rodri-oliveira-dev · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -261,6 +261,9 @@ jobs:
       - name: Verify MCP GitHub Packages publication and backfill policy
         run: bash scripts/mcp-github-packages-policy-test.sh
 
+      - name: Verify independent component distribution policy
+        run: bash scripts/component-distribution-policy-test.sh
+
   github-action-contract:
     name: GitHub Action contract
     runs-on: ${{ vars.RUNNER_OS || 'ubuntu-26.04' }}

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,7 @@ Version links below point to GitHub Releases. Dates and previously shipped highl
 
 ### Added
 - Prepare an authenticated GitHub Packages distribution channel for future MCP versions and a separate manual backfill of the existing, immutable MCP 1.0.0 release. Package hash and commit provenance are validated before upload; NuGet.org and MCP Registry remain the primary publication channels.
+- Add opt-in one-based `line` and `column` evidence to schema 1.0 validation diagnostics and matching SARIF regions while preserving the default report shape and file-only findings when no precise location is known.
 
 ### Fixed
 - Fix the independent MCP release version-reservation step to distinguish HTTP 404 (create) from HTTP 200 (verify), cap GET/POST API responses to 64 KiB, and keep authorization tokens out of process arguments; add offline regression tests before any package publication.

diff --git a/Dockerfile b/Dockerfile
@@ -17,7 +17,7 @@ RUN dotnet publish src/AdrGuard/AdrGuard.csproj \
     --no-self-contained \
     /p:UseAppHost=true
 
-FROM mcr.microsoft.com/dotnet/runtime:10.0.13-azurelinux3.0@sha256:26d37c58334e91321cfc6b69f287b72f644ae9105d23238fde65c5a59733783e AS final
+FROM mcr.microsoft.com/dotnet/runtime:10.0.13-azurelinux3.0@sha256:0f82ccc5e4affe9f538d8fc5e14cc246e11459a72ebc5cef1ea2287625f6f2a3 AS final
 WORKDIR /workspace
 
 # Impact analysis invokes the bounded local Git CLI. The runtime remains

diff --git a/README.md b/README.md
@@ -1,9 +1,10 @@
 # ADR Guard
 
 [![CI](https://github.com/rodri-oliveira-dev/adr-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/rodri-oliveira-dev/adr-guard/actions/workflows/ci.yml)
-[![NuGet](https://img.shields.io/nuget/v/RodriOliveira.AdrGuard.svg)](https://www.nuget.org/packages/RodriOliveira.AdrGuard)
+[![CLI NuGet](https://img.shields.io/nuget/v/RodriOliveira.AdrGuard.svg?label=CLI%20NuGet)](https://www.nuget.org/packages/RodriOliveira.AdrGuard)
+[![MCP NuGet](https://img.shields.io/nuget/v/RodriOliveira.AdrGuard.Mcp.svg?label=MCP%20NuGet)](https://www.nuget.org/packages/RodriOliveira.AdrGuard.Mcp)
 [![VS Code Marketplace](https://img.shields.io/visual-studio-marketplace/v/rodrioliveira.adr-guard?label=VS%20Code%20Marketplace)](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard)
-[![GitHub Release](https://img.shields.io/github/v/release/rodri-oliveira-dev/adr-guard)](https://github.com/rodri-oliveira-dev/adr-guard/releases)
+[![CLI GitHub Release](https://img.shields.io/github/v/release/rodri-oliveira-dev/adr-guard?filter=v*&sort=semver&label=CLI%20release)](https://github.com/rodri-oliveira-dev/adr-guard/releases?q=v1.8.0)
 ![.NET](https://img.shields.io/badge/.NET-10.0-512BD4)
 [![License](https://img.shields.io/github/license/rodri-oliveira-dev/adr-guard)](LICENSE)
 
@@ -88,7 +89,7 @@ See the [selection matrix](docs/decision-design/choosing-a-template.md), [comple
 | CI reports | Produce text, JSON, or SARIF validation output | [Check reports](docs/check-reports.md) |
 | Agent Skills | Give agents portable instructions for human-controlled ADR and CLI workflows | [Skills guide](docs/skills/README.md) |
 
-Release status (verified against GitHub Releases on 2026-10-17): CLI `1.8.0` has a [published GitHub Release](https://github.com/rodri-oliveira-dev/adr-guard/releases/tag/v1.8.0) with its `.nupkg` asset. VS Code `1.1.0` and the independently versioned MCP `1.0.0` are prepared in source; the last project-documented Marketplace baseline is VS Code `1.0.0`, and an MCP package/Registry publication has not been verified. Check NuGet.org, the VS Code Marketplace, and the MCP Registry separately before assuming any prepared component is publicly installable. See the [compatibility matrix](docs/compatibility.md) for minimum CLI contracts, .NET/VS Code requirements, optional dependencies, and operation without MCP.
+Release status (verified on 2026-10-18): CLI `1.8.0` is published on [NuGet.org](https://www.nuget.org/packages/RodriOliveira.AdrGuard/1.8.0) and in its [GitHub Release](https://github.com/rodri-oliveira-dev/adr-guard/releases/tag/v1.8.0). VS Code `1.0.1` is published in the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard); version `1.1.0` remains a source/VSIX candidate. MCP `1.0.0` is published independently on [NuGet.org](https://www.nuget.org/packages/RodriOliveira.AdrGuard.Mcp/1.0.0), in its [GitHub Release](https://github.com/rodri-oliveira-dev/adr-guard/releases/tag/mcp/v1.0.0), and in the MCP Registry. See the [compatibility matrix](docs/compatibility.md) for exact component boundaries.
 
 The [published ADR Guard for VS Code extension](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard) includes the visual ADR list plus guided creation, editing, and settings. These screens require the CLI 1.7.0 form contracts. Extension and CLI versions remain independent.
 
@@ -100,7 +101,7 @@ Structured ADR creation and editing are implemented for trusted visual clients s
 
 The [GitHub Marketplace Action](https://github.com/marketplace/actions/adr-guard-architecture-decision-validator) and [Visual Studio Marketplace extension](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard) are published. The moving `@v1` tag is published and supports `check`, `index`, opt-in `review` since v1.1.6, and opt-in `impact` since v1.5.0. In v1.6.0, `drift` is provided through the CLI/direct-container workflow, alongside `new` and `draft`; it is not a composite Action mode. The extension does not bundle the CLI.
 
-The independent MCP `1.0.0` candidate, `RodriOliveira.AdrGuard.Mcp` packaging, Registry manifest, and manual release pipeline are implemented and tested in source. They remain unpublished until the first authorized `MCP Release` run completes and verifies NuGet.org, GitHub Releases, and the Registry; use a local package or source build meanwhile. See [MCP configuration](docs/mcp-configuration.md), [available tools](docs/mcp-tools.md), [VS Code integration](extensions/vscode/README.md#mcp-integration), and [security and permissions](docs/mcp-security.md).
+The independent MCP `1.0.0` release can be installed with `dotnet tool install --global RodriOliveira.AdrGuard.Mcp --version 1.0.0`. Its authenticated GitHub Packages backfill remains a separate manual distribution step; NuGet.org is the recommended source. See [MCP configuration](docs/mcp-configuration.md), [available tools](docs/mcp-tools.md), [VS Code integration](extensions/vscode/README.md#mcp-integration), and [security and permissions](docs/mcp-security.md).
 
 ## Agent Skills (P0 + P1)
 

diff --git a/README.pt-BR.md b/README.pt-BR.md
@@ -1,9 +1,10 @@
 # ADR Guard
 
 [![CI](https://github.com/rodri-oliveira-dev/adr-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/rodri-oliveira-dev/adr-guard/actions/workflows/ci.yml)
-[![NuGet](https://img.shields.io/nuget/v/RodriOliveira.AdrGuard.svg)](https://www.nuget.org/packages/RodriOliveira.AdrGuard)
+[![CLI NuGet](https://img.shields.io/nuget/v/RodriOliveira.AdrGuard.svg?label=CLI%20NuGet)](https://www.nuget.org/packages/RodriOliveira.AdrGuard)
+[![MCP NuGet](https://img.shields.io/nuget/v/RodriOliveira.AdrGuard.Mcp.svg?label=MCP%20NuGet)](https://www.nuget.org/packages/RodriOliveira.AdrGuard.Mcp)
 [![VS Code Marketplace](https://img.shields.io/visual-studio-marketplace/v/rodrioliveira.adr-guard?label=VS%20Code%20Marketplace)](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard)
-[![GitHub Release](https://img.shields.io/github/v/release/rodri-oliveira-dev/adr-guard)](https://github.com/rodri-oliveira-dev/adr-guard/releases)
+[![Release da CLI no GitHub](https://img.shields.io/github/v/release/rodri-oliveira-dev/adr-guard?filter=v*&sort=semver&label=release%20da%20CLI)](https://github.com/rodri-oliveira-dev/adr-guard/releases?q=v1.8.0)
 ![.NET](https://img.shields.io/badge/.NET-10.0-512BD4)
 [![License](https://img.shields.io/github/license/rodri-oliveira-dev/adr-guard)](LICENSE)
 
@@ -88,7 +89,7 @@ Consulte a [matriz de seleção](docs/decision-design/choosing-a-template.pt-BR.
 | Relatórios de CI | Produzir validação em texto, JSON ou SARIF | [Relatórios de check](docs/check-reports.pt-BR.md) |
 | Agent Skills | Oferecer instruções portáveis a agentes para fluxos de ADR e CLI controlados por pessoas | [Guia de Skills](docs/skills/README.pt-BR.md) |
 
-Situação das releases (verificada nas GitHub Releases em 2026-10-17): a CLI `1.8.0` possui [GitHub Release publicada](https://github.com/rodri-oliveira-dev/adr-guard/releases/tag/v1.8.0), com o respectivo `.nupkg` anexado. VS Code `1.1.0` e MCP `1.0.0`, versionados independentemente, estão preparados no código-fonte; a última baseline documentada do Marketplace é VS Code `1.0.0`, e a publicação de um pacote/entrada MCP no Registry não foi verificada. Confira separadamente NuGet.org, o Visual Studio Marketplace e o MCP Registry antes de considerar qualquer candidata disponível publicamente. Consulte a [matriz de compatibilidade](docs/compatibility.pt-BR.md) para contratos mínimos da CLI, requisitos de .NET/VS Code, dependências opcionais e operação sem MCP.
+Situação das releases (verificada em 18/10/2026): a CLI `1.8.0` está publicada no [NuGet.org](https://www.nuget.org/packages/RodriOliveira.AdrGuard/1.8.0) e em sua [GitHub Release](https://github.com/rodri-oliveira-dev/adr-guard/releases/tag/v1.8.0). A extensão VS Code `1.0.1` está publicada no [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard); a versão `1.1.0` continua sendo uma candidata em código-fonte/VSIX. O MCP `1.0.0` está publicado de forma independente no [NuGet.org](https://www.nuget.org/packages/RodriOliveira.AdrGuard.Mcp/1.0.0), em sua [GitHub Release](https://github.com/rodri-oliveira-dev/adr-guard/releases/tag/mcp/v1.0.0) e no MCP Registry. Consulte a [matriz de compatibilidade](docs/compatibility.pt-BR.md) para os limites exatos entre componentes.
 
 A [extensão ADR Guard para VS Code publicada](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard) inclui listagem visual de ADRs, criação orientada, edição e configurações. Essas telas exigem os contratos de formulário da CLI 1.7.0. As versões da extensão e da CLI permanecem independentes.
 
@@ -100,7 +101,7 @@ A criação e a edição estruturadas de ADRs estão implementadas para clientes
 
 A [Action no GitHub Marketplace](https://github.com/marketplace/actions/adr-guard-architecture-decision-validator) e a [extensão no Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard) estão publicadas. A tag móvel `@v1` está publicada e suporta `check`, `index`, `review` opcional desde a v1.1.6 e `impact` opcional desde a v1.5.0. Na v1.6.0, `drift` é disponibilizado por meio da CLI/container direto, assim como `new` e `draft`; não é um modo da Action composta. A extensão não inclui a CLI.
 
-A candidata MCP `1.0.0` independente, o empacotamento da .NET Tool `RodriOliveira.AdrGuard.Mcp`, o manifesto do Registry e o pipeline manual de release estão implementados e testados no código-fonte. Eles continuam não publicados até que a primeira execução autorizada de `MCP Release` conclua e verifique NuGet.org, GitHub Releases e Registry; use um pacote local ou build do código-fonte enquanto isso. Consulte a [configuração do MCP](docs/mcp-configuration.pt-BR.md), as [ferramentas disponíveis](docs/mcp-tools.pt-BR.md), a [integração com VS Code](extensions/vscode/README.pt-BR.md#integração-mcp) e [segurança e permissões](docs/mcp-security.pt-BR.md).
+A release independente MCP `1.0.0` pode ser instalada com `dotnet tool install --global RodriOliveira.AdrGuard.Mcp --version 1.0.0`. Seu backfill autenticado para GitHub Packages continua sendo uma etapa manual de distribuição; NuGet.org é a fonte recomendada. Consulte a [configuração do MCP](docs/mcp-configuration.pt-BR.md), as [ferramentas disponíveis](docs/mcp-tools.pt-BR.md), a [integração com VS Code](extensions/vscode/README.pt-BR.md#integração-mcp) e [segurança e permissões](docs/mcp-security.pt-BR.md).
 
 ## Agent Skills (P0 + P1)
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -16,16 +16,16 @@ https://github.com/rodri-oliveira-dev
 
 Please include privately:
 
-- affected ADR Guard version / Action ref;
-- affected execution mode (.NET Tool, container, GitHub Action);
+- affected component and version / Action ref;
+- affected execution mode (.NET Tool, MCP server, VS Code extension, container, or GitHub Action);
 - impact and attack prerequisites;
 - minimal reproduction;
 - whether the issue is already public;
 - suggested mitigation if known.
 
 ## GitHub Action security model
 
-The reusable Action is intentionally limited to deterministic `check` and `index` operations. It does not expose AI `draft` provider credentials.
+The reusable Action supports deterministic `check` and `index`, opt-in advisory or policy-enforced `review`, and opt-in advisory `impact`. It does not expose `new`, `draft`, `baseline`, or `drift` as Action commands. Review credentials are accepted only through the caller step environment after review is selected explicitly; they are never Action inputs.
 
 Its runtime hardening, token model, workspace write boundaries, anonymous GHCR pull policy, version pinning, and annotation escaping are documented in:
 
@@ -34,7 +34,7 @@ Its runtime hardening, token model, workspace write boundaries, anonymous GHCR p
 
 ## Secret handling
 
-Never place provider API keys or repository secrets in ADR Markdown, workflow inputs, issue reports, or command-line arguments. The default GitHub Action does not request provider API keys or forward the runner environment into its container.
+Never place provider API keys or repository secrets in ADR Markdown, workflow inputs, issue reports, or command-line arguments. `check`, `index`, and `impact` do not require provider credentials. For explicit `review`, supply only the selected provider variable through the caller step environment as documented; the Action validates the provider-specific environment before forwarding it to the isolated container.
 
 ## Disclosure
 

diff --git a/SUPPORT.md b/SUPPORT.md
@@ -10,8 +10,8 @@ https://github.com/rodri-oliveira-dev/adr-guard/issues
 
 Before opening an issue, include:
 
-- ADR Guard version or Action ref;
-- execution mode (.NET Tool, container, or GitHub Action);
+- component and version (CLI, MCP, or VS Code extension) or Action ref;
+- execution mode (.NET Tool, MCP server, VS Code extension, container, or GitHub Action);
 - operating system / runner;
 - the command or relevant workflow fragment;
 - expected behavior;
@@ -22,14 +22,16 @@ Do not include API keys, tokens, private ADR content, credentials, or other secr
 
 ## Releases
 
-Release notes and downloadable package assets are available at:
+CLI and MCP release notes and downloadable package assets are available at:
 
 https://github.com/rodri-oliveira-dev/adr-guard/releases
 
+The CLI and MCP server use separate NuGet packages and version streams. The VS Code extension uses its own version stream: install the published version from the Visual Studio Marketplace, or download a validated release-candidate VSIX from the extension workflow artifacts, retained for 21 days.
+
 ## Security reports
 
 Do not disclose an unpatched vulnerability in a public support issue. Follow [SECURITY.md](SECURITY.md) instead.
 
 ## Marketplace
 
-Marketplace listing URL (provided by the repository owner on 2026-10-07): [ADR Guard - Architecture Decision Validator](https://github.com/marketplace/actions/adr-guard-architecture-decision-validator). Independent public-access verification remains pending under issue #49. See [docs/github-marketplace.md](docs/github-marketplace.md).
+The [ADR Guard GitHub Action](https://github.com/marketplace/actions/adr-guard-architecture-decision-validator) and [ADR Guard for VS Code](https://marketplace.visualstudio.com/items?itemName=rodrioliveira.adr-guard) have public Marketplace listings. The extension Marketplace release and workflow-produced VSIX candidates may have different versions; check the [compatibility matrix](docs/compatibility.md) before reporting a version-specific problem.
diff --git a/docs/check-reports.md b/docs/check-reports.md
@@ -1,8 +1,10 @@
 # JSON, SARIF, and GitHub Code Scanning
 
-`adr-guard check --format json` emits the versioned [ADR Guard check report v1 schema](schemas/adr-check-report-v1.schema.json). Diagnostics are ordered by file, code, and message. `valid` reflects structural validation; the summary and file list make empty/success reports explicit.
+> `--diagnostic-locations` is currently available only in source builds and is not included in the published CLI 1.8.0 package. The existing JSON and SARIF output remains the published default.
 
-`adr-guard check --format sarif` emits SARIF 2.1.0. Each ADR diagnostic becomes a result with its stable `ruleId`, message, severity, and workspace-appropriate artifact URI. ADR Guard does not own reliable Markdown source positions, so it does not invent a line/region.
+`adr-guard check --format json` emits the versioned [ADR Guard check report v1 schema](schemas/adr-check-report-v1.schema.json). Diagnostics are ordered by file, code, and message. `valid` reflects structural validation; the summary and file list make empty/success reports explicit. Add `--diagnostic-locations` to opt in to optional one-based `line` and `column` properties when the validator can identify a source location from parsed Markdown. The properties are omitted together when the evidence identifies only the file. Without the flag, output remains compatible with strict schema `1.0` clients that predate these optional properties.
+
+`adr-guard check --format sarif` emits SARIF 2.1.0. Each ADR diagnostic becomes a result with its stable `ruleId`, message, severity, and workspace-appropriate artifact URI. With `--diagnostic-locations`, known positions become a `region`; file-only diagnostics omit it. ADR Guard never invents a line or column when the validator lacks location evidence.
 
 Keep the normal validation job read-only. If Code Scanning upload is desired, use a separate job/step and grant only that job `security-events: write`: