diff --git a/schemas/index.json b/schemas/index.json
index 2bc43b1..4fda9fa 100644
--- a/schemas/index.json
+++ b/schemas/index.json
@@ -184,6 +184,23 @@
         "open-agent-audit"
       ],
       "summary": "Trust Passport \u2014 signed, expiring, verifiable trust-state artifact for AI agents."
+    },
+    {
+      "id": "package",
+      "title": "Package",
+      "path": "schemas/package/package.schema.json",
+      "canonical_id": "https://wasmagent.dev/schemas/package/v0.1.schema.json",
+      "version": "package/v0.1",
+      "stability": "evolving",
+      "owners": [
+        "wasmagent-protocol"
+      ],
+      "consumers": [
+        "wasmagent-js",
+        "trace-pipeline",
+        "open-agent-audit"
+      ],
+      "summary": "Machine-readable manifest of a published WasmAgent protocol package release \u2014 which canonical schemas a versioned @wasmagent/protocol / wasmagent-protocol build bundles, where it ships, and the canonical host its schemas resolve under."
     }
   ]
 }
diff --git a/schemas/package/package.schema.json b/schemas/package/package.schema.json
new file mode 100644
index 0000000..340acd5
--- /dev/null
+++ b/schemas/package/package.schema.json
@@ -0,0 +1,98 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wasmagent.dev/schemas/package/v0.1.schema.json",
+  "title": "Package",
+  "description": "Descriptor for a published WasmAgent protocol package release — the machine-readable manifest of which canonical schemas a given version of @wasmagent/protocol (npm) / wasmagent-protocol (PyPI) bundles, where it is published, and the canonical host its schemas resolve under. Lets consumers pin and verify a release against the registry without depending on prose.",
+  "type": "object",
+  "required": [
+    "name",
+    "version",
+    "canonical_host",
+    "schemas"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Published package name, e.g. @wasmagent/protocol (npm) or wasmagent-protocol (PyPI)"
+    },
+    "version": {
+      "type": "string",
+      "description": "Semver release version of the package, e.g. 0.1.7"
+    },
+    "canonical_host": {
+      "type": "string",
+      "format": "uri",
+      "description": "Canonical host prefix every bundled schema $id resolves under, e.g. https://wasmagent.dev/schemas/"
+    },
+    "registries": {
+      "type": "array",
+      "description": "Distribution registries the package is published to",
+      "items": {
+        "type": "object",
+        "required": [
+          "name",
+          "url"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Registry identifier, e.g. npm or pypi"
+          },
+          "url": {
+            "type": "string",
+            "format": "uri",
+            "description": "Canonical registry URL for this package release"
+          }
+        }
+      }
+    },
+    "schemas": {
+      "type": "array",
+      "description": "Canonical schemas bundled in this package release",
+      "items": {
+        "type": "object",
+        "required": [
+          "id",
+          "canonical_id",
+          "version"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Registry id of the bundled schema, e.g. aep-record"
+          },
+          "canonical_id": {
+            "type": "string",
+            "format": "uri",
+            "description": "Canonical $id the schema declares, e.g. https://wasmagent.dev/schemas/aep/aep-record.schema.json"
+          },
+          "version": {
+            "type": "string",
+            "description": "Schema-version tag bundled in this release, e.g. aep/v0.3"
+          },
+          "stability": {
+            "type": "string",
+            "enum": [
+              "stable",
+              "evolving",
+              "unstable"
+            ],
+            "description": "Contract stability of the bundled schema"
+          }
+        }
+      }
+    },
+    "published_at": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$",
+      "description": "Publication timestamp in ISO 8601 format"
+    },
+    "license": {
+      "type": "string",
+      "description": "SPDX license identifier, e.g. Apache-2.0"
+    }
+  }
+}
diff --git a/tests/fixtures/invalid/package/example.json b/tests/fixtures/invalid/package/example.json
new file mode 100644
index 0000000..46d2978
--- /dev/null
+++ b/tests/fixtures/invalid/package/example.json
@@ -0,0 +1,11 @@
+{
+  "name": "@wasmagent/protocol",
+  "canonical_host": "https://wasmagent.dev/schemas/",
+  "schemas": [
+    {
+      "id": "aep-record",
+      "canonical_id": "https://wasmagent.dev/schemas/aep/aep-record.schema.json",
+      "version": "aep/v0.3"
+    }
+  ]
+}
diff --git a/tests/fixtures/valid/package/example.json b/tests/fixtures/valid/package/example.json
new file mode 100644
index 0000000..cf4ef81
--- /dev/null
+++ b/tests/fixtures/valid/package/example.json
@@ -0,0 +1,31 @@
+{
+  "name": "@wasmagent/protocol",
+  "version": "0.1.7",
+  "canonical_host": "https://wasmagent.dev/schemas/",
+  "registries": [
+    {
+      "name": "npm",
+      "url": "https://www.npmjs.com/package/@wasmagent/protocol"
+    },
+    {
+      "name": "pypi",
+      "url": "https://pypi.org/project/wasmagent-protocol/"
+    }
+  ],
+  "schemas": [
+    {
+      "id": "aep-record",
+      "canonical_id": "https://wasmagent.dev/schemas/aep/aep-record.schema.json",
+      "version": "aep/v0.3",
+      "stability": "evolving"
+    },
+    {
+      "id": "evidence-envelope",
+      "canonical_id": "https://wasmagent.dev/schemas/aep/evidence-envelope.schema.json",
+      "version": "aep/v0.1",
+      "stability": "evolving"
+    }
+  ],
+  "published_at": "2026-07-28T00:00:00Z",
+  "license": "Apache-2.0"
+}