fix(adms): align API surface with live ADMS wire format

.github/dependabot.yml

@@ -1,29 +1,22 @@
 version: 2
 updates:
-  # Python pip dependencies
-  # Non-major (minor + patch) version updates are batched into one grouped PR;
-  # majors are left ungrouped so each breaking bump lands in its own PR for
-  # review. Security updates (enabled in repo settings) come as a separate
-  # grouped PR of their own
+  # Python pip dependencies - security updates only
+  # Regular version updates are disabled because we use compatible release
+  # constraints (~=) in pyproject.toml to pin patch versions.
+  # Dependabot Security Updates (enabled in repo settings) bypass these rules.
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
       time: "09:00"
-    groups:
-      version-minor-patch:
-        patterns:
-          - "*"
+    # Ignore all regular version updates - security updates still come through
+    ignore:
+      - dependency-name: "*"
         update-types:
-          - "minor"
-          - "patch"
-      security:
-        applies-to: security-updates
-        patterns:
-          - "*"
-    labels:
-      - "dependencies"
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
     # Commit message configuration
     commit-message:
       prefix: "chore"
@@ -46,11 +39,6 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
-    # Batch all Actions bumps (including majors) into one PR
-    groups:
-      github-actions:
-        patterns:
-          - "*"
     commit-message:
       prefix: "chore"
       include: "scope"

.github/pull_request_template.md

@@ -42,8 +42,6 @@ Before submitting your PR, please review and check the following:
 - [ ] I have added type hints for all public APIs
 - [ ] My code does not contain sensitive information (credentials, tokens, etc.)
 - [ ] I have followed [Conventional Commits](https://www.conventionalcommits.org/) for commit messages
-- [ ] *(New modules only)* I have attached e2e evidence showing the module working against a real BTP service
-- [ ] *(Security-sensitive changes only)* I have run `/security-review` and addressed all ❌ findings
 
 ## Breaking Changes
 

.github/workflows/check-version-bump.yaml

@@ -18,23 +18,29 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Reject manual version bumps in pyproject.toml
+      - name: Check that version was bumped if src/ was modified
         run: |
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-          MERGE_BASE=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
-
-          BASE_VERSION=$(git show "$MERGE_BASE:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
-          HEAD_VERSION=$(git show "$HEAD_SHA:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
-
-          if [[ "$BASE_VERSION" != "$HEAD_VERSION" ]]; then
-            echo "ERROR: Manual version bump detected in pyproject.toml."
-            echo "  Base: $BASE_VERSION"
-            echo "  PR:   $HEAD_VERSION"
-            echo ""
-            echo "The version is managed automatically by the release pipeline."
-            echo "Remove the version change from pyproject.toml and use /release-prep to trigger a release."
-            exit 1
-          fi
 
-          echo "Version unchanged ($HEAD_VERSION) — OK."
+          CHANGED_FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
+
+          if echo "$CHANGED_FILES" | grep -qE "^src/.*\.(py|pyi|proto)$"; then
+            BASE_VERSION=$(git show "$BASE_SHA:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
+            HEAD_VERSION=$(git show "$HEAD_SHA:pyproject.toml" | grep "^version = " | cut -d'"' -f2)
+
+            if [ "$BASE_VERSION" = "$HEAD_VERSION" ]; then
+              echo "ERROR: Source files under src/ were modified but the version in pyproject.toml was not bumped (still $HEAD_VERSION)."
+              exit 1
+            fi
+
+            HIGHER=$(printf '%s\n' "$BASE_VERSION" "$HEAD_VERSION" | sort -V | tail -1)
+            if [ "$HIGHER" != "$HEAD_VERSION" ]; then
+              echo "ERROR: Version regression detected. Base is $BASE_VERSION but PR has $HEAD_VERSION."
+              exit 1
+            fi
+
+            echo "Version bump OK: $BASE_VERSION → $HEAD_VERSION"
+          else
+            echo "No source file changes under src/. Version bump not required."
+          fi