure Rust) parses untrusted upstream data; treat your upstreams as part of the trust boundary.
 
 Because of the above:
 
diff --git a/SECURITY.md b/SECURITY.md
index bc7e138..9506f23 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -72,8 +72,8 @@ encryption and access control.
 ### Trust boundary
 
 Upstream SHiP nodes are part of the trust boundary. fleet-router parses bytes
-received from upstreams through `rs_abieos`, a C++ library reached via FFI.
-Only point fleet-router at upstream nodes you operate or otherwise trust.
+received from upstreams via `rs_abieos` (pure-Rust backend). Only point
+fleet-router at upstream nodes you operate or otherwise trust.
 
 ### In scope
 
diff --git a/tests/e2e_proxy.rs b/tests/e2e_proxy.rs
index b952661..a1ae2df 100644
--- a/tests/e2e_proxy.rs
+++ b/tests/e2e_proxy.rs
@@ -89,19 +89,10 @@ impl FleetRouterProcess {
     }
 
     fn find_binary() -> String {
-        // Try debug build first, then release
-        let debug_path = "target/debug/fleet-router";
-        let release_path = "target/release/fleet-router";
-        if std::path::Path::new(debug_path).exists() {
-            debug_path.to_string()
-        } else if std::path::Path::new(release_path).exists() {
-            release_path.to_string()
-        } else {
-            panic!(
-                "fleet-router binary not found. Run `cargo build` first.\n  Checked: {} and {}",
-                debug_path, release_path
-            );
-        }
+        // Cargo builds the binary before running this integration test and sets
+        // CARGO_BIN_EXE_<name> to its absolute path, with the platform's
+        // executable extension (e.g. `.exe` on Windows).
+        env!("CARGO_BIN_EXE_fleet-router").to_string()
     }
 
     fn ws_url(&self) -> String {
diff --git a/tests/operational.rs b/tests/operational.rs
index 8d5a2ff..162b0b8 100644
--- a/tests/operational.rs
+++ b/tests/operational.rs
@@ -10,12 +10,10 @@ use mock_ship::{MockShipConfig, MockShipServer};
 use tokio::time::sleep;
 
 fn find_binary() -> String {
-    for path in ["target/debug/fleet-router", "target/release/fleet-router"] {
-        if std::path::Path::new(path).exists() {
-            return path.to_string();
-        }
-    }
-    panic!("fleet-router binary not found. Run `cargo build` first.");
+    // Cargo builds the binary before running this integration test and sets
+    // CARGO_BIN_EXE_<name> to its absolute path, with the platform's executable
+    // extension (e.g. `.exe` on Windows).
+    env!("CARGO_BIN_EXE_fleet-router").to_string()
 }
 
 fn free_port() -> u16 {