diff --git a/README.md b/README.md
index 7c11980..835376d 100644
--- a/README.md
+++ b/README.md
@@ -31,3 +31,7 @@ Destructive backup recovery uses the explicit `backup-restore-request.json`
 and `backup-restore-response.json` contracts; test fixtures contain no real
 database paths or credentials.
 
+The authenticated WebAssembly plugin lifecycle uses the manifest, install,
+and installed-response contracts. Fixtures contain only synthetic package
+metadata and no executable module or secret.
+
diff --git a/contracts/v1/plugin-install-request.json b/contracts/v1/plugin-install-request.json
new file mode 100644
index 0000000..fded2bf
--- /dev/null
+++ b/contracts/v1/plugin-install-request.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trixie.local/contracts/v1/plugin-install-request.json",
+  "title": "Plugin install request",
+  "type": "object",
+  "required": ["manifest", "wasm_base64"],
+  "properties": {
+    "manifest": { "$ref": "plugin-manifest.json" },
+    "wasm_base64": { "type": "string", "minLength": 1, "maxLength": 5592406 }
+  },
+  "additionalProperties": false
+}
diff --git a/contracts/v1/plugin-installed-response.json b/contracts/v1/plugin-installed-response.json
new file mode 100644
index 0000000..98b7cce
--- /dev/null
+++ b/contracts/v1/plugin-installed-response.json
@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trixie.local/contracts/v1/plugin-installed-response.json",
+  "title": "Installed plugin response",
+  "type": "object",
+  "required": ["id", "plugin_id", "name", "version", "manifest", "enabled", "installed_at", "updated_at"],
+  "properties": {
+    "id": { "type": "string", "format": "uuid" },
+    "plugin_id": { "type": "string" },
+    "name": { "type": "string" },
+    "version": { "type": "string" },
+    "manifest": { "$ref": "plugin-manifest.json" },
+    "enabled": { "type": "boolean" },
+    "installed_at": { "type": "string" },
+    "updated_at": { "type": "string" }
+  },
+  "additionalProperties": false
+}
diff --git a/contracts/v1/plugin-manifest.json b/contracts/v1/plugin-manifest.json
new file mode 100644
index 0000000..5f878ba
--- /dev/null
+++ b/contracts/v1/plugin-manifest.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trixie.local/contracts/v1/plugin-manifest.json",
+  "title": "Trixie WebAssembly plugin manifest",
+  "type": "object",
+  "required": ["id", "name", "version", "api_version", "permissions", "entrypoint"],
+  "properties": {
+    "id": { "type": "string", "pattern": "^[a-z0-9.-]+$", "maxLength": 64 },
+    "name": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "version": { "type": "string", "minLength": 1, "maxLength": 64 },
+    "api_version": { "type": "string", "maxLength": 32 },
+    "permissions": { "type": "array", "maxItems": 16, "items": { "enum": ["chat.read", "chat.send", "overlay.emit", "twitch.read", "twitch.manage"] } },
+    "entrypoint": { "type": "string", "minLength": 1, "maxLength": 64 }
+  },
+  "additionalProperties": false
+}
diff --git a/fixtures/v1/plugin-installed-response.json b/fixtures/v1/plugin-installed-response.json
new file mode 100644
index 0000000..a196ade
--- /dev/null
+++ b/fixtures/v1/plugin-installed-response.json
@@ -0,0 +1,17 @@
+{
+  "id": "00000000-0000-4000-8000-000000000001",
+  "plugin_id": "example.plugin",
+  "name": "Example",
+  "version": "1.0.0",
+  "manifest": {
+    "id": "example.plugin",
+    "name": "Example",
+    "version": "1.0.0",
+    "api_version": "v1",
+    "permissions": ["chat.read"],
+    "entrypoint": "trixie_start"
+  },
+  "enabled": true,
+  "installed_at": "2026-10-25T00:00:00Z",
+  "updated_at": "2026-10-25T00:00:00Z"
+}