diff --git a/crates/git-vendor/CHANGELOG.md b/crates/git-vendor/CHANGELOG.md
index 2e5bf9e..4d3263c 100644
--- a/crates/git-vendor/CHANGELOG.md
+++ b/crates/git-vendor/CHANGELOG.md
@@ -1,5 +1,127 @@
 # Changelog
 
+## [1.0.0-alpha.1](https://github.com/git-ents/git-vendor/compare/git-vendor-v1.0.0-alpha.1...git-vendor-v1.0.0-alpha.1) (2026-07-31)
+
+
+### Features
+
+* `add` stages vendored files and sets MERGE_HEAD rather than auto-committing; user runs `git commit` to finalize ([4d0b229](https://github.com/git-ents/git-vendor/commit/4d0b22955f1ff735cf03f3c5ad10d9e539086e57))
+* Add --dry-run to add and update ([03d8deb](https://github.com/git-ents/git-vendor/commit/03d8deba67e90e454d5b810e4389685a5d1c1dbc))
+* Add `ConflictStages` carrying `[base, ours, theirs]` stage versions ([0993c27](https://github.com/git-ents/git-vendor/commit/0993c27e42e976f10921cd7c8acea678a5e26077))
+* Add `Error::Conflict` ([395b29c](https://github.com/git-ents/git-vendor/commit/395b29c42ceee1d136bb0348bc2468161767a5b6))
+* Add `Error::InvalidName` ([e535fcf](https://github.com/git-ents/git-vendor/commit/e535fcfc62f9cf2a6e64c7ed0e7d2ee1a47e2eba))
+* Add `Error::InvalidUrl` and `Error::Fetch` variants ([b9d4407](https://github.com/git-ents/git-vendor/commit/b9d4407e3bce2b0373dd43958d477bcc6a656ecd))
+* Add `From<gix::repository::merge_base::Error>` to `Error` ([73df0c5](https://github.com/git-ents/git-vendor/commit/73df0c558ae7674d6b78658688523b207e1599e5))
+* Add `From<merge_trees::Error>` and `From<tree_merge_options::Error>` to `Error` ([31d98a9](https://github.com/git-ents/git-vendor/commit/31d98a9254c03cd5f629ec306383055811621db8))
+* Add `mode` config key with `squash` integration strategy ([b6d305e](https://github.com/git-ents/git-vendor/commit/b6d305e300e26dcd818985cf0dd4dee19da92c0f))
+* Add `vendor_overlay` to `VendorRepository` ([4799cb0](https://github.com/git-ents/git-vendor/commit/4799cb0c601a2d8f3d629d9952aabbd9e9c1dc78))
+* Add `VendorMode` enum replacing `VendorEntry::squash` ([b6d305e](https://github.com/git-ents/git-vendor/commit/b6d305e300e26dcd818985cf0dd4dee19da92c0f))
+* Add `VendorName` validated newtype ([e535fcf](https://github.com/git-ents/git-vendor/commit/e535fcfc62f9cf2a6e64c7ed0e7d2ee1a47e2eba))
+* Add `VendorWorktree::checkout_vendor_conflicted` ([395b29c](https://github.com/git-ents/git-vendor/commit/395b29c42ceee1d136bb0348bc2468161767a5b6))
+* Add apply subcommand ([d4e7285](https://github.com/git-ents/git-vendor/commit/d4e7285d580becc91ebc4001f51b4df5243d2398))
+* Add CLI subcommands add, update, status, remove, list ([f2b6e46](https://github.com/git-ents/git-vendor/commit/f2b6e46ea3ecd21e3d0d10dc98d8460aecf21068))
+* Add committer, author, and message params to `commit_vendor` ([cc46448](https://github.com/git-ents/git-vendor/commit/cc464483f24e0e5f5646b16d6881e5ac1f170e5d))
+* Add DepotRepository trait and VendorEntry ([24f21a7](https://github.com/git-ents/git-vendor/commit/24f21a7a3bdb455a6f6a9cc0b9157d38be3bd0a6))
+* Add Error type with thiserror and impl_gix_from! macro ([24f21a7](https://github.com/git-ents/git-vendor/commit/24f21a7a3bdb455a6f6a9cc0b9157d38be3bd0a6))
+* Add Error::InvalidPath ([f2b6e46](https://github.com/git-ents/git-vendor/commit/f2b6e46ea3ecd21e3d0d10dc98d8460aecf21068))
+* Add exe module with VendorWorktree trait (checkout/track/untrack/sync) ([1da7741](https://github.com/git-ents/git-vendor/commit/1da774161074166a9f06e9d52953691ee33640c8))
+* Add explicit `ours` commit parameter to `VendorRepository::vendor_paths` ([a5c94e6](https://github.com/git-ents/git-vendor/commit/a5c94e6a117100120d6f860fe733537dea8a05db))
+* Add gix index-from-tree and attribute-stack error conversions to `Error` ([098de11](https://github.com/git-ents/git-vendor/commit/098de11cfdc52699c98d8ed679f9743303fb88d0))
+* Add gix tree-editor and traverse error conversions to `Error` ([f7fe174](https://github.com/git-ents/git-vendor/commit/f7fe174c07c846afe03055165df6e4c6e2b6484e))
+* Add paths to vendor content filter in working-copy .gitattributes ([83f7038](https://github.com/git-ents/git-vendor/commit/83f7038690fa96a027b954793ffd79ac2a0016cf))
+* Add PatternMapping, VendorStatus, VendorMerge, VendorConfig types ([1da7741](https://github.com/git-ents/git-vendor/commit/1da774161074166a9f06e9d52953691ee33640c8))
+* Add prepare_merge to VendorWorktree trait ([f2b6e46](https://github.com/git-ents/git-vendor/commit/f2b6e46ea3ecd21e3d0d10dc98d8460aecf21068))
+* Add VendorConfig::open_from_bytes ([33cd3ba](https://github.com/git-ents/git-vendor/commit/33cd3ba7fc61ae461d653a1913e2006a1e4ddab4))
+* Add visible aliases rm and ls ([03d8deb](https://github.com/git-ents/git-vendor/commit/03d8deba67e90e454d5b810e4389685a5d1c1dbc))
+* Carry merge-stage versions on `VendorMerge` conflicts ([0993c27](https://github.com/git-ents/git-vendor/commit/0993c27e42e976f10921cd7c8acea678a5e26077))
+* Checkout_vendor returns full overlay tree OID ([f2b6e46](https://github.com/git-ents/git-vendor/commit/f2b6e46ea3ecd21e3d0d10dc98d8460aecf21068))
+* Default vendored files to vendor/&lt;name&gt;/ when no patterns given ([03d8deb](https://github.com/git-ents/git-vendor/commit/03d8deba67e90e454d5b810e4389685a5d1c1dbc))
+* Define DepotRepository trait and Error type ([24f21a7](https://github.com/git-ents/git-vendor/commit/24f21a7a3bdb455a6f6a9cc0b9157d38be3bd0a6))
+* Derive `Error::Config` for invalid vendor glob patterns ([f7fe174](https://github.com/git-ents/git-vendor/commit/f7fe174c07c846afe03055165df6e4c6e2b6484e))
+* Enable gix `blocking-network-client` feature ([b9d4407](https://github.com/git-ents/git-vendor/commit/b9d4407e3bce2b0373dd43958d477bcc6a656ecd))
+* Enable gix `worktree-mutation` feature ([5bb39fb](https://github.com/git-ents/git-vendor/commit/5bb39fb45ed2d3303aee3cb4362240ec1d8c2cd2))
+* Enforce vendor name invariant via validated `VendorName` newtype ([e535fcf](https://github.com/git-ents/git-vendor/commit/e535fcfc62f9cf2a6e64c7ed0e7d2ee1a47e2eba))
+* Filter and remap upstream blobs into local path space in `upstream_tree` ([f7fe174](https://github.com/git-ents/git-vendor/commit/f7fe174c07c846afe03055165df6e4c6e2b6484e))
+* Friendlier CLI UX ([03d8deb](https://github.com/git-ents/git-vendor/commit/03d8deba67e90e454d5b810e4389685a5d1c1dbc))
+* Implement `base_tree` as `upstream_tree` at the recorded base ([e1c0593](https://github.com/git-ents/git-vendor/commit/e1c05931bb2b1d6314f4101ef4fcdc7d12e7c161))
+* Implement `checkout_vendor_conflicted` ([951eb6b](https://github.com/git-ents/git-vendor/commit/951eb6bde8f057a39b082a4ece7cd937ebb15ce8))
+* Implement `checkout_vendor` working-copy projection ([5bb39fb](https://github.com/git-ents/git-vendor/commit/5bb39fb45ed2d3303aee3cb4362240ec1d8c2cd2))
+* Implement `commit_vendor` ([b8da2b3](https://github.com/git-ents/git-vendor/commit/b8da2b3c32fc9fbaa13a2f6096d2a047e8a1f049))
+* Implement `commit_vendor` using `gix::objs::Commit` and `write_object` ([b8da2b3](https://github.com/git-ents/git-vendor/commit/b8da2b3c32fc9fbaa13a2f6096d2a047e8a1f049))
+* Implement `fetch_vendor` for `gix::Repository` ([b9d4407](https://github.com/git-ents/git-vendor/commit/b9d4407e3bce2b0373dd43958d477bcc6a656ecd))
+* Implement `fetch_vendor` with anonymous remote fetch and ref projection ([b9d4407](https://github.com/git-ents/git-vendor/commit/b9d4407e3bce2b0373dd43958d477bcc6a656ecd))
+* Implement `merge_vendor` in `VendorRepository for gix::Repository` ([31d98a9](https://github.com/git-ents/git-vendor/commit/31d98a9254c03cd5f629ec306383055811621db8))
+* Implement `merge_vendor` three-way merge in local path space ([31d98a9](https://github.com/git-ents/git-vendor/commit/31d98a9254c03cd5f629ec306383055811621db8))
+* Implement `ours_tree` attribute-filtered local snapshot ([098de11](https://github.com/git-ents/git-vendor/commit/098de11cfdc52699c98d8ed679f9743303fb88d0))
+* Implement `track_vendor` ([83f7038](https://github.com/git-ents/git-vendor/commit/83f7038690fa96a027b954793ffd79ac2a0016cf))
+* Implement `untrack_vendor` ([c760880](https://github.com/git-ents/git-vendor/commit/c760880acc1d962b6b303bc71714892735bd2e27))
+* Implement `upstream_tree` pattern filtering and remapping ([f7fe174](https://github.com/git-ents/git-vendor/commit/f7fe174c07c846afe03055165df6e4c6e2b6484e))
+* Implement `vendor_paths`, resolving the local selection from `.gitattributes` ([a7bd9d2](https://github.com/git-ents/git-vendor/commit/a7bd9d279dd26502afa80e6f203f8905b1ff1f28))
+* Implement `vendor_status` ([73df0c5](https://github.com/git-ents/git-vendor/commit/73df0c558ae7674d6b78658688523b207e1599e5))
+* Implement `vendor_tip` via `try_find_reference` ([e1c0593](https://github.com/git-ents/git-vendor/commit/e1c05931bb2b1d6314f4101ef4fcdc7d12e7c161))
+* Implement CLI, extend VendorWorktree, and refactor gitattributes helpers ([f2b6e46](https://github.com/git-ents/git-vendor/commit/f2b6e46ea3ecd21e3d0d10dc98d8460aecf21068))
+* Implement PatternMapping and VendorConfig ([33cd3ba](https://github.com/git-ents/git-vendor/commit/33cd3ba7fc61ae461d653a1913e2006a1e4ddab4))
+* Implement VendorConfig and PatternMapping with tests ([33cd3ba](https://github.com/git-ents/git-vendor/commit/33cd3ba7fc61ae461d653a1913e2006a1e4ddab4))
+* Make name optional in add, defaulting to URL leaf ([5136a64](https://github.com/git-ents/git-vendor/commit/5136a64bec06be4c5ced748b2b223d81c1831676))
+* Normalize --prefix and stage-only add ([4d0b229](https://github.com/git-ents/git-vendor/commit/4d0b22955f1ff735cf03f3c5ad10d9e539086e57))
+* Preserve non-UTF-8 `ours` paths byte-for-byte in `ours_tree` ([098de11](https://github.com/git-ents/git-vendor/commit/098de11cfdc52699c98d8ed679f9743303fb88d0))
+* Project conflicted merges onto the working copy ([951eb6b](https://github.com/git-ents/git-vendor/commit/951eb6bde8f057a39b082a4ece7cd937ebb15ce8))
+* Record squashed upstream OID as a `Squashed-upstream` git trailer ([b6d305e](https://github.com/git-ents/git-vendor/commit/b6d305e300e26dcd818985cf0dd4dee19da92c0f))
+* Refuse to commit conflicted vendor merges and stub conflict checkout ([395b29c](https://github.com/git-ents/git-vendor/commit/395b29c42ceee1d136bb0348bc2468161767a5b6))
+* Reject conflicted `VendorMerge` in `commit_vendor` ([395b29c](https://github.com/git-ents/git-vendor/commit/395b29c42ceee1d136bb0348bc2468161767a5b6))
+* Remove `sync_attributes` method ([faa5cf3](https://github.com/git-ents/git-vendor/commit/faa5cf3119738777259c31a25fe6ceb47fa0013c))
+* Remove paths from vendor content filter in working-copy .gitattributes ([c760880](https://github.com/git-ents/git-vendor/commit/c760880acc1d962b6b303bc71714892735bd2e27))
+* Rename --ref-name to --ref ([03d8deb](https://github.com/git-ents/git-vendor/commit/03d8deba67e90e454d5b810e4389685a5d1c1dbc))
+* Select `vendor=<name>` attributed paths from the ours commit tree in `ours_tree` ([098de11](https://github.com/git-ents/git-vendor/commit/098de11cfdc52699c98d8ed679f9743303fb88d0))
+* Wire `vendor_paths` to `resolve_vendor_paths` ([a7bd9d2](https://github.com/git-ents/git-vendor/commit/a7bd9d279dd26502afa80e6f203f8905b1ff1f28))
+
+
+### Bug Fixes
+
+* .gitvendors included in commit tree and staged alongside .gitattributes ([4e50374](https://github.com/git-ents/git-vendor/commit/4e50374361cd724df409a8df775bf225af018660))
+* Allow local (file://) transport for non-bare repos ([9e1afb5](https://github.com/git-ents/git-vendor/commit/9e1afb5f8a8f60bf80dd9f9edb4534e3d3ad9d66))
+* Append trailing / to --prefix so it is always treated as a directory ([4d0b229](https://github.com/git-ents/git-vendor/commit/4d0b22955f1ff735cf03f3c5ad10d9e539086e57))
+* Avoid lossy UTF-8 conversion when writing .gitattributes ([ee6fc03](https://github.com/git-ents/git-vendor/commit/ee6fc03001a1744c9ab8858c0b16a6c6a09cda54))
+* Build the merge commit's tree by overlaying `result_tree` onto the parent ([881d96c](https://github.com/git-ents/git-vendor/commit/881d96cca6aab7a7f40d867438e117d17e3dff67))
+* Cmd_add always auto-commits ([4e50374](https://github.com/git-ents/git-vendor/commit/4e50374361cd724df409a8df775bf225af018660))
+* Cmd_remove stages index deletions for removed vendor files ([4e50374](https://github.com/git-ents/git-vendor/commit/4e50374361cd724df409a8df775bf225af018660))
+* Conflict path writes MERGE_HEAD and saves config before exiting ([4e50374](https://github.com/git-ents/git-vendor/commit/4e50374361cd724df409a8df775bf225af018660))
+* Correct git-vendor CLI orchestration edge cases ([4d9d57b](https://github.com/git-ents/git-vendor/commit/4d9d57b72fdd30e54b19fe5ae60abc521dc3a5e9))
+* Correct several CLI correctness bugs found in adversarial review ([4e50374](https://github.com/git-ents/git-vendor/commit/4e50374361cd724df409a8df775bf225af018660))
+* Error when all configured patterns are invalid instead of silently emptying the tree ([6561041](https://github.com/git-ents/git-vendor/commit/656104187478faba9ec4c89ccd20b8b9cb7d6318))
+* Escape glob metacharacters when writing .gitattributes patterns ([1b4bd84](https://github.com/git-ents/git-vendor/commit/1b4bd8482c6b679f5cc68b5128f8fa6499cdfc46))
+* Force `refs/vendor/<name>` to a direct ref after fetch ([329f141](https://github.com/git-ents/git-vendor/commit/329f141d0e7afa3e77158f5fe6e5b61cdd651218))
+* Gate `raw_paths` helper on `#[cfg(unix)]` ([48f6f51](https://github.com/git-ents/git-vendor/commit/48f6f515e403c444ae8d805aea15c611dd8c1777))
+* Guard against silently resolving a .gitattributes merge conflict ([867038d](https://github.com/git-ents/git-vendor/commit/867038ddce827db9c8b505ad2472024161fdf252))
+* Handle unborn HEAD with no `.git/index` in `checkout_vendor` ([5bb39fb](https://github.com/git-ents/git-vendor/commit/5bb39fb45ed2d3303aee3cb4362240ec1d8c2cd2))
+* Harden `upstream_tree` glob matching and path remapping ([3caa4ac](https://github.com/git-ents/git-vendor/commit/3caa4acf6fc818f74a6ce81a48af9a92e389fa6d))
+* Harden upstream_tree pattern indexing, path safety, and traversal ([6561041](https://github.com/git-ents/git-vendor/commit/656104187478faba9ec4c89ccd20b8b9cb7d6318))
+* Harden vendor worktree/attribute layer ([381ebb4](https://github.com/git-ents/git-vendor/commit/381ebb4b39458d3da7c3e54675b26114731f7d2b))
+* Import `ByteSlice` trait in `non_utf8_filename_is_preserved` ([48f6f51](https://github.com/git-ents/git-vendor/commit/48f6f515e403c444ae8d805aea15c611dd8c1777))
+* Make `remove` work on an unborn HEAD ([a796f3c](https://github.com/git-ents/git-vendor/commit/a796f3ca2d56beedf838e5d1e2a1cb438ce2480d))
+* Make advance_head a compare-and-swap on HEAD ([a75768a](https://github.com/git-ents/git-vendor/commit/a75768ad4aa5f86370970417f7b7d1bf13d58314))
+* Pair compiled globs with their PatternMapping to prevent index desync ([6561041](https://github.com/git-ents/git-vendor/commit/656104187478faba9ec4c89ccd20b8b9cb7d6318))
+* Peel fetched OID to a commit unconditionally ([f895e2b](https://github.com/git-ents/git-vendor/commit/f895e2b5c6975b39958b477908a0179b7f97b995))
+* Propagate `vendor_paths` errors in `update`/`apply` ([9ce6bb3](https://github.com/git-ents/git-vendor/commit/9ce6bb3de7e413300a2b379f270ca76bd6043057))
+* Prune empty ancestor directories after remove ([aa96571](https://github.com/git-ents/git-vendor/commit/aa965715a8991c033e31f1b638ffa0c1aefa9460))
+* Read upstream OID from outcome.ref_map rather than local vendor ref ([9e1afb5](https://github.com/git-ents/git-vendor/commit/9e1afb5f8a8f60bf80dd9f9edb4534e3d3ad9d66))
+* Read upstream OID from refmap to avoid HEAD-symref misresolution ([9e1afb5](https://github.com/git-ents/git-vendor/commit/9e1afb5f8a8f60bf80dd9f9edb4534e3d3ad9d66))
+* Refuse local transports ([23a6e4e](https://github.com/git-ents/git-vendor/commit/23a6e4e3d4201aa1a7157a96bf0e4c345b026697))
+* Reject `add <url> <existing-name>` instead of silently corrupting merge state ([1b5fd0c](https://github.com/git-ents/git-vendor/commit/1b5fd0c21ab9a77cf5a56068ba5b9f88f7907c43))
+* Reject `add` of a vendor name that already exists ([1b5fd0c](https://github.com/git-ents/git-vendor/commit/1b5fd0c21ab9a77cf5a56068ba5b9f88f7907c43))
+* Reject escaping or empty synthesized local paths via gix::validate::path::component ([6561041](https://github.com/git-ents/git-vendor/commit/656104187478faba9ec4c89ccd20b8b9cb7d6318))
+* Remove stale vendor symlinks during `checkout_vendor` ([5bb39fb](https://github.com/git-ents/git-vendor/commit/5bb39fb45ed2d3303aee3cb4362240ec1d8c2cd2))
+* Report `Error::Config` when a pattern maps to an empty local path ([3caa4ac](https://github.com/git-ents/git-vendor/commit/3caa4acf6fc818f74a6ce81a48af9a92e389fa6d))
+* Splice vendored content into the full tree on `commit_vendor` ([881d96c](https://github.com/git-ents/git-vendor/commit/881d96cca6aab7a7f40d867438e117d17e3dff67))
+* Split_attr_line returns None for comment and whitespace-only lines ([4e50374](https://github.com/git-ents/git-vendor/commit/4e50374361cd724df409a8df775bf225af018660))
+* Stage rewritten `.gitvendors` on `remove` ([5d8ab0b](https://github.com/git-ents/git-vendor/commit/5d8ab0b7fa6407b94128d8541b42c303b6a5704b))
+* Stop checkout_vendor from clobbering staged index entries ([a8d4d84](https://github.com/git-ents/git-vendor/commit/a8d4d840f494b0ff933de67b7494d7be94bcc441))
+* Stop multi-vendor `update` from clobbering earlier vendors' pending MERGE_HEAD ([1b5fd0c](https://github.com/git-ents/git-vendor/commit/1b5fd0c21ab9a77cf5a56068ba5b9f88f7907c43))
+* Track vendor paths when `add`/`update` conflicts ([32a39d8](https://github.com/git-ents/git-vendor/commit/32a39d85ca3c23fb7e6352eee39ade0257065823))
+* Untrack .gitattributes on `remove --keep-files` ([1784c17](https://github.com/git-ents/git-vendor/commit/1784c1703556405b280affc12a380448169043a7))
+* Use gitignore-like glob semantics in `upstream_tree` so `*` no longer crosses `/` ([3caa4ac](https://github.com/git-ents/git-vendor/commit/3caa4acf6fc818f74a6ce81a48af9a92e389fa6d))
+* Validate trackable paths before checkout mutates state ([cdb481c](https://github.com/git-ents/git-vendor/commit/cdb481c74f62f5ec43631ae8ab34b261394cf6d5))
+
 ## [1.0.0-alpha.1](https://github.com/git-ents/git-vendor/compare/git-vendor-v0.2.0...git-vendor-v1.0.0-alpha.1) (2026-03-26)