[WeiqiNs]

Follow-ups to #2, consolidated here (replaces #3, #4 and #5).

CI and dependencies

• Removes Dependabot. It immediately opened Bump rand from 0.8.8 to 0.10.3 #3 (rand 0.8 → 0.10) and Bump dtolnay/rust-toolchain from 1.86.0 to 1.120.0 #4 (a bump of the pinned MSRV toolchain), and neither can work: rand has to stay on 0.8 to match the Rng trait arkworks 0.6 uses.
• Drops the minimum-supported-Rust-version promise: removes rust-version = "1.86", the MSRV CI job, and the README line. CI tests the latest stable Rust only.
• Goes back to u64::bit_width / usize::bit_width in place of the private helper that only existed for 1.86.
• Re-resolves Cargo.lock to current releases. cargo-deny now notes a duplicate syn (2 and 3, build-time only); it is a warning, not a failure.

README

• Cites the published papers instead of the ePrint preprints: Boneh et al., CRYPTO 2019 (doi:10.1007/978-3-030-26954-8_3), and PEAR, PoPETs 2025 issue 4 (doi:10.56553/popets-2025-0171). Drops the "Theorem 4.3" reference, which followed the ePrint numbering.
• Adds a measured figure from cargo bench --bench flp: proving a 1,024-entry one-hot vector takes about 1.5 ms and verifying it about 0.12 ms on one core of an AMD Ryzen 7 9800X3D.

Fix from a full review of the repo

• RangeProduct and SetProduct passed their u64 constants through F::from unchecked, so a custom circuit over a field under 64 bits accepted values congruent to an out-of-field constant (e.g. SetProduct { values: {p} } accepted 0 over Goldilocks). Gadget now has a check_params hook that Flp::new runs for every gadget; the two product gadgets check their largest constant and ParallelSum delegates. Pinned by custom_gadgets_reject_constants_beyond_the_field, which fails if the hook call is removed.

Docs and CI

• Adds CLAUDE.md: commands, layout, the prove/query/decide flow, how to add a circuit, and design facts with the tests that pin them.
• README: quotes query construction (~0.6 ms) alongside proving and checking, says to generate a fresh query per proof, and notes MeanVariance's range check.
• CI runs weekly as well (catches new advisories without Dependabot) and runs the test suite with --features parallel. The published package excludes CI and lint configuration.

Local checks: fmt, clippy (with and without parallel), 39 tests (with and without parallel), the coverage gate, cargo-deny, cargo-machete, docs, the benchmark smoke run, both examples, and cargo publish --dry-run all pass.

🤖 Generated with Claude Code

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️