Publish gate: refuse a manifest the fleet's enforcer lib cannot read

plugins/geenforce/plugin.py

@@ -218,13 +218,21 @@ class GeEnforcePlugin(BasePlugin):
         @click.argument('scopename')
         @click.option('--phase', default='runtime')
         @click.option('--notes', default=None)
-        def publish_cmd(scopename, phase, notes):
+        @click.option('--force', is_flag=True,
+                      help='Publish even when reporting PCs run an older '
+                           'enforcer lib than the manifest requires.')
+        def publish_cmd(scopename, phase, notes, force):
             """Freeze the current draft of a scope into a published snapshot."""
             from flask import current_app
-            from .service import publish_scope
+            from .service import publish_scope, LibVersionTooOldError
 
             with current_app.app_context():
-                version = publish_scope(scopename, phase, notes=notes)
+                try:
+                    version = publish_scope(scopename, phase, notes=notes,
+                                            force=force)
+                except LibVersionTooOldError as error:
+                    click.echo(click.style(f'REFUSED: {error}', fg='red'))
+                    raise SystemExit(1)
                 db.session.commit()
                 click.echo(f"Published {scopename}/{phase} as v{version}.")