diff --git a/docs/15-milestones.md b/docs/15-milestones.md
index ce39502..deff0ae 100644
--- a/docs/15-milestones.md
+++ b/docs/15-milestones.md
@@ -25,7 +25,7 @@ bullets into issues. Each bullet is scoped to concrete files.
 - [x] Point `wasmagent-train-replay` `EpochEvidenceBundle` at the shared AEP
       record schema for its evidence envelope.
 - [ ] In `open-agent-audit`, add an adapter mapping `schemas/v0.1/canonical-event.schema.json` onto `@wasmagent/protocol` `aep-record`, with a conformance test proving a sample AEP record validates. (tracked: WasmAgent/open-agent-audit#94)
-- [ ] Add `scripts/check-consumer-versions.mjs` + a CI job here that reads each consumer repo's declared `@wasmagent/protocol` range and fails if any is out of the supported band.
+- [ ] Add `scripts/check-consumer-versions.mjs` + a CI job here that reads each consumer repo's declared `@wasmagent/protocol` range and fails if any is out of the supported band. (tracked: WasmAgent/wasmagent-protocol#69)
 
 ## Milestone 3 — Stability & conformance
 
diff --git a/docs/GOVERNANCE.md b/docs/GOVERNANCE.md
index 78df9b1..c4f9708 100644
--- a/docs/GOVERNANCE.md
+++ b/docs/GOVERNANCE.md
@@ -50,6 +50,12 @@ prevents the drift that motivated the repo's creation.
 See [`CONTRACT-CHANGE-PROCESS.md`](CONTRACT-CHANGE-PROCESS.md) for the full
 workflow.
 
+## Version band mechanism
+
+- All consumer repositories must pin or declare an acceptable version range within the supported `@wasmagent/protocol` version band.
+- A cross-repo CI compatibility check (`scripts/check-consumer-versions.mjs`) verifies that consumer repos do not depend on out-of-band protocol versions.
+- Protocol packages (`@wasmagent/protocol` on npm, `wasmagent-protocol` on PyPI) serve as the foundation contract across all WasmAgent ecosystem services.
+
 ## Exit condition
 
 Per org policy, every repository declares what would cause it to be archived or