tawasuyu/arje

- ente-journalctl: bin nuevo en ente-journald-compat. Lee
  ~/.local/share/ente/journal/index.log, parse timestamp:source:unit:sha,
  filtra --unit/--source/--since/--grep/--tail, restituye blobs desde CAS
  y formatea (pretty | --json). Default extrae MESSAGE de journald native.
- compat-machined: org.freedesktop.machine1.Manager con
  ListMachines/GetMachine/Register/Terminate. Lista vacía + NotFound —
  apps que llaman al boot ya no quedan en timeout.
- compat-polkit: query_policy() consulta el bus interno por el cap
  POLKIT_DECISION_IFACE con blob (pid_be|uid_be|action_id_utf8). Si hay
  proveedor su byte de respuesta gobierna; si no, default-allow.
  Anuncia POLKIT_SERVICE_IFACE (separado para evitar recursión).
- docs/gnome-boot-test.md: procedimiento end-to-end para arrancar GNOME
  con ente-zero como PID 1 en QEMU. scripts/build-rootfs.sh overlaya
  binarios + symlink /init. scripts/run-vm.sh boot QEMU con KVM y GTK.
  docs/seed-gnome-test.k Card Semilla con genesis para 8 shims +
  dbus-daemon + NetworkManager + gdm.

8 compat-shims operativos en paralelo cubriendo: logind, hostnamed,
timedated, localed, journald, resolved, polkit, machined.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

diff --git a/Cargo.lock b/Cargo.lock
index 821713e..0d2edba 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -446,6 +446,19 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "ente-machined-compat"
+version = "0.0.1"
+dependencies = [
+ "anyhow",
+ "ente-bus",
+ "ente-card",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "zbus",
+]
+
 [[package]]
 name = "ente-polkit-compat"
 version = "0.0.1"
diff --git a/Cargo.toml b/Cargo.toml
index 8683fd4..99bef85 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,6 +18,7 @@ members = [
     "crates/ente-journald-compat",
     "crates/ente-resolved-compat",
     "crates/ente-polkit-compat",
+    "crates/ente-machined-compat",
 ]
 
 [workspace.package]
diff --git a/crates/ente-bus/src/lib.rs b/crates/ente-bus/src/lib.rs
index 2ce90a4..586df9c 100644
--- a/crates/ente-bus/src/lib.rs
+++ b/crates/ente-bus/src/lib.rs
@@ -18,6 +18,20 @@ pub const ENV_BUS_SOCK: &str = "ENTE_BUS_SOCK";
 pub const ENV_ENTE_ID: &str = "ENTE_ID";
 pub const MAX_FRAME: usize = 1 << 20; // 1 MiB — protección contra OOM
 
+/// Interface UUID para decisiones de policy. Un Ente independiente
+/// (separado de polkit-compat) se anuncia como proveedor de
+/// `Capability::Endpoint { interface: POLKIT_DECISION_IFACE, version: 1 }`
+/// para arbitrar autorizaciones. Recibe blob:
+/// `pid_be | uid_be | action_id_utf8` → responde 1 byte: 1=allow, 0=deny.
+pub const POLKIT_DECISION_IFACE: ente_card::InterfaceId =
+    ente_card::InterfaceId([0xb0; 16]);
+
+/// Interface UUID auto-anunciado por compat-polkit. Diferente al de
+/// decisión para evitar recursión (polkit-compat invoca DECISION pero
+/// no es proveedor de DECISION; se anuncia como SERVICE).
+pub const POLKIT_SERVICE_IFACE: ente_card::InterfaceId =
+    ente_card::InterfaceId([0xa4; 16]);
+
 /// Credenciales del peer extraídas vía SO_PEERCRED al accept del bus.
 /// Imposibles de falsear desde el cliente — el kernel las inyecta.
 /// Definidas aquí (no en ente-zero) porque conceptualmente son atributo
diff --git a/crates/ente-journald-compat/Cargo.toml b/crates/ente-journald-compat/Cargo.toml
index 9c8fc1f..c248dfe 100644
--- a/crates/ente-journald-compat/Cargo.toml
+++ b/crates/ente-journald-compat/Cargo.toml
@@ -9,6 +9,10 @@ publish.workspace = true
 name = "ente-journald-compat"
 path = "src/main.rs"
 
+[[bin]]
+name = "ente-journalctl"
+path = "src/journalctl.rs"
+
 [dependencies]
 ente-card = { path = "../ente-card" }
 ente-bus = { path = "../ente-bus" }
diff --git a/crates/ente-journald-compat/src/journalctl.rs b/crates/ente-journald-compat/src/journalctl.rs
new file mode 100644
index 0000000..c282228
--- /dev/null
+++ b/crates/ente-journald-compat/src/journalctl.rs
@@ -0,0 +1,197 @@
+//! ente-journalctl: query CLI sobre el journal persistido en CAS.
+//!
+//! Lee el index `~/.local/share/ente/journal/index.log` (líneas
+//! `timestamp_ms:source:unit:sha_hex`), filtra, y para cada match
+//! restituye el blob desde CAS y lo imprime.
+//!
+//! Uso:
+//!   ente-journalctl                       # todo el journal
+//!   ente-journalctl --unit foo.service    # filtra por unit
+//!   ente-journalctl --since 60            # últimos 60 segundos
+//!   ente-journalctl --grep "panic"        # contiene "panic"
+//!   ente-journalctl --tail 20             # últimas 20 entries
+//!   ente-journalctl --json                # output JSON-lines
+
+use std::path::PathBuf;
+
+struct Args {
+    unit: Option<String>,
+    since_secs: Option<u64>,
+    grep: Option<String>,
+    tail: Option<usize>,
+    source: Option<String>,
+    json: bool,
+}
+
+fn parse_args() -> Args {
+    let mut args = std::env::args().skip(1);
+    let mut a = Args {
+        unit: None, since_secs: None, grep: None, tail: None, source: None, json: false,
+    };
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--unit" | "-u" => a.unit = args.next(),
+            "--since" | "-S" => a.since_secs = args.next().and_then(|s| s.parse().ok()),
+            "--grep" | "-g" => a.grep = args.next(),
+            "--tail" | "-n" => a.tail = args.next().and_then(|s| s.parse().ok()),
+            "--source" => a.source = args.next(),
+            "--json" => a.json = true,
+            "-h" | "--help" => { print_help(); std::process::exit(0); }
+            other => {
+                eprintln!("argumento desconocido: {other}");
+                print_help();
+                std::process::exit(2);
+            }
+        }
+    }
+    a
+}
+
+fn print_help() {
+    eprintln!("ente-journalctl — query CLI del journal persistido en CAS");
+    eprintln!();
+    eprintln!("Filtros:");
+    eprintln!("  --unit, -u <name>    Filtra por unidad (e.g. foo.service)");
+    eprintln!("  --source <s>         journal | syslog");
+    eprintln!("  --since, -S <secs>   Sólo últimos N segundos");
+    eprintln!("  --grep, -g <text>    Contiene <text> en el body decoded");
+    eprintln!("  --tail, -n <N>       Últimas N entries");
+    eprintln!("Output:");
+    eprintln!("  --json               JSON-lines en lugar de pretty");
+}
+
+fn index_path() -> PathBuf {
+    let base = if let Ok(d) = std::env::var("XDG_DATA_HOME") { d }
+        else if let Ok(h) = std::env::var("HOME") { format!("{h}/.local/share") }
+        else { "/var/lib".into() };
+    PathBuf::from(base).join("ente").join("journal").join("index.log")
+}
+
+fn now_ms() -> u128 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis())
+        .unwrap_or(0)
+}
+
+#[derive(Debug)]
+struct IndexEntry {
+    timestamp_ms: u128,
+    source: String,
+    unit: String,
+    sha_hex: String,
+}
+
+fn parse_line(line: &str) -> Option<IndexEntry> {
+    let mut parts = line.splitn(4, ':');
+    let ts: u128 = parts.next()?.parse().ok()?;
+    let source = parts.next()?.to_string();
+    let unit = parts.next()?.to_string();
+    let sha = parts.next()?.to_string();
+    if sha.len() != 64 { return None; }
+    Some(IndexEntry { timestamp_ms: ts, source, unit, sha_hex: sha })
+}
+
+fn parse_sha(hex: &str) -> Option<[u8; 32]> {
+    if hex.len() != 64 { return None; }
+    let mut sha = [0u8; 32];
+    for i in 0..32 {
+        sha[i] = u8::from_str_radix(&hex[i*2..i*2+2], 16).ok()?;
+    }
+    Some(sha)
+}
+
+fn main() -> anyhow::Result<()> {
+    let args = parse_args();
+    let path = index_path();
+    if !path.exists() {
+        eprintln!("index no existe: {} — ¿journald-compat ha corrido?", path.display());
+        std::process::exit(1);
+    }
+    let raw = std::fs::read_to_string(&path)?;
+    let mut entries: Vec<IndexEntry> = raw.lines()
+        .filter_map(parse_line)
+        .collect();
+
+    // Filtros
+    let now = now_ms();
+    if let Some(secs) = args.since_secs {
+        let cutoff = now.saturating_sub(secs as u128 * 1000);
+        entries.retain(|e| e.timestamp_ms >= cutoff);
+    }
+    if let Some(unit) = &args.unit {
+        entries.retain(|e| &e.unit == unit);
+    }
+    if let Some(src) = &args.source {
+        entries.retain(|e| &e.source == src);
+    }
+    // tail después de filtros temporales/identidad pero antes de grep —
+    // grep es post porque requiere cargar bytes del CAS.
+
+    let mut out: Vec<(IndexEntry, String)> = entries.into_iter()
+        .filter_map(|e| {
+            let sha = parse_sha(&e.sha_hex)?;
+            let bytes = ente_cas::resolve(&sha).ok()?;
+            let body = String::from_utf8_lossy(&bytes).into_owned();
+            Some((e, body))
+        })
+        .collect();
+
+    if let Some(g) = &args.grep {
+        out.retain(|(_, body)| body.contains(g.as_str()));
+    }
+    if let Some(n) = args.tail {
+        let len = out.len();
+        if len > n { out.drain(..len - n); }
+    }
+
+    for (e, body) in out {
+        if args.json {
+            print_json(&e, &body);
+        } else {
+            print_pretty(&e, &body);
+        }
+    }
+    Ok(())
+}
+
+fn print_pretty(e: &IndexEntry, body: &str) {
+    let secs = e.timestamp_ms / 1000;
+    let ms = e.timestamp_ms % 1000;
+    let header = if e.unit == "-" {
+        format!("{}.{:03} [{}]", secs, ms, e.source)
+    } else {
+        format!("{}.{:03} [{}] {{{}}}", secs, ms, e.source, e.unit)
+    };
+    println!("{header}");
+    // Si es journald native (KEY=value lines), extraer MESSAGE.
+    if body.contains('=') && body.lines().any(|l| l.contains('=')) {
+        for line in body.lines() {
+            if let Some((k, v)) = line.split_once('=') {
+                if k.trim() == "MESSAGE" {
+                    println!("  {v}");
+                    return;
+                }
+            }
+        }
+    }
+    for line in body.trim_end().lines() {
+        println!("  {line}");
+    }
+}
+
+fn print_json(e: &IndexEntry, body: &str) {
+    // JSON-lines básico, sin dependencia de serde — formato simple y estable.
+    let escaped_body = body
+        .replace('\\', "\\\\")
+        .replace('"', "\\\"")
+        .replace('\n', "\\n")
+        .replace('\r', "\\r")
+        .replace('\t', "\\t");
+    let unit_field = if e.unit == "-" { "null".to_string() }
+        else { format!("\"{}\"", e.unit) };
+    println!(
+        r#"{{"timestamp_ms":{},"source":"{}","unit":{},"sha":"{}","body":"{}"}}"#,
+        e.timestamp_ms, e.source, unit_field, e.sha_hex, escaped_body
+    );
+}
diff --git a/crates/ente-machined-compat/Cargo.toml b/crates/ente-machined-compat/Cargo.toml
new file mode 100644
index 0000000..eb88b4a
--- /dev/null
+++ b/crates/ente-machined-compat/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "ente-machined-compat"
+version = "0.0.1"
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[[bin]]
+name = "ente-machined-compat"
+path = "src/main.rs"
+
+[dependencies]
+ente-card = { path = "../ente-card" }
+ente-bus = { path = "../ente-bus" }
+anyhow = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+zbus = { version = "4", default-features = false, features = ["tokio"] }
diff --git a/crates/ente-machined-compat/src/main.rs b/crates/ente-machined-compat/src/main.rs
new file mode 100644
index 0000000..4ad7e00
--- /dev/null
+++ b/crates/ente-machined-compat/src/main.rs
@@ -0,0 +1,186 @@
+//! ente-machined-compat: shim de `org.freedesktop.machine1`.
+//!
+//! systemd-machined trackea VMs y containers (typically managed por systemd-nspawn).
+//! En el fractal cada Ente con namespaces es candidato a "machine", pero la
+//! correspondencia no es 1:1 — un Ente puede tener menos aislamiento que una
+//! container completa.
+//!
+//! Este shim devuelve listas vacías para no romper clientes (gnome-boxes,
+//! virt-manager, etc) que llaman a `ListMachines` durante boot. Métodos de
+//! mutación (RegisterMachine, KillMachine) se aceptan como no-op con audit
+//! log via tracing.
+//!
+//! Producción real: integrar con el graph del fractal — ListMachines query
+//! BusRequest::ListEntes filtrado por `card.soma.namespaces.pid`.
+
+use ente_bus::{BusClient, BusRequest, BusResponse};
+use ente_card::Capability;
+use std::collections::HashMap;
+use tokio::signal::unix::{signal, SignalKind};
+use tracing::{info, warn};
+use tracing_subscriber::EnvFilter;
+use zbus::{fdo, interface, zvariant::OwnedValue};
+
+const BUS_NAME: &str = "org.freedesktop.machine1";
+const OBJ_PATH: &str = "/org/freedesktop/machine1";
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> anyhow::Result<()> {
+    init_tracing();
+    info!("ente-machined-compat: arrancando");
+    announce_to_fractal().await;
+
+    let manager = MachineManager;
+    let conn_result = zbus::connection::Builder::system()
+        .and_then(|b| b.name(BUS_NAME))
+        .and_then(|b| b.serve_at(OBJ_PATH, manager));
+    match conn_result {
+        Ok(builder) => match builder.build().await {
+            Ok(_conn) => {
+                info!(name = BUS_NAME, "name acquired, sirviendo");
+                wait_for_term().await
+            }
+            Err(e) => { warn!(?e, "build conn falló — modo idle"); wait_for_term().await }
+        },
+        Err(e) => { warn!(?e, "builder D-Bus falló — modo idle"); wait_for_term().await }
+    }
+}
+
+struct MachineManager;
+
+/// Tipo del wire format de ListMachines: `(s, s, s, u, ay, ay, t, ay)` —
+/// name, class, service, leader_pid, root_directory_path, id_unix, time_obtained,
+/// machine_id_bytes. systemd usa este struct simplificado.
+type Machine = (String, String, String, u32, String);
+
+#[interface(name = "org.freedesktop.machine1.Manager")]
+impl MachineManager {
+    /// Lista vacía — no trackeamos containers todavía.
+    async fn list_machines(&self) -> fdo::Result<Vec<Machine>> {
+        Ok(vec![])
+    }
+
+    /// Devuelve siempre NotFound — sin machines registradas.
+    async fn get_machine(&self, name: String) -> fdo::Result<zbus::zvariant::OwnedObjectPath> {
+        Err(fdo::Error::Failed(format!("machine '{name}' no encontrada")))
+    }
+
+    async fn get_machine_by_pid(&self, pid: u32) -> fdo::Result<zbus::zvariant::OwnedObjectPath> {
+        Err(fdo::Error::Failed(format!("PID {pid} no asociado a ninguna machine")))
+    }
+
+    async fn register_machine(
+        &self,
+        name: String,
+        _id: Vec<u8>,
+        _service: String,
+        class: String,
+        _leader_pid: u32,
+        _root_directory: String,
+    ) -> fdo::Result<zbus::zvariant::OwnedObjectPath> {
+        info!(%name, %class, "RegisterMachine (no-op)");
+        Err(fdo::Error::NotSupported(
+            "RegisterMachine no implementado — usar Cards del fractal".into()
+        ))
+    }
+
+    async fn register_machine_with_network(
+        &self,
+        name: String,
+        id: Vec<u8>,
+        service: String,
+        class: String,
+        leader_pid: u32,
+        root_directory: String,
+        _network_interfaces: Vec<i32>,
+    ) -> fdo::Result<zbus::zvariant::OwnedObjectPath> {
+        self.register_machine(name, id, service, class, leader_pid, root_directory).await
+    }
+
+    async fn create_machine(
+        &self,
+        name: String,
+        _id: Vec<u8>,
+        _service: String,
+        class: String,
+        _leader_pid: u32,
+        _root_directory: String,
+        _scope_properties: Vec<(String, OwnedValue)>,
+    ) -> fdo::Result<zbus::zvariant::OwnedObjectPath> {
+        info!(%name, %class, "CreateMachine (no-op)");
+        Err(fdo::Error::NotSupported(
+            "CreateMachine no implementado".into()
+        ))
+    }
+
+    async fn terminate_machine(&self, name: String) -> fdo::Result<()> {
+        info!(%name, "TerminateMachine (no-op)");
+        Ok(())
+    }
+
+    async fn kill_machine(&self, name: String, _who: String, _signal: i32) -> fdo::Result<()> {
+        info!(%name, "KillMachine (no-op)");
+        Ok(())
+    }
+
+    async fn get_machine_address(&self, name: String) -> fdo::Result<Vec<(i32, Vec<u8>)>> {
+        warn!(%name, "GetMachineAddress (sin tracking, devuelvo vacío)");
+        Ok(vec![])
+    }
+
+    async fn get_machine_osrelease(&self, name: String) -> fdo::Result<HashMap<String, String>> {
+        warn!(%name, "GetMachineOSRelease (sin tracking)");
+        Ok(HashMap::new())
+    }
+
+    /// Operaciones sobre la "host machine" (PID 1 namespace) — siempre
+    /// disponibles. Usamos el path canónico `/org/freedesktop/machine1/machine/_host`.
+    async fn open_machine_login(&self, _name: String) -> fdo::Result<(zbus::zvariant::OwnedObjectPath, zbus::zvariant::OwnedFd)> {
+        Err(fdo::Error::NotSupported(
+            "OpenMachineLogin no implementado".into()
+        ))
+    }
+
+    async fn open_machine_shell(
+        &self,
+        _name: String,
+        _user: String,
+        _path: String,
+        _args: Vec<String>,
+        _environment: Vec<String>,
+    ) -> fdo::Result<(zbus::zvariant::OwnedObjectPath, zbus::zvariant::OwnedFd)> {
+        Err(fdo::Error::NotSupported("OpenMachineShell no implementado".into()))
+    }
+}
+
+async fn announce_to_fractal() {
+    if let Ok(mut client) = BusClient::from_env().await {
+        let req = BusRequest::Announce {
+            capabilities: vec![Capability::Endpoint {
+                interface: ente_card::InterfaceId([0xa5; 16]),
+                version: 1,
+            }],
+        };
+        match client.call(req).await {
+            Ok(BusResponse::Ok) => info!("Announce → bus interno OK"),
+            Ok(other) => warn!(?other, "Announce respuesta inesperada"),
+            Err(e) => warn!(?e, "Announce falló"),
+        }
+    }
+}
+
+async fn wait_for_term() -> anyhow::Result<()> {
+    let mut term = signal(SignalKind::terminate())?;
+    let mut int_ = signal(SignalKind::interrupt())?;
+    tokio::select! {
+        _ = term.recv() => info!("SIGTERM"),
+        _ = int_.recv() => info!("SIGINT"),
+    }
+    Ok(())
+}
+
+fn init_tracing() {
+    let filter = EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| EnvFilter::new("ente_machined_compat=info"));
+    tracing_subscriber::fmt().with_env_filter(filter).with_target(true).init();
+}
diff --git a/crates/ente-polkit-compat/src/main.rs b/crates/ente-polkit-compat/src/main.rs
index 96fd8c1..53b411c 100644
--- a/crates/ente-polkit-compat/src/main.rs
+++ b/crates/ente-polkit-compat/src/main.rs
@@ -14,11 +14,11 @@
 //! CheckAuthorization solicita un token al graph y devuelve true/false
 //! según el resultado.
 
-use ente_bus::{BusClient, BusRequest, BusResponse};
+use ente_bus::{BusClient, BusRequest, BusResponse, POLKIT_DECISION_IFACE, POLKIT_SERVICE_IFACE};
 use ente_card::Capability;
 use std::collections::HashMap;
 use tokio::signal::unix::{signal, SignalKind};
-use tracing::{info, warn};
+use tracing::{debug, info, warn};
 use tracing_subscriber::EnvFilter;
 use zbus::{fdo, interface, zvariant::OwnedValue};
 
@@ -73,9 +73,12 @@ impl PolkitAuthority {
             .and_then(|v| u32::try_from(v).ok());
         let uid = subj_details.get("uid")
             .and_then(|v| u32::try_from(v).ok());
-        info!(%action_id, %subj_kind, ?pid, ?uid, "CheckAuthorization → ALLOW");
-        // Always-yes: fractal confía en todos sus Entes (auth real está en el bus).
-        Ok((true, false, HashMap::new()))
+
+        // Pregunta al bus interno del fractal si hay un policy provider.
+        // Si lo hay, su decisión gobierna. Si no (NoProvider), default = allow.
+        let decision = query_policy(&action_id, pid, uid).await;
+        info!(%action_id, %subj_kind, ?pid, ?uid, ?decision, "CheckAuthorization");
+        Ok((decision.allow, false, HashMap::new()))
     }
 
     async fn check_authorization_by_async(
@@ -175,11 +178,62 @@ type EnumeratedAction = (
 /// Aquí `(string)` * 5 + 2 timestamps. Simplificamos al subset relevante.
 type TemporaryAuth = (String, String, (String, HashMap<String, OwnedValue>), u64, u64);
 
+/// Resultado de una consulta de policy al fractal.
+#[derive(Debug)]
+struct PolicyDecision {
+    allow: bool,
+    /// Origen: "fractal" si vino del bus, "default-allow" si no había proveedor.
+    source: &'static str,
+}
+
+/// Pregunta al bus interno: ¿hay alguien que decida sobre `action_id`?
+/// Wire format del blob: `pid_u32_be | uid_u32_be | action_id_utf8`.
+/// El proveedor responde con `Invoked { result: [0|1] }` — 1 = allow.
+async fn query_policy(action_id: &str, pid: Option<u32>, uid: Option<u32>) -> PolicyDecision {
+    let mut blob = Vec::with_capacity(8 + action_id.len());
+    blob.extend_from_slice(&pid.unwrap_or(0).to_be_bytes());
+    blob.extend_from_slice(&uid.unwrap_or(0).to_be_bytes());
+    blob.extend_from_slice(action_id.as_bytes());
+
+    let mut client = match BusClient::from_env().await {
+        Ok(c) => c,
+        Err(e) => {
+            debug!(?e, "no bus client — default allow");
+            return PolicyDecision { allow: true, source: "no-bus" };
+        }
+    };
+    let req = BusRequest::Invoke {
+        cap: Capability::Endpoint {
+            interface: POLKIT_DECISION_IFACE,
+            version: 1,
+        },
+        blob,
+    };
+    match client.call(req).await {
+        Ok(BusResponse::Invoked { result }) => {
+            let allow = result.first().copied().unwrap_or(1) != 0;
+            PolicyDecision { allow, source: "fractal" }
+        }
+        Ok(BusResponse::Error(msg)) if msg.contains("sin proveedor") => {
+            // No hay policy provider — default allow.
+            PolicyDecision { allow: true, source: "default-allow" }
+        }
+        Ok(other) => {
+            warn!(?other, "policy: respuesta inesperada — default allow");
+            PolicyDecision { allow: true, source: "default-allow" }
+        }
+        Err(e) => {
+            warn!(?e, "policy: bus call falló — default allow");
+            PolicyDecision { allow: true, source: "default-allow" }
+        }
+    }
+}
+
 async fn announce_to_fractal() {
     if let Ok(mut client) = BusClient::from_env().await {
         let req = BusRequest::Announce {
             capabilities: vec![Capability::Endpoint {
-                interface: ente_card::InterfaceId([0xa4; 16]),
+                interface: POLKIT_SERVICE_IFACE,
                 version: 1,
             }],
         };
diff --git a/crates/ente-zero/src/seed.rs b/crates/ente-zero/src/seed.rs
index 06365ab..f424982 100644
--- a/crates/ente-zero/src/seed.rs
+++ b/crates/ente-zero/src/seed.rs
@@ -155,6 +155,7 @@ fn synthesize_dev_seed() -> EntityCard {
         ("compat-journald",  "target/debug/ente-journald-compat"),
         ("compat-resolved",  "target/debug/ente-resolved-compat"),
         ("compat-polkit",    "target/debug/ente-polkit-compat"),
+        ("compat-machined",  "target/debug/ente-machined-compat"),
     ] {
         if let Some(card) = optional_native_card(
             label, bin,
diff --git a/docs/gnome-boot-test.md b/docs/gnome-boot-test.md
new file mode 100644
index 0000000..bb04f06
--- /dev/null
+++ b/docs/gnome-boot-test.md
@@ -0,0 +1,164 @@
+# Boot test: GNOME bajo Ente #0 (sin systemd)
+
+Procedimiento para verificar que GNOME 45+ arranca con `ente-zero` como
+PID 1 y los 8 D-Bus shims (logind, hostnamed, timedated, localed,
+journald, resolved, polkit, machined) cubren las llamadas que el
+escritorio realiza durante la sesión.
+
+## Qué se prueba
+
+1. **PID 1 boot**: el kernel arranca, mounta initramfs, transfiere control
+   a `/init` que es `ente-zero` con la Card Semilla.
+2. **Genesis spawning**: ente-zero encarna el bus D-Bus (dbus-daemon),
+   los 8 compat-shims, NetworkManager, y gdm/sddm (display manager).
+3. **D-Bus interception**: los compat-shims toman los nombres
+   `org.freedesktop.{logind,hostname1,timedate1,locale1,resolve1,
+   PolicyKit1,machine1}` antes que cualquier sondeo de systemd.
+4. **GNOME session**: gdm autenticación → GNOME shell → settings panels
+   funcionan (Region & Language, Date & Time, About, Network).
+
+## Prerequisitos
+
+- QEMU (`qemu-system-x86_64`) con KVM.
+- Imagen base con kernel + GNOME instalados — sugerencia: una Arch Linux
+  o Fedora minimal modificada (más abajo). NixOS también es razonable.
+- ~10 GiB libre.
+
+## Esqueleto del rootfs
+
+`scripts/build-rootfs.sh` genera un overlay sobre una imagen base que:
+
+1. Compila el workspace en modo release (`cargo build --workspace --release`)
+2. Copia los binarios a `<rootfs>/usr/local/bin/`:
+   - `ente-zero`
+   - `ente-{logind,hostnamed,timedated,localed,journald,resolved,polkit,machined}-compat`
+   - `ente-echo`, `brainctl`, `busctl`, `ente-journalctl`
+3. Renombra el `/init` original a `/sbin/init.systemd` (backup)
+4. Symlink `/init` → `/usr/local/bin/ente-zero`
+5. Coloca la Card Semilla en `/ente/seed.card.k`
+6. Desinstala los services systemd que ahora son shims (logind, etc) o
+   los enmascara con `systemctl mask` (en la imagen base, antes de
+   reescribir `/init`)
+
+## Card Semilla para el boot test
+
+`/ente/seed.card.k` debe declarar como genesis los Entes esenciales:
+- D-Bus daemon (`/usr/bin/dbus-daemon --system`)
+- Los 8 compat-shims
+- NetworkManager
+- udev daemon (kernel events ya manejados por nuestro Netlink stream;
+  udev añade reglas de userspace — opcional)
+- gdm o sddm
+
+Ejemplo mínimo:
+
+```kcl
+import .card
+
+seed = EntityCard {
+    schema_version = 1
+    id = "01KQ_BOOT_SEED_GNOME_TEST_0"
+    label = "boot-gnome-test"
+    provides = [
+        Capability {kind = "Spawn"}
+        Capability {kind = "Journal"}
+    ]
+    soma = SomaSpec {}
+    payload = Payload {kind = "Virtual"}
+    supervision = Supervision {kind = "OneShot"}
+    genesis = [
+        # dbus-daemon — todo lo demás depende de él.
+        EntityCard {
+            schema_version = 1
+            id = "01KQ_BOOT_DBUS_DAEMON__________"
+            label = "dbus-daemon"
+            soma = SomaSpec {}
+            payload = Payload {
+                kind = "Native"
+                exec = "/usr/bin/dbus-daemon"
+                argv = ["--system", "--nofork"]
+            }
+            supervision = Supervision {
+                kind = "Restart"
+                initial_ms = 100
+                max_ms = 30000
+            }
+        }
+        # Aquí los 8 compat-shims (mismo patrón) ...
+        # Aquí gdm o sddm ...
+    ]
+}
+```
+
+## Boot
+
+```bash
+scripts/run-vm.sh /path/to/base.qcow2 /path/to/built-rootfs.iso
+```
+
+QEMU arranca con:
+- `-kernel` el kernel de la imagen base
+- `-initrd` (opcional) si la imagen no es bootable directa
+- `-append "init=/usr/local/bin/ente-zero rd.break=initqueue"` para
+  redirigir PID 1 desde el initramfs.
+- `-display gtk,gl=on` para ver la sesión gráfica.
+
+## Verificaciones
+
+### Console
+- ente-zero arranca como PID 1 (`/proc/1/comm` == `ente-zero`).
+- Genesis instancia los 8 shims: logs `Ente encarnado label=compat-X`.
+- D-Bus daemon responde: `busctl list` muestra los nombres tomados por
+  los shims (deberían aparecer como `org.freedesktop.X1`).
+
+### gdm
+- Llega al greeter — significa que polkit, logind, hostnamed responden.
+- Login funciona — verifica que `Inhibit`, `CreateSession`, `ListSessions`
+  no bloquean la pila de PAM.
+
+### GNOME shell
+- Settings → About: hostname y OS info pobladas (hostnamed properties).
+- Settings → Date & Time: timezone correcta (timedated).
+- Settings → Region & Language: locale actual visible (localed).
+- Settings → Network: NetworkManager opera, los DNS lookups funcionan
+  (resolved).
+- "Restart" en menú: invoca `org.freedesktop.login1.Reboot` → llega a
+  nuestro stub → log en journal.
+
+### Journal
+- `ente-journalctl --tail 100` muestra mensajes capturados durante el boot.
+- Filtros `--unit gdm.service` y `--source syslog` funcionan.
+
+## Limitaciones conocidas
+
+- **systemd-units**: GNOME no usa systemd unit files directamente, pero
+  algunas apps los crean dinámicamente (e.g., gnome-terminal con
+  `systemd-run --user`). Esas calls fallarán con NotSupported y la app
+  caerá a un fallback no-systemd.
+- **sd_notify**: services que usan `Type=notify` para anunciar readiness
+  fallan silenciosamente (NOTIFY_SOCKET no se setea). Reemplazables con
+  `Type=simple` y nuestro Supervision::Restart.
+- **systemd-tmpfiles**: tmpfiles.d no se procesa. Aplicar manualmente
+  o portar el comportamiento a un Ente.
+- **systemd journal binary export**: nuestro journal usa CAS por hash,
+  no el formato `.journal` binario. Apps que llamen
+  `journalctl --output=export` no son compatibles. `ente-journalctl`
+  cubre los casos típicos.
+
+## Plan de regresión
+
+Hacer boot test en CI tras cada cambio en los compat-shims:
+
+1. `cargo build --workspace --release`
+2. `scripts/build-rootfs.sh` (overlay sobre imagen base inmutable)
+3. `scripts/run-vm.sh --headless --timeout 120` con script de comprobación
+   automatizado (xdotool o similar, o screen-shotting).
+4. Capturar `dmesg` + `ente-journalctl` outputs como artefactos.
+
+Output esperado en stdout del test:
+```
+PASS: ente-zero como PID 1
+PASS: 8 compat-shims encarnados
+PASS: gdm greeter mostrado
+PASS: settings panels operativos
+```
diff --git a/docs/seed-gnome-test.k b/docs/seed-gnome-test.k
new file mode 100644
index 0000000..b68d1ab
--- /dev/null
+++ b/docs/seed-gnome-test.k
@@ -0,0 +1,155 @@
+# Card Semilla para el boot test de GNOME bajo Ente #0.
+#
+# Este archivo se valida con `kcl run` contra el schema en
+# crates/ente-card/schema/card.k antes de que ente-zero lo cargue.
+#
+# Genesis declara la constelación mínima para que GNOME arranque sin
+# systemd: D-Bus daemon, los 8 compat-shims, NetworkManager, gdm.
+
+import .ente_card.schema.card
+
+# Card "supervisor genérico" reutilizable — dispara un binario con Restart.
+schema NativeRestart(EnteBase):
+    soma = SomaSpec {
+        rlimits = ResourceLimits {nofile = 16384}
+    }
+    supervision = Supervision {
+        kind = "Restart"
+        initial_ms = 100
+        max_ms = 30000
+    }
+
+
+# ----- La Semilla -----
+
+seed = EntityCard {
+    schema_version = 1
+    id = "01KQABOOTTESTSEEDFRACTAL00"
+    label = "boot-gnome-test"
+    provides = [
+        Capability {kind = "Spawn"}
+        Capability {kind = "Journal"}
+    ]
+    soma = SomaSpec {}
+    payload = Payload {kind = "Virtual"}
+    supervision = Supervision {kind = "OneShot"}
+
+    genesis = [
+        # 1. dbus-daemon — pivote del system bus, todos los demás dependen de él.
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTDBUSDAEMON___"
+            label = "dbus-daemon"
+            soma = SomaSpec {}
+            payload = Payload {
+                kind = "Native"
+                exec = "/usr/bin/dbus-daemon"
+                argv = ["--system", "--nofork", "--nopidfile"]
+            }
+            supervision = Supervision {
+                kind = "Restart"
+                initial_ms = 100
+                max_ms = 30000
+            }
+        }
+
+        # 2-9. Los 8 compat-shims D-Bus.
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTLOGIND_______"
+            label = "compat-logind"
+            provides = [Capability {kind = "LegacyLogind"}]
+            soma = SomaSpec {}
+            payload = Payload {
+                kind = "Native"
+                exec = "/usr/local/bin/ente-logind-compat"
+            }
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTHOSTNAMED____"
+            label = "compat-hostnamed"
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-hostnamed-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTTIMEDATED____"
+            label = "compat-timedated"
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-timedated-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTLOCALED______"
+            label = "compat-localed"
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-localed-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTJOURNALD_____"
+            label = "compat-journald"
+            provides = [Capability {kind = "Journal"}]
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-journald-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTRESOLVED_____"
+            label = "compat-resolved"
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-resolved-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTPOLKIT_______"
+            label = "compat-polkit"
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-polkit-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTMACHINED_____"
+            label = "compat-machined"
+            soma = SomaSpec {}
+            payload = Payload {kind = "Native", exec = "/usr/local/bin/ente-machined-compat"}
+            supervision = Supervision {kind = "Restart", initial_ms = 100, max_ms = 30000}
+        }
+
+        # 10. NetworkManager — la mayoría de distros lo prefieren sobre networkd.
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTNETWORKMGR___"
+            label = "NetworkManager"
+            soma = SomaSpec {}
+            payload = Payload {
+                kind = "Native"
+                exec = "/usr/sbin/NetworkManager"
+                argv = ["--no-daemon"]
+            }
+            supervision = Supervision {kind = "Restart", initial_ms = 200, max_ms = 30000}
+        }
+
+        # 11. gdm — display manager. GNOME settings panels via gnome-shell.
+        EntityCard {
+            schema_version = 1
+            id = "01KQABOOTTESTGDMDAEMON____"
+            label = "gdm"
+            soma = SomaSpec {}
+            payload = Payload {
+                kind = "Native"
+                exec = "/usr/bin/gdm"
+                argv = ["--no-daemon"]
+            }
+            supervision = Supervision {kind = "Restart", initial_ms = 500, max_ms = 60000}
+        }
+    ]
+}
diff --git a/scripts/build-rootfs.sh b/scripts/build-rootfs.sh
new file mode 100755
index 0000000..a99bc96
--- /dev/null
+++ b/scripts/build-rootfs.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# build-rootfs.sh — overlay del workspace sobre una imagen base.
+#
+# Inputs:
+#   $1 — path al rootfs (directorio montado o chroot pre-existente)
+#   $2 — path opcional a Card Semilla custom (.k o .json)
+#
+# Output: el rootfs queda con /init → ente-zero, binarios en
+# /usr/local/bin, y la Semilla en /ente/seed.card.k.
+
+set -euo pipefail
+
+ROOTFS="${1:-}"
+SEED_CARD="${2:-}"
+
+if [[ -z "$ROOTFS" || ! -d "$ROOTFS" ]]; then
+    echo "Uso: $0 <rootfs-dir> [seed-card-path]" >&2
+    exit 1
+fi
+
+WORKSPACE="$(cd "$(dirname "$0")/.." && pwd)"
+echo "Workspace: $WORKSPACE"
+echo "Rootfs:    $ROOTFS"
+
+# 1. Build release
+echo "==> cargo build --workspace --release"
+cd "$WORKSPACE"
+cargo build --workspace --release
+
+# 2. Copia binarios
+echo "==> copiando binarios a $ROOTFS/usr/local/bin/"
+mkdir -p "$ROOTFS/usr/local/bin"
+BINS=(
+    ente-zero
+    ente-logind-compat
+    ente-hostnamed-compat
+    ente-timedated-compat
+    ente-localed-compat
+    ente-journald-compat
+    ente-resolved-compat
+    ente-polkit-compat
+    ente-machined-compat
+    ente-echo
+    ente-journalctl
+)
+for bin in "${BINS[@]}"; do
+    src="target/release/$bin"
+    if [[ ! -x "$src" ]]; then
+        echo "WARN: $src no existe, skip" >&2
+        continue
+    fi
+    cp "$src" "$ROOTFS/usr/local/bin/"
+    echo "  + $bin"
+done
+
+# brainctl viene del example
+if [[ -x "target/release/examples/brainctl" ]]; then
+    cp "target/release/examples/brainctl" "$ROOTFS/usr/local/bin/"
+    echo "  + brainctl (example)"
+fi
+if [[ -x "target/release/examples/busctl" ]]; then
+    cp "target/release/examples/busctl" "$ROOTFS/usr/local/bin/ente-busctl"
+    echo "  + ente-busctl (example, renombrado para no chocar con systemd-busctl)"
+fi
+
+# 3. Backup del init original
+if [[ -e "$ROOTFS/sbin/init" && ! -L "$ROOTFS/sbin/init" ]]; then
+    if [[ ! -e "$ROOTFS/sbin/init.systemd" ]]; then
+        echo "==> backup /sbin/init → /sbin/init.systemd"
+        mv "$ROOTFS/sbin/init" "$ROOTFS/sbin/init.systemd"
+    fi
+fi
+
+# 4. /init y /sbin/init apuntan a ente-zero
+echo "==> /init → ente-zero"
+ln -sf /usr/local/bin/ente-zero "$ROOTFS/init"
+ln -sf /usr/local/bin/ente-zero "$ROOTFS/sbin/init"
+
+# 5. Card Semilla
+mkdir -p "$ROOTFS/ente"
+if [[ -n "$SEED_CARD" && -f "$SEED_CARD" ]]; then
+    cp "$SEED_CARD" "$ROOTFS/ente/seed.card.k"
+    echo "==> Semilla custom: $SEED_CARD"
+else
+    cp "$WORKSPACE/docs/seed-gnome-test.k" "$ROOTFS/ente/seed.card.k" 2>/dev/null \
+        || echo "WARN: docs/seed-gnome-test.k no existe; ente-zero sintetizará dev seed"
+fi
+
+# 6. Mascara servicios systemd que vamos a sustituir
+echo "==> systemctl mask de servicios sustituidos (si systemd presente)"
+chroot "$ROOTFS" systemctl mask \
+    systemd-logind.service \
+    systemd-hostnamed.service \
+    systemd-timedated.service \
+    systemd-localed.service \
+    systemd-journald.service \
+    systemd-resolved.service \
+    systemd-machined.service \
+    polkit.service \
+    2>/dev/null || echo "  (chroot mask falló — OK si la imagen no tiene systemd)"
+
+echo "==> rootfs listo en $ROOTFS"
+echo
+echo "Próximo paso:"
+echo "  scripts/run-vm.sh <imagen-base.qcow2>"
diff --git a/scripts/run-vm.sh b/scripts/run-vm.sh
new file mode 100755
index 0000000..c6058a2
--- /dev/null
+++ b/scripts/run-vm.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# run-vm.sh — boot de la imagen rootfs en QEMU con KVM.
+#
+# Inputs:
+#   $1 — imagen disco (qcow2 o raw) con el rootfs ya parchado
+#   $@ — args adicionales a qemu
+#
+# Default: 4 GiB RAM, 2 vCPU, virtio-net, OpenGL para GNOME shell.
+
+set -euo pipefail
+
+DISK="${1:-}"
+shift || true
+
+if [[ -z "$DISK" || ! -f "$DISK" ]]; then
+    echo "Uso: $0 <disk.qcow2> [args extra de qemu]" >&2
+    echo "Genera la imagen con scripts/build-rootfs.sh primero." >&2
+    exit 1
+fi
+
+# Boot config: redirige init a ente-zero. Usa los flags que el initramfs
+# de la imagen base entienda — `init=` es universal para GRUB-equivalentes.
+KERNEL_CMDLINE="root=/dev/vda1 rw console=ttyS0,115200 init=/usr/local/bin/ente-zero RUST_LOG=info"
+
+# Config QEMU. -display gtk con OpenGL para GNOME shell. -display none
+# para CI/headless (el test verifica solamente boot via console).
+DISPLAY_FLAGS="${ENTE_VM_DISPLAY:--display gtk,gl=on}"
+
+exec qemu-system-x86_64 \
+    -enable-kvm \
+    -cpu host \
+    -smp 2 \
+    -m 4G \
+    -drive "file=$DISK,if=virtio" \
+    -netdev user,id=net0 \
+    -device virtio-net-pci,netdev=net0 \
+    -serial mon:stdio \
+    $DISPLAY_FLAGS \
+    -append "$KERNEL_CMDLINE" \
+    "$@"