diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index b32371d..0378b9f 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -2,7 +2,7 @@ name: validate
 
 on:
   pull_request:
-    paths: ["pkgs/**/*.lua"]
+    paths: ["pkgs/**/*.lua", ".github/workflows/validate.yml"]
   push:
     branches: [main]
 
@@ -11,22 +11,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Install lua
+        run: sudo apt-get install -y --no-install-recommends lua5.4
       - name: Lint package descriptors
         run: |
           fail=0
           for f in pkgs/*/*.lua; do
+            # 1. Forbidden install hook (security: descriptors must not run code)
             if grep -q "^function install" "$f"; then
               echo "::error file=$f::install hook is forbidden"
               fail=1
             fi
-            if ! grep -q "mcpp = {" "$f"; then
-              echo "::error file=$f::missing mcpp = {} segment"
-              fail=1
-            fi
-            if ! grep -q 'schema *= *"0\.1"' "$f"; then
-              echo "::error file=$f::missing schema = \"0.1\""
+            # 2. Lua syntax check — load (= compile) without executing.
+            #    `loadfile(name, 't')` rejects bytecode and parses text only.
+            if ! lua5.4 -e "assert(loadfile('$f', 't'))" >/dev/null 2>&1; then
+              echo "::error file=$f::lua syntax error"
               fail=1
             fi
+            # 3. xpkg V1 baseline: the file has to populate `package = { ... }`
+            #    with at least `spec`, `name`, and an `xpm` table. Form A vs
+            #    Form B (mcpp = "<path>" / mcpp = { ... }) is descriptor-author
+            #    choice and not enforced here.
+            for needle in 'spec *=' 'name *=' 'xpm *='; do
+              if ! grep -q "$needle" "$f"; then
+                echo "::error file=$f::missing required field ($needle)"
+                fail=1
+              fi
+            done
           done
           [ $fail -eq 0 ] && echo "All package files valid."
           exit $fail
diff --git a/pkgs/l/lua.lua b/pkgs/l/lua.lua
new file mode 100644
index 0000000..d496b19
--- /dev/null
+++ b/pkgs/l/lua.lua
@@ -0,0 +1,86 @@
+-- M6.x glob-aware Form B descriptor for Lua 5.4.
+--
+-- Pure-C library; relies on mcpp 0.0.2's C-language compile rule (`.c`
+-- routed to `c_object` via the gcc/clang sibling driver). Builds the
+-- 32 library translation units (CORE_O + LIB_O from upstream's
+-- src/Makefile) into a single static archive `liblua.a`. The two
+-- binary entry points (`src/lua.c` for the interpreter and
+-- `src/luac.c` for the bytecode compiler) are intentionally excluded —
+-- both define `int main()` and aren't part of the embeddable library.
+-- Consumers `#include <lua.h>` and link against liblua.a.
+
+package = {
+    spec        = "1",
+    name        = "lua",
+    description = "A powerful, efficient, lightweight, embeddable scripting language",
+    licenses    = {"MIT"},
+    repo        = "https://www.lua.org",
+    type        = "package",
+
+    xpm = {
+        linux = {
+            ["5.4.7"] = {
+                url    = "https://www.lua.org/ftp/lua-5.4.7.tar.gz",
+                sha256 = "9fbf5e28ef86c69858f6d3d34eccc32e911c1a28b4120ff3e84aaa70cfbf1e30",
+            },
+        },
+        macosx = {
+            ["5.4.7"] = {
+                url    = "https://www.lua.org/ftp/lua-5.4.7.tar.gz",
+                sha256 = "9fbf5e28ef86c69858f6d3d34eccc32e911c1a28b4120ff3e84aaa70cfbf1e30",
+            },
+        },
+        windows = {
+            ["5.4.7"] = {
+                url    = "https://www.lua.org/ftp/lua-5.4.7.tar.gz",
+                sha256 = "9fbf5e28ef86c69858f6d3d34eccc32e911c1a28b4120ff3e84aaa70cfbf1e30",
+            },
+        },
+    },
+
+    -- Form B `mcpp` segment: paths are globs relative to the verdir
+    -- (~/.mcpp/registry/data/xpkgs/<idx>-x-lua/<ver>/). The leading
+    -- `*/` absorbs the upstream tarball's `lua-5.4.7/` wrap layer.
+    mcpp = {
+        language     = "c++23",                   -- top-level [package].standard knob; mcpp drives a c++23 toolchain even for pure-C deps.
+        import_std   = false,                     -- pure C — no `import std;`.
+        c_standard   = "c99",                     -- Lua's reference build is c99-clean; matches upstream src/Makefile.
+        include_dirs = { "*/src" },                -- public headers (lua.h, lualib.h, lauxlib.h, luaconf.h) live next to .c files.
+        sources = {
+            "*/src/lapi.c",
+            "*/src/lauxlib.c",
+            "*/src/lbaselib.c",
+            "*/src/lcode.c",
+            "*/src/lcorolib.c",
+            "*/src/lctype.c",
+            "*/src/ldblib.c",
+            "*/src/ldebug.c",
+            "*/src/ldo.c",
+            "*/src/ldump.c",
+            "*/src/lfunc.c",
+            "*/src/lgc.c",
+            "*/src/linit.c",
+            "*/src/liolib.c",
+            "*/src/llex.c",
+            "*/src/lmathlib.c",
+            "*/src/lmem.c",
+            "*/src/loadlib.c",
+            "*/src/lobject.c",
+            "*/src/lopcodes.c",
+            "*/src/loslib.c",
+            "*/src/lparser.c",
+            "*/src/lstate.c",
+            "*/src/lstring.c",
+            "*/src/lstrlib.c",
+            "*/src/ltable.c",
+            "*/src/ltablib.c",
+            "*/src/ltm.c",
+            "*/src/lundump.c",
+            "*/src/lutf8lib.c",
+            "*/src/lvm.c",
+            "*/src/lzio.c",
+        },
+        targets = { ["lua"] = { kind = "lib" } },
+        deps    = { },
+    },
+}