The Linux app segfaulted when opening the encrypted DB. Root cause: on Linux we
overrode package:sqlite3 to the SYSTEM libsqlcipher.so, but sqlcipher_flutter_libs
statically links its own SQLCipher into libsqlcipher_flutter_libs_plugin.so and
exports the sqlite3_* symbols globally. Two SQLite/SQLCipher builds loaded in one
process → symbol clash → segfault at sqlite3_open (before PRAGMA key).
Fix: _openLinuxCipher() now prefers the ABI-matched bundled plugin .so
(libsqlcipher_flutter_libs_plugin.so), falling back to the system lib only if the
plugin isn't present (e.g. host test/CI layouts). Android is unaffected (uses the
bundled Android lib as before).
Verified: Linux desktop build runs without crashing; full suite 37/37, and the
"no plaintext at rest" test now runs (not skipped) on the dev host with system
libsqlcipher, confirming real encryption.
Add a small curated catalog of Iberian horticultural species and let a variety
be linked to it from the edit sheet.
- assets/catalog/species.json: 14 species with botanical family and ES/EN
common names (wikidata_qid/gbif_key deferred to the varilla enrichment).
- SpeciesRepository: idempotent seedBundled (is_bundled rows, keyed by
scientific name) + search by scientific/common name with a locale-best label.
Seeded on startup from DI.
- VarietyRepository.linkSpecies: sets species_id and prefills category from the
species' family when empty (never overwrites an existing category).
VarietyDetail now carries the scientific name.
- Edit sheet gains a live species-search field; the detail view shows the
scientific name (italic). i18n strings added (ES/EN).
Tests: catalog parse, idempotent seeding, search by scientific/common name,
linkSpecies prefill semantics, and a widget test for the autocomplete → link →
scientific-name-shown flow. Full suite: 32 passing, 0 skipped.
Stand up the Tanemaki monorepo and the first end-to-end vertical slice of
Block 1 (offline, encrypted inventory): add a seed → see it in a categorized,
searchable list → it persists → reopen and it's still there.
Architecture (state management like G1nkgo, adapted to Tane's reality):
- flutter_bloc (Cubit-first), but the encrypted Drift DB is the single source
of truth; cubits stream from repositories (no hydrated_bloc/Hive, which would
write plaintext at rest).
- get_it composition root; go_router; slang i18n (ES/EN, Weblate-friendly JSON).
Workspace & core:
- pub workspace: packages/commons_core (pure Dart) + apps/app_seeds (Flutter).
- commons_core primitives: UUIDv7 IdGen, Hybrid Logical Clock, Quantity value
type (+ plant-aware QuantityKind), IdentityService root-seed stub.
Data & security:
- Drift schemaVersion=1 with all 10 Block-1 tables + common CRDT columns
(HLC updated_at, last_author, tombstones); Movement append-only.
- SQLCipher via an injectable executor that refuses to open a plaintext DB;
DB key + root seed in the OS keystore (separate secrets).
- Exported drift_schema_v1.json + migration scaffold.
Tests (near-TDD; nothing merges without tests):
- commons_core units (24), Drift migration test, "no plaintext at rest"
security guard (runs where SQLCipher is present, skips otherwise),
repository, widget, full quick-add flow, file-reopen persistence, and a
no-hardcoded-strings i18n guard. GitLab CI: format + analyze + test + coverage.
Follow-on Block-1 stories (item detail/edit, species catalog, germination UI)
and all of Block 2 remain out of scope.
