@@ -23,7 +23,8 @@ body:
         - label: Sweep deprecations whose stated removal version has arrived (`grep -rn 'deprecated::' cuda_core/cuda`) and remove any that are due
         - label: "Finalize the doc update, including release notes (\"Note: Touching docstrings/type annotations in code is OK during code freeze, apply your best judgement!\")"
         - label: Update the docs for the new version
-        - label: Create a public release tag
+        - label: "For cuda-core: create the release branch (`release/cuda-core-vX.Y.x`) from `main` for a minor release, or use the existing one for a patch release"
+        - label: "Create a public release tag (for cuda-core, on the release branch)"
         - label: Wait for the tag-triggered CI run to complete, and use that run ID for release workflows (this will upload the release to PyPI)
         - label: Publish the release at https://github.com/NVIDIA/cuda-python/releases (this will trigger the conda package update)
         - label: Approve the conda-package update PR
 
@@ -85,9 +85,23 @@ platforms as appropriate for each release.
 ## Check (or update if needed) the dependency requirements
 
 Review `cuda_core/pyproject.toml` and verify that all dependency
-requirements are current. The `cu12`/`cu13` extras declare the
-`cuda-bindings` floors; see "Bumping the cuda-bindings floor" in
-`cuda_core/AGENTS.md`.
+requirements are current.
+
+The `cu12`/`cu13` extras declare the `cuda-bindings` floors. A release
+does not raise a floor to the newest `cuda-bindings`; see "Bumping the
+cuda-bindings floor" in `cuda_core/AGENTS.md`. Check the floors instead:
+
+- The minor of each floor equals the minor of the toolkit pin of its
+  major in `ci/versions.yml` (`build` for the current major, `prev_build`
+  for the prior major). If a floor's minor is lower, the toolkit-bump
+  window is open: move the floor before the release.
+- In the latest CI run on `main`, the CUDA 13 rows whose CUDA minor
+  differs from the `build` pin (for example "CUDA 13.0.2") installed the
+  literal floor. Their logs show `Installing bindings (source: floor)` and
+  `cuda-bindings==<floor>`, and no "predates ... headers" line. Standard
+  CI does not install the CUDA 12 floor: its rows use the 12.9.x backport
+  build.
+- The release notes list every floor move since the last release.
 
 Update the `cuda-core` pin in `cuda_python/setup.py` to the new minor
 series (`cuda-core~=X.Y.0`), and plan a `cuda-python` release right after
@@ -142,17 +156,45 @@ built and deployed automatically by the release workflow.
 
 ---
 
+## Create the release branch
+
+Each `cuda-core` minor series has one release branch,
+`release/cuda-core-vX.Y.x`. Releases are tagged on that branch, not on
+`main`. Patch releases of the series land there too.
+
+For a minor release (`X.Y.0`), create the branch after every pre-release
+pull request has merged into `main`. Branch from the `main` commit that
+holds the final release notes:
+
+```bash
+git fetch origin main
+git push origin origin/main:refs/heads/release/cuda-core-v0.6.x
+```
+
+For a patch release (`X.Y.Z`), use the existing branch. Changes reach it
+through pull requests that cherry-pick the fixes from `main`, with
+`(cherry picked from commit ...)` trailers. The release notes for the patch
+release must be on the release branch before the tag: the release workflow
+checks for them in the tagged tree. Add them to `main` as well, so the docs
+switcher and the `latest` docs list them.
+
+The repository ruleset protects `release/**`: a push to an existing release
+branch needs a pull request and passing checks.
+
+---
+
 ## Create a public release tag
 
 **Warning:** Pushing a tag is a potentially irrevocable action.  Be absolutely
 certain the tag points to the correct commit before pushing.
 
 Tags should be GPG-signed. The tag name format is `cuda-core-v<VERSION>`
-(e.g. `cuda-core-v0.6.0`). The tag must point to a commit on `main`.
+(e.g. `cuda-core-v0.6.0`). The tag must point to a commit on the release
+branch.
 
 ```bash
-git checkout main
-git pull origin main
+git fetch origin release/cuda-core-v0.6.x
+git checkout --detach origin/release/cuda-core-v0.6.x
 git tag -s cuda-core-v0.6.0 -m "cuda-core v0.6.0"
 git push origin cuda-core-v0.6.0
 ```
 
@@ -19,6 +19,14 @@ inputs:
     description: "where the CTK components will be installed to, relative to $PWD"
     required: false
     default: "./cuda_toolkit"
+  install-mode:
+    description: >
+      "replace" (default) empties cuda-path before installing.
+      "add" installs the components on top of the mini CTK that an earlier
+      fetch_ctk call installed at the same cuda-path, and leaves the
+      environment that call exported unchanged.
+    required: false
+    default: "replace"
   redist-base-url:
     description: >
       Base URL of a redistrib server (manifest and component archives).
@@ -43,6 +51,34 @@ runs:
       with:
         dependent_exes: "curl unzip tar sha256sum cygpath"
 
+    - name: Check install mode
+      shell: bash --noprofile --norc -xeuo pipefail {0}
+      run: |
+        case "${{ inputs.install-mode }}" in
+          replace)
+            ;;
+          add)
+            # The environment exports are skipped in this mode, so the target
+            # must be the CUDA_PATH an earlier fetch_ctk call exported.
+            if [[ -z "${CUDA_PATH:-}" ]]; then
+              echo "::error::install-mode 'add' requires CUDA_PATH from an earlier fetch_ctk call"
+              exit 1
+            fi
+            EXISTING_PATH="$CUDA_PATH"
+            if [[ "${{ inputs.host-platform }}" == win* ]]; then
+              EXISTING_PATH="$(cygpath -u "$EXISTING_PATH")"
+            fi
+            if [[ "$(realpath -e "${{ inputs.cuda-path }}")" != "$(realpath -e "$EXISTING_PATH")" ]]; then
+              echo "::error::install-mode 'add' requires cuda-path to be the existing CUDA_PATH ($CUDA_PATH)"
+              exit 1
+            fi
+            ;;
+          *)
+            echo "::error::install-mode must be 'replace' or 'add', got '${{ inputs.install-mode }}'"
+            exit 1
+            ;;
+        esac
+
     - name: Set up CTK cache variable
       shell: bash --noprofile --norc -xeuo pipefail {0}
       run: |
@@ -82,9 +118,11 @@ runs:
         # prefixes its output line with "\", which would end up in the cache key.
         MANIFEST_SHA256="$(sha256sum < "$CTK_JSON_FILE" | awk '{print $1}')"
         HASH=$(echo -n "${CTK_CACHE_COMPONENTS}" | sha256sum | awk '{print $1}')
+        # Bump the layout tag (l2) whenever the unpacked tree changes shape, so
+        # caches saved with an older layout are not restored.
         {
-          echo "CTK_CACHE_KEY=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH-m$MANIFEST_SHA256"
-          echo "CTK_CACHE_FILENAME=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH-m$MANIFEST_SHA256.tar.gz"
+          echo "CTK_CACHE_KEY=mini-ctk-l2-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH-m$MANIFEST_SHA256"
+          echo "CTK_CACHE_FILENAME=mini-ctk-l2-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH-m$MANIFEST_SHA256.tar.gz"
           echo "CTK_CACHE_COMPONENTS=${CTK_CACHE_COMPONENTS}"
           echo "CTK_BASE_URL=${CTK_BASE_URL}"
           echo "CTK_JSON_FILE=${CTK_JSON_FILE}"
@@ -115,16 +153,16 @@ runs:
         # "Set up CTK cache variable".
         if [[ "${{ inputs.host-platform }}" == linux* ]]; then
           function extract() {
-            tar -xvf $1 -C $CACHE_TMP_DIR --strip-components=1
+            tar -xvf $1 -C $2 --strip-components=1
           }
         elif [[ "${{ inputs.host-platform }}" == win* ]]; then
           function extract() {
             _TEMP_DIR_=$(mktemp -d)
             unzip $1 -d $_TEMP_DIR_
-            cp -r $_TEMP_DIR_/*/* $CACHE_TMP_DIR
+            cp -r $_TEMP_DIR_/*/* $2
             rm -rf $_TEMP_DIR_
             # see commit NVIDIA/cuda-python@69410f1d9228e775845ef6c8b4a9c7f37ffc68a5
-            chmod 644 $CACHE_TMP_DIR/LICENSE
+            chmod 644 $2/LICENSE
           }
         fi
         function populate_cuda_path() {
@@ -147,17 +185,34 @@ runs:
             --component "$CTK_COMPONENT" \
             --metadata-path "$CTK_JSON_FILE")"
           echo "${CTK_COMPONENT_SHA256}  ${CTK_COMPONENT_COMPONENT_FILENAME}" | sha256sum --check --strict -
-          extract $CTK_COMPONENT_COMPONENT_FILENAME
+          # cuda.pathfinder looks for CUPTI only under extras/CUPTI, the CTK installer
+          # layout; the redistrib archive itself has a flat include/ + lib/ layout.
+          CTK_COMPONENT_DEST="$CACHE_TMP_DIR"
+          if [[ "$CTK_COMPONENT" == cuda_cupti ]]; then
+            CTK_COMPONENT_DEST="$CACHE_TMP_DIR/extras/CUPTI"
+          fi
+          mkdir -p "$CTK_COMPONENT_DEST"
+          extract $CTK_COMPONENT_COMPONENT_FILENAME "$CTK_COMPONENT_DEST"
           rm $CTK_COMPONENT_COMPONENT_FILENAME
         }
 
         # Get headers and shared libraries in place
         for item in $(echo $CTK_CACHE_COMPONENTS | tr ',' ' '); do
             populate_cuda_path "$item"
         done
-        # TODO: check Windows
-        if [[ "${{ inputs.host-platform }}" == linux* && -d "${CACHE_TMP_DIR}/lib" ]]; then
-          mv $CACHE_TMP_DIR/lib $CACHE_TMP_DIR/lib64
+        CUPTI_DIR="$CACHE_TMP_DIR/extras/CUPTI"
+        if [[ "${{ inputs.host-platform }}" == linux* ]]; then
+          for lib_parent in "$CACHE_TMP_DIR" "$CUPTI_DIR"; do
+            if [[ -d "$lib_parent/lib" ]]; then
+              mv "$lib_parent/lib" "$lib_parent/lib64"
+            fi
+          done
+        elif [[ "${{ inputs.host-platform }}" == win* ]]; then
+          # CUPTI archives before 13.4 put the DLLs directly in lib/, where the
+          # CTK installer uses extras/CUPTI/lib64; later ones use lib/<arch>.
+          if [[ -d "$CUPTI_DIR/lib" && ! -d "$CUPTI_DIR/lib/x64" && ! -d "$CUPTI_DIR/lib/arm64" ]]; then
+            mv "$CUPTI_DIR/lib" "$CUPTI_DIR/lib64"
+          fi
         fi
         ls -l $CACHE_TMP_DIR
 
@@ -170,7 +225,9 @@ runs:
         # symlinks from a prerelease CTK at ./cuda_toolkit/include etc., causing
         # "cp: cannot overwrite non-directory" failures on the next restore).
         CUDA_PATH="${{ inputs.cuda-path }}"
-        rm -rf $CUDA_PATH
+        if [[ "${{ inputs.install-mode }}" == replace ]]; then
+          rm -rf $CUDA_PATH
+        fi
         mkdir -p $CUDA_PATH
         # Unfortunately we cannot use "rsync -av $CACHE_TMP_DIR/ $CUDA_PATH" because
         # not all runners have rsync pre-installed (or even installable, such as
@@ -194,7 +251,9 @@ runs:
         ls -l
         CACHE_TMP_DIR="./cache_tmp_dir"
         CUDA_PATH="${{ inputs.cuda-path }}"
-        rm -rf $CUDA_PATH
+        if [[ "${{ inputs.install-mode }}" == replace ]]; then
+          rm -rf $CUDA_PATH
+        fi
         mkdir -p $CUDA_PATH
         tar -xzvf $CTK_CACHE_FILENAME
         # Can't use rsync here, see above
@@ -203,6 +262,7 @@ runs:
         ls -l $CUDA_PATH
 
     - name: Set output environment variables
+      if: ${{ inputs.install-mode == 'replace' }}
       shell: bash --noprofile --norc -xeuo pipefail {0}
       run: |
         # mimics actual CTK installation
 
@@ -69,3 +69,56 @@ function Test-ExplicitlyDistrusted([System.Security.Cryptography.X509Certificate
         $chain.Dispose()
     }
 }
+
+# Classifies how Windows chain building treats the certificate, using only the
+# local trust state (no revocation, no AIA downloads):
+#   ExplicitDistrust : in LocalMachine\Disallowed or Microsoft's disallowed list
+#   NoTrustAnchor    : the chain no longer ends in a trusted root, and
+#                      UntrustedRoot / PartialChain are the only problems
+#                      reported, e.g. because the root was removed
+#   Trusted          : the chain builds cleanly, so the compromised key is usable
+#   Indeterminate    : the build failed for some other reason; never a pass
+# Verification time is pinned (the instant used by runner_trust_probe.sh) so an
+# expired certificate cannot masquerade as untrusted.
+# A PartialChain only shows that the root is untrusted if the issuers are
+# available to the build, so callers pass the non-root issuers in
+# $ExtraCertificates. Issuers that are roots need not be supplied: a missing
+# root is exactly the condition this function reports as NoTrustAnchor.
+function Get-ChainTrustState(
+    [System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
+    [System.Security.Cryptography.X509Certificates.X509Certificate2[]]$ExtraCertificates = @()
+) {
+    $explicitDistrust = [System.Security.Cryptography.X509Certificates.X509ChainStatusFlags]::ExplicitDistrust
+    $noAnchor = [int]([System.Security.Cryptography.X509Certificates.X509ChainStatusFlags]::UntrustedRoot -bor
+        [System.Security.Cryptography.X509Certificates.X509ChainStatusFlags]::PartialChain)
+    $chain = [System.Security.Cryptography.X509Certificates.X509Chain]::new()
+    try {
+        foreach ($extra in $ExtraCertificates) {
+            [void]$chain.ChainPolicy.ExtraStore.Add($extra)
+        }
+        $chain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::NoCheck
+        $chain.ChainPolicy.VerificationTime = [DateTime]::new(2026, 10, 23, 0, 0, 0, [DateTimeKind]::Utc)
+        # DisableCertificateDownloads does not exist on .NET Framework (Windows PowerShell 5.1).
+        if ($chain.ChainPolicy | Get-Member -Name DisableCertificateDownloads) {
+            $chain.ChainPolicy.DisableCertificateDownloads = $true
+        }
+        $built = $chain.Build($Cert)
+        $statuses = @($chain.ChainStatus) + @($chain.ChainElements | ForEach-Object { $_.ChainElementStatus })
+        $names = @($statuses | ForEach-Object { $_.Status.ToString() } | Where-Object { $_ -ne 'NoError' } | Sort-Object -Unique)
+        if ($statuses | Where-Object { $_.Status.HasFlag($explicitDistrust) }) {
+            $state = 'ExplicitDistrust'
+        } elseif ($built) {
+            $state = 'Trusted'
+        } elseif (
+            ($statuses | Where-Object { ([int]$_.Status -band $noAnchor) -ne 0 }) -and
+            -not ($statuses | Where-Object { ([int]$_.Status -band (-bnot $noAnchor)) -ne 0 })
+        ) {
+            $state = 'NoTrustAnchor'
+        } else {
+            $state = 'Indeterminate'
+        }
+        return [pscustomobject]@{ State = $state; Statuses = ($names -join ',') }
+    } finally {
+        $chain.Dispose()
+    }
+}
@@ -72,8 +72,13 @@ jobs:
           # but not historical blobs.
           fetch-depth: 0
           filter: blob:none
-          # third_party/cccl provides the CCCL headers cuda.core compiles against.
-          submodules: true
+          # Fetch CCCL separately: checkout's filter does not apply to submodules.
+          submodules: false
+
+      - name: Checkout CCCL submodule
+        run: |
+          git submodule sync --recursive
+          git submodule update --init --force --depth=1 --filter=blob:none --recursive
 
       - name: Register problem matchers
         # Compiler and Cython errors from the wheel builds become annotations
 
@@ -61,13 +61,12 @@ jobs:
       - name: Set up Python
         uses: ./.github/actions/setup-hardened-python
         with:
-          python-version: "3.12"
+          python-version: "3.11"
 
       - name: Run CI tools unit tests
         run: |
-          python -m pip install pytest pyyaml==6.0.3 pathspec==0.12.1
-          # Standalone CI tool tests; skip repo-root conftest.py (imports cuda.pathfinder).
-          python -m pytest -v --noconftest ci/tools/tests
+          python -m pip install -e './ci[test]'
+          python -m pytest -v ci/tools/tests
 
   find-wheels:
     if: ${{ github.repository_owner == 'nvidia' && !inputs.documentation-links-only }}