diff --git a/.automation/validation-marker b/.automation/validation-marker
new file mode 100644
index 00000000..a5627fcf
--- /dev/null
+++ b/.automation/validation-marker
@@ -0,0 +1,2 @@
+source-head=9edbaca12f1ff120705b5f87a5a463c79865e5e5
+validation-attempt=published-result
diff --git a/.github/workflows/source-snapshot.yml b/.github/workflows/source-snapshot.yml
new file mode 100644
index 00000000..cf4e7e5a
--- /dev/null
+++ b/.github/workflows/source-snapshot.yml
@@ -0,0 +1,101 @@
+name: Validate Remaining Part A
+
+on:
+  push:
+    branches:
+      - agent/source-snapshot-api-redesign
+    paths-ignore:
+      - .automation/validation-result.txt
+
+permissions:
+  contents: write
+  packages: read
+
+jobs:
+  validate:
+    name: Exact-head validation
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      PACKAGES_USER: ${{ secrets.HAUNTEDMC_PACKAGES_USERNAME }}
+      PACKAGES_TOKEN: ${{ secrets.HAUNTEDMC_PACKAGES_TOKEN }}
+      PLATFORM_ACCEPTANCE_KEEP_WORK_DIRECTORY: "true"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: "25"
+          cache: maven
+          server-id: github
+          server-username: PACKAGES_USER
+          server-password: PACKAGES_TOKEN
+      - name: Validate and publish result
+        shell: bash
+        env:
+          PLATFORM_ACCEPTANCE_WORK_DIRECTORY: ${{ runner.temp }}/proxyfeatures-platform-acceptance
+        run: |
+          set +e
+          test -n "$PACKAGES_USER" && test -n "$PACKAGES_TOKEN"
+          credentials_status=$?
+
+          ./mvnw -U -B -ntp -DskipTests checkstyle:check > "${RUNNER_TEMP}/lint.log" 2>&1
+          lint_status=$?
+          shellcheck update_version.sh proxyfeatures-platform-acceptance/run-platform-acceptance.sh \
+            >> "${RUNNER_TEMP}/lint.log" 2>&1
+          shell_status=$?
+
+          ./mvnw -U -B -ntp verify > "${RUNNER_TEMP}/verify.log" 2>&1
+          verify_status=$?
+
+          ./mvnw -U -B -ntp -Pplatform-acceptance verify > "${RUNNER_TEMP}/acceptance.log" 2>&1
+          acceptance_status=$?
+
+          mkdir -p .automation
+          {
+            echo "source_head=9edbaca12f1ff120705b5f87a5a463c79865e5e5"
+            echo "validation_commit=$(git rev-parse HEAD)"
+            echo "credentials_status=$credentials_status"
+            echo "lint_status=$lint_status"
+            echo "shellcheck_status=$shell_status"
+            echo "verify_status=$verify_status"
+            echo "acceptance_status=$acceptance_status"
+            echo
+            echo "===== LINT TAIL ====="
+            tail -n 300 "${RUNNER_TEMP}/lint.log"
+            echo
+            echo "===== VERIFY TAIL ====="
+            tail -n 500 "${RUNNER_TEMP}/verify.log"
+            echo
+            echo "===== FAILING TEST REPORTS ====="
+            find . -type f \( -path '*/target/surefire-reports/*.txt' -o -path '*/target/failsafe-reports/*.txt' \) -print0 \
+              | sort -z \
+              | xargs -0 -r grep -l -E 'Failures: [1-9]|Errors: [1-9]|<<< FAILURE|<<< ERROR' \
+              | while read -r report; do
+                  echo "--- $report"
+                  tail -n 250 "$report"
+                done
+            echo
+            echo "===== ACCEPTANCE TAIL ====="
+            tail -n 500 "${RUNNER_TEMP}/acceptance.log"
+            if [[ -f "${PLATFORM_ACCEPTANCE_WORK_DIRECTORY}/velocity/velocity.log" ]]; then
+              echo
+              echo "===== VELOCITY LOG TAIL ====="
+              tail -n 400 "${PLATFORM_ACCEPTANCE_WORK_DIRECTORY}/velocity/velocity.log"
+            fi
+          } > .automation/validation-result.txt
+
+          git config user.name "hauntedmc-validation-agent"
+          git config user.email "hauntedmc-validation-agent@users.noreply.github.com"
+          git add .automation/validation-result.txt
+          git commit -m "ci: record exact-head validation result"
+          git push origin HEAD:agent/source-snapshot-api-redesign
+
+          if (( credentials_status != 0 || lint_status != 0 || shell_status != 0 \
+                || verify_status != 0 || acceptance_status != 0 )); then
+            exit 1
+          fi