feat: allow gem-free goldsmithing projects and add the Golden Key

[XxFran10xX]

Summary

• Goldsmithing projects with gem: 0 can now be finished. Before this change they failed at the branding step with "Could not create that item", because the output builder always needed an infused gem.
• A gem-free project gives the configured item as is. It gets no gem stat and no quality lore, so the item keeps its own lore. It still records the gold used, so recycling works the same as for jewelry.
• The menu, the not-ready messages and the finish summary leave out the tier, gem and stat-carry lines for these projects. They also need no tier:.
• Adds the Golden Key (m.keys.gold_key). Its recipe is rough 5, moldable 1, shiny 4. That is 10 gold, the same total as the greater-tier projects, in a mix no other project uses (picked at random).
• Test fix: jewelryCarriesScaledStatIntoFreshHistoryAndQualityLore now switches off the random gem-rarity boost added in v2.2.7. That boost made the test fail about 15% of the time.

Deploy note

Existing servers keep their own goldsmithing/projects.yml, so the gold_key entry has to be added there by hand.

Tests

• mvn clean verify passes locally. The two POSIX-permission tests in GoldsmithStationStoreTest were excluded because they only run on Linux.
• No coverage gaps in changed classes.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 620e19a9-ede8-4877-b02e-aed209c8e0d2

📥 Commits

Reviewing files that changed from the base of the PR and between fcc6a36 and 84df5ac.

📒 Files selected for processing (10)

• README.md
• src/main/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithInventoryManager.java
• src/main/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithStationManager.java
• src/main/java/net/tfminecraft/geminfusion/goldsmith/JewelryOutput.java
• src/main/java/net/tfminecraft/geminfusion/goldsmith/JewelryProject.java
• src/main/resources/goldsmithing/projects.yml
• src/test/java/net/tfminecraft/geminfusion/GemOutputTest.java
• src/test/java/net/tfminecraft/geminfusion/goldsmith/ConfigLoadersTest.java
• src/test/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithInventoryManagerTest.java
• src/test/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithStationManagerTest.java

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features

  • Added a Golden Key goldsmithing project that uses gold without requiring a gem and produces an item with no stats or quality.

• Improvements

  • Gold-only projects no longer show gem-tier requirements or stat-carry information. Missing-material messages now list only the requirements that apply.
  • Projects that require gems continue to show their tier requirements and report stat carry on completion.

Walkthrough

This change adds a gem-free goldsmithing project path. It defines the Gold Key recipe, creates configured output without gem infusion, and adjusts project loading, menu lore, prerequisite messages, craft reporting, and related tests.

Changes

Gem-free goldsmithing

Layer / File(s)	Summary
Define gem-free projects src/main/resources/goldsmithing/projects.yml, src/main/java/net/tfminecraft/geminfusion/goldsmith/JewelryProject.java, src/test/java/net/tfminecraft/geminfusion/goldsmith/ConfigLoadersTest.java, README.md	Adds the gold_key project with a gold-only recipe. Missing tiers still default to greater, but the warning now applies only to projects that require a gem. Configuration tests and the README describe the gem-free project behaviour.
Build output without a gem src/main/java/net/tfminecraft/geminfusion/goldsmith/JewelryOutput.java, src/test/java/net/tfminecraft/geminfusion/GemOutputTest.java	Gem-free projects now produce the configured base item without gem infusion. The result has zero stat carry and no quality. Tests cover output properties and missing configured output.
Update menu and station feedback src/main/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithInventoryManager.java, src/main/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithStationManager.java, src/test/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithInventoryManagerTest.java, src/test/java/net/tfminecraft/geminfusion/goldsmith/GoldsmithStationManagerTest.java	Gem-free projects no longer show tier lore. Prerequisite messages mention a gem only when one is required, and craft completion reports stat carry only for gem-requiring projects.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: ryanbarlow97

Merge Risk: ⚪ Minimal · up to 84df5

This change lets the Golden Key be crafted from gold alone and keeps the menus and station messages consistent with that. No concrete merge-blocking problem was found. One minor open question is whether the item library returns a fresh item on each lookup; the author may want to confirm this, but it does not block merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 84df5

Gem-free crafting retains the normal permission, ingredient and work requirements. Newly craftable outputs inherit an existing recovery weakness if completed station data survives output delivery. No permission bypass or additional authority conferred by the Golden Key was established; external item-provider and key-consumer behavior remain unverified.

Retained concerns

• Medium · reliability · inferred: Newly successful gem-free crafts inherit non-atomic output delivery and station retirement. If the delivered item survives while a saved ready station remains because deletion fails or execution is interrupted, recovery can permit another output from the same deposited ingredients. The ordering predates this PR; the changed exposure is its reachability for gem-free outputs. Ordinary sequential completion removes the station, and later saves retry stale-file cleanup. Actual replay and an attacker-triggerable failure were not demonstrated.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure is server-local station state and configured item production available through goldsmith interactions. Output paths come from server project configuration, not a player-supplied arbitrary path. No supplied implementation establishes whether the Golden Key grants access to other assets, services or privileged operations.

Trust Boundaries and Controls

• observed — The player interaction and menu-selection entrypoints retain goldsmith permission checks. The manager retains ingredient and work readiness checks before invoking output creation. Gem-free configuration intentionally removes gem validation, rather than bypassing it for gem-requiring projects. The public builder relies on its caller for readiness; external callers were not established.

Resilience and Maintainability Implications

• observed — Normal successful completion removes in-memory station and menu references and immediately attempts persisted deletion. Periodic saves also delete stale files. Failed deletion is logged without a durable terminal marker, so these controls prevent ordinary repetition but do not establish exactly-once completion across persistence failures.

Hardening Proposals

• proposed — Make plain-output ownership explicit by requiring independently owned factory stacks or cloning before mutation. Separately, define an idempotent completion and recovery protocol that reconciles item delivery with durable station retirement; simply reversing the current ordering could exchange duplication risk for item loss.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}