Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/geenforce/models/manifest.py

@@ -49,6 +49,15 @@ class ManifestScope(BaseModel):
     computertypeid = db.Column(db.Integer, nullable=True)
     measuringtooltypeid = db.Column(db.Integer, nullable=True)
     manifestversion = db.Column(db.String(16), nullable=False, default='1.0')
+    # Lowest GE-Enforce client library that may enforce this scope, e.g. '2.6'.
+    #
+    # SEPARATE FROM manifestversion, which is the manifest's own 'Version' field
+    # and is whatever its author wrote - seed_display_scope picks '2.0'. The
+    # publish gate used manifestversion as the library floor, so for every
+    # code-authored scope it compared the fleet against a number that says
+    # nothing about library features, and passed. NULL means "derive it", see
+    # service.required_libversion.
+    minlibversion = db.Column(db.String(16), nullable=True)
     description = db.Column(db.String(255), nullable=True)
     # The manifest-level '_comment' (documentation), preserved verbatim so
     # export-to-share round-trips it. Excluded from behavioral parity.