A registry of the test's own speaks npm's publish protocol and asks for the credential: a candidate's build publishes nothing, a trunk build publishes the packed file the build digested, and a second trunk build of the same package finds it and publishes nothing.