diff --git a/.ci/automatic-publish-proof.md b/.ci/automatic-publish-proof.md
new file mode 100644
index 0000000..d8b940c
--- /dev/null
+++ b/.ci/automatic-publish-proof.md
@@ -0,0 +1 @@
+Acceptance: a fresh protected-branch build must publish through the scheduled trusted publisher and resolve from an empty Maven cache.