forward-netbox 2.3.0__tar.gz → 2.3.2__tar.gz

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forward-netbox
-Version: 2.3.0
+Version: 2.3.2
 Summary: NetBox plugin to sync Forward data into NetBox via built-in NQE queries
 License: MIT
 License-File: LICENSE
@@ -8,7 +8,7 @@ Keywords: netbox,forward,plugin,sync,nqe
 Author: Craig Johnson
 Author-email: craigjohnson@forwardnetworks.com
 Requires-Python: >=3.10,<4.0
-Classifier: Development Status :: 5 - Production/Stable
+Classifier: Development Status :: 4 - Beta
 Classifier: Framework :: Django
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: System Administrators
@@ -23,7 +23,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: System :: Networking
 Requires-Dist: httpx (>0.26,<0.29)
 Requires-Dist: netboxlabs-netbox-branching (>=1.1.0)
-Requires-Dist: pyzipper (>=0.3.6,<0.4.0)
+Requires-Dist: pyzipper (>=0.3.6,<0.5.0)
 Project-URL: Changelog, https://github.com/forwardnetworks/forward-netbox/blob/main/CHANGELOG.md
 Project-URL: Documentation, https://github.com/forwardnetworks/forward-netbox/tree/main/docs
 Project-URL: Homepage, https://github.com/forwardnetworks/forward-netbox
@@ -31,17 +31,77 @@ Project-URL: Issue Tracker, https://github.com/forwardnetworks/forward-netbox/is
 Project-URL: Repository, https://github.com/forwardnetworks/forward-netbox
 Description-Content-Type: text/markdown
 
-# Forward Field Integration
+# Forward Integration for NetBox
 
-**Forward Field Integration** (`forward_netbox`) is a NetBox plugin that syncs Forward inventory into NetBox through direct Forward API connectivity and NQE while preserving the branch-backed sync, diff, and merge workflow.
+**Forward Integration for NetBox** (`forward_netbox`) is a NetBox plugin that syncs Forward Networks inventory into NetBox.
 
-Forward 26.6 is the baseline for async NQE.
+[![PyPI](https://img.shields.io/pypi/v/forward-netbox)](https://pypi.org/project/forward-netbox/)
+[![CI](https://github.com/forwardnetworks/forward-netbox/actions/workflows/ci.yml/badge.svg)](https://github.com/forwardnetworks/forward-netbox/actions/workflows/ci.yml)
+
+## Status
+
+- **Support model:** field integration reference — **not** an officially
+  supported Forward Networks product.
+- **Requires:** NetBox `4.6.4`, `netbox-branching` `1.1.0+`; Forward `26.6`
+  baseline for async NQE (full matrix in
+  [Release Compatibility](#release-compatibility)).
+- **Distribution:** PyPI (`forward-netbox`) + GitHub releases.
+
+## What It Does
+
+It pulls your Forward-discovered inventory into NetBox — devices, interfaces, IP addresses, prefixes, VLANs, VRFs, cables, LAGs, MAC addresses, and inventory items. It runs Forward NQE against a chosen snapshot, stages every change in a `netbox_branching` branch so you can review the diff, then merges when it looks right.
+
+On top of the import it adds scope control (sync only devices carrying chosen Forward tags), orphan pruning, per-device analysis (reachability, connectivity blast-radius, CVE exposure), a drift report, and snapshot selection.
+
+## What It Does Not Do
+
+- **It does not write back to Forward.** The sync is one-way, Forward → NetBox;
+  Forward stays the source of truth and the plugin keeps NetBox populated from
+  what Forward collected. (The drift report only *compares* the two.)
+- **It is not a source of truth for Forward configuration or intent** — it
+  populates NetBox from Forward's collected snapshot, nothing more.
+- **It does not require** the optional `netbox-routing` / `netbox-peering-manager`
+  plugins unless you enable the beta BGP/OSPF maps.
+
+## Screenshots
+
+**Sync — health, enabled models, and actions**
+
+![Forward sync detail](docs/assets/screenshots/sync-detail.png)
+
+**Staged ingestion — progress, snapshot metrics, and issues**
+
+![Forward ingestion detail](docs/assets/screenshots/ingestion-diff.png)
+
+**Drift report — per-model NetBox-vs-Forward divergence**
+
+![Drift report](docs/assets/screenshots/drift-report.png)
+
+**Forward sources**
+
+![Forward sources list](docs/assets/screenshots/sources.png)
+
+## Architecture
+
+Forward NQE runs against a selected snapshot to fetch inventory, each model's
+rows are staged into a `netbox_branching` branch as a reviewable per-model diff,
+and you merge when the changes look correct. Large baselines can use a
+`Fast bootstrap` direct-write backend; steady-state runs use Branching with
+Forward `nqe-diffs` so every change is reviewable. See the
+[Architecture Flow](docs/02_Reference/architecture-flow.md) reference for detail.
 
 ## Release Compatibility
 
+Latest release requires NetBox `4.6.4` and `netbox-branching` `1.1.0+`. Expand for the full per-release history and notes.
+
+<details>
+<summary>Release compatibility history</summary>
+
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.3.0` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; GA/enterprise hardening: encrypted Forward credential at rest, PyPI Trusted Publishing + SBOM, Prometheus metrics + stuck-job alert, populated-DB upgrade test, dead-code removal (multi_branch/density-learning), reliability fixes (jittered/Retry-After backoff, SaaS rate clamp, PK-anchored device prune), and supported-product framing. Drop-in from 2.2.5 — stored credentials auto-encrypt on save; rotating SECRET_KEY requires re-entering them. |
+| `v2.3.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Feature: optional import of Forward SNMP endpoints (e.g. Avocent console servers) as NetBox devices — off by default (`sync_endpoints`), enabled per source and scoped by the same device tags. |
+| `v2.3.1` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.3.2`;  |
+| `v2.3.0` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.3.1`; GA/enterprise hardening: encrypted Forward credential at rest, PyPI Trusted Publishing + SBOM, Prometheus metrics + stuck-job alert, populated-DB upgrade test, dead-code removal (multi_branch/density-learning), reliability fixes (jittered/Retry-After backoff, SaaS rate clamp, PK-anchored device prune), and supported-product framing. Drop-in from 2.2.5 — stored credentials auto-encrypt on save; rotating SECRET_KEY requires re-entering them. |
 | `v2.2.5` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.3.0`; Feature: operator-selectable **Sync Device Tags** — pick which Forward device tags (e.g. `Mgmt_*`) become NetBox device tags (replaces the hardcoded feature-tag set); Fix dependency-preview AttributeError + vsys job pile-up guard (hung pending); test/require NetBox 4.6.4 |
 | `v2.2.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.5`; Hotfix: device-analysis NQE (bare foreach) errored refresh + CVE list; surface job errors into job.data |
 | `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.4`; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
@@ -137,91 +197,14 @@ Forward 26.6 is the baseline for async NQE.
 | `v0.3.0.1` | `4.5.8` validated; `4.5.x` only | Superseded by `v0.3.1` |
 | `v0.3.0` | `4.5.8` validated; `4.5.x` only | Superseded by `v0.3.0.1` |
 
-## Version History
-
-| Release | Summary |
-| --- | --- |
-| `v1.5.0.1` | Fixes platform NQE query (`normalizePlatformName`), adds `--overwrite` to validation-org repair, hardens org-publish commit to retry on 409 INVALID_CHANGE_PATH. |
-| `v1.5.0` | Hardens ingest throughput: adaptive async-NQE poll backoff, ndjson streaming, webhook/event-rule signal suppression during apply, targeted validation on existing objects (skips DB-hitting uniqueness checks in both bulk engine paths), and async advanced-reachability trigger (FWD-53559). Full suite green on NetBox 4.5.9 and 4.6.2. |
-| `v1.4.3` | Hardens query provenance with source-backed query-id repair during preflight, adds async execution path readiness for 26.6 with resilient NDJSON/JSONL result handling, and proves CIMC/APIC platform/type updates from command-source evidence while preserving prior 1.4 protections. |
-| `v1.4.2` | Adds CIMC platform separation, visible query-drift repair and dependency preview on the sync detail page, and keeps module-bay merge hardening plus parent-interface description preservation. |
-| `v1.4.1.1` | Prevents optional module sync from creating `dcim.modulebay` side-effect changes during merge, skips missing module bays with a readiness/import warning, and keeps LAG member rows from clearing existing parent interface descriptions. |
-| `v1.4.1` | Publishes the 1.4 patch release line with query-ID drift remediation and support-bundle diagnostics on top of the parent-device contract and release surfaces. |
-| `v1.3.6` | Enforces a hard parent-device sync contract so child models cannot run without `dcim.device`, preventing stale sync configs from skipping the device shard and breaking dependent imports. |
-| `v1.3.5.5` | Adds compressed support-bundle ZIP downloads with optional password protection and folds live source/query-drift/data-file diagnostics into the troubleshooting bundle. |
-| `v1.3.5.4` | Republishes the `v1.3.5.3` query-contract hardening as the prior patch release. |
-| `v1.3.5.3` | Preserves the claimed-step and payload-compaction protections from `v1.3.5.2`, adds strict shipped-query parameter-contract validation, strips legacy tag aliases from runtime NQE payloads, and keeps support-bundle previews summary-only. |
-| `v1.3.5.2` | Prevents shard execution drift by tying resume/overlap workers to the claimed execution step and compacts sync execution payloads (`plan_items`, workload previews, and advisory branch summaries) so large runs remain user-visible but lightweight in UI/log exports. |
-| `v1.3.5.1` | Removes the raw `model_results` payload from sync telemetry summaries and stops unparameterized query IDs from inheriting source-level tag parameters, which keeps sync-detail rendering responsive while preserving the saved-query-ID path. |
-| `v1.3.5` | Tightens the saved-query-ID path for 1.3.x, keeps shipped maps parameter-compatible with `forward_netbox_shard_keys`, and uses command-inventory signals to avoid misclassifying ACI platforms during repeat syncs. |
-| `v1.3.4` | Makes non-retryable Branching merge errors operator-visible by persisting the failure reason before the job terminates, marks branches still stuck in `Merging` as `Failed`, preserves timeout/transient retry behavior, and adds disabled-by-default async NQE client support for the future Forward 26.6 execution API. |
-| `v1.3.3` | Refreshes shipped NQE syntax so saved query IDs accept the standard `forward_netbox_shard_keys` parameter payload, republishes the saved validation-folder query set, and validates the affected saved query IDs against a live Forward SaaS dataset. |
-| `v1.3.2` | Adds optional `netbox-cisco-aci` plugin support with disabled-by-default ACI fabric, pod, node, tenant, VRF, and filter maps; keeps deeper ACI policy maps conservative until source identity is proven; and hardens duplicate ACI node observations so repeat syncs remain no-op when source data is unchanged. |
-| `v1.3.1` | Fixes repeat prefix sync accounting by treating unchanged NetBox `ipam.prefix` rows as unchanged, avoids dependency VRF metadata rewrites from prefix/IP/FHRP imports, removes the legacy sync column-filter shard path, and preserves the `v1.3.0` parameterized NQE path. |
-| `v1.3.0` | Eliminates default Forward NQE column-filter shard fetches in favor of query-side `forward_netbox_shard_keys` parameters, keeps local shard safety filtering, and preserves branch boundaries while reducing Forward SaaS API/NQE pressure. |
-| `v1.2.3` | Coalesces compatible sibling shard column-filter fetches into bounded EQUALS_ANY requests, caches prefetched sibling rows locally to avoid repeated Forward calls, and surfaces local Branching change-explainability summaries in support bundles and the ingestion UI. |
-| `v1.2.2` | Adds operator-visible Forward API usage budgets/rate evidence in Sync Health and support bundles, extends repeat-sync no-op hardening across key adapters, and persists successful staged deletes into ingestion statistics so active delete shards are visible before merge accounting catches up. |
-| `v1.2.1` | Fixes repeat prefix sync churn where otherwise unchanged `ipam.prefix` rows could be updated only because the VRF foreign key was re-resolved; built-in prefix maps now use exact `prefix + vrf` identity while prefix shard fetches still use parameterized NQE. |
-| `v1.2.0` | Adds optional NetBox-native HSRP/VRRP FHRP import from Forward native FHRP state, bounded access/native interface VLAN assignment from existing site-scoped VLANs, keeps FHRP upgrade behavior safe for existing 1.1 IPAM data, and hardens current NetBox job-test compatibility. |
-| `v1.1.1` | Adds optional NetBox-native HSRP/FHRP import from Forward native FHRP state, keeps FHRP upgrade behavior safe for existing 1.1 IPAM data, and hardens current NetBox job-test compatibility. |
-| `v1.1.0` | Adds Forward SaaS API request pacing, parameterized prefix shard execution, single-pass interface NQE, configured max-shard persistence in smoke evidence, and release-validation gates for API/NQE scale validation. |
-| `v1.0.0` | Introduced the first `v1.0.0` release line and initial API/NQE release validation flow before the 1.1 runtime and request-pacing enhancements. |
-| `v0.9.4.6` | Tightens delete-heavy `dcim.device` cleanup planning to about 500 planned delete rows per 10k branch-change budget after live shard evidence showed the earlier estimate was still too high. |
-| `v0.9.4.5` | Plans delete-heavy `dcim.device` cleanup shards with a conservative row budget so tag-scope prune runs do not pack thousands of cascading device deletes into one Branching shard. |
-| `v0.9.4.4` | Clarifies large branching progress by clamping utilization display to 100% during intermediate accounting overshoots and showing current shard row progress in the ingestion UI. |
-| `v0.9.4.3` | Converts NetBox protected-reference delete failures into dependency skips so large tag-scope prune/device cleanup runs continue without shard-failing delete rows. |
-| `v0.9.4.1.1` | Keeps the shared 4.5/4.6 branch line, execution ledger, support logging, and scale hardening while preserving the read-only advisory surfaces from `v0.9.0`. |
-| `v0.9.0` | Adds read-only analysis, workload preview, advisory summaries, and native log export for troubleshooting while keeping lifecycle enrichment and predict deferred. |
-| `v0.8.6.3` | Hardens beta routing scope resolution, filters invalid BGP ASN rows in shipped NQE, skips positionless virtual-chassis rows conservatively, and lets fast bootstrap retain its diff baseline when only optional model issues remain. |
-| `v0.8.6.2` | Hardens issue and job-log rendering for JSON safety when unexpected nested payload objects leak into failure data. |
-| `v0.8.6.1` | Clarifies NQE map bulk edit labels and help text so operators use repository query paths and understand query IDs are resolved automatically during sync and diff execution. |
-| `v0.8.6` | Publishes flattened built-in NQE to Forward org repositories, filters IPv4 host/any/loopback prefix artifacts, reports IP rows missing imported parent prefixes on full baselines, and prevents stale virtual-chassis/device/routing row failures from blocking unrelated models. |
-| `v0.8.5` | Makes the beta routing and module maps broadly available by default, preserves the conservative bundled virtual chassis map, handles Forward repository query lookups that return a `queries` list, and makes failed sync activity show the terminal failure instead of stale row heartbeat text. |
-| `v0.8.3` | Isolates stale or invalid per-model query output, rejects virtual-chassis rows missing `vc_position`, records row issues without aborting later multi-branch shards, and prevents dirty runs from becoming diff baselines. |
-| `v0.8.2` | Adds portable repository `query_path` execution with Forward-backed selectors, true native bulk edit for publishing bundled NQE into the Forward Org Repository, binding selected maps to repository paths, restoring bundled raw NQE, and clearer skipping for IP address rows whose interface cannot be resolved. |
-| `v0.8.1.1` | Emits `vc_position` in the built-in virtual chassis NQE map for vPC and MLAG memberships so NetBox does not reject virtual chassis device assignments without a member position. |
-| `v0.8.1` | Runs fast bootstrap inside native NetBox change tracking, shows branchless ingestion changes from `ObjectChange` rows, updates fast-bootstrap counters from real object changes, warns about undersized worker timeouts, and retries transient Forward API HTTP timeouts/gateway responses. |
-| `v0.8.0` | Adds an opt-in fast bootstrap direct-write backend for trusted large baselines, keeps NQE validation and row adapters shared with Branching, and skips LAG cable endpoints that NetBox cannot cable directly. |
-| `v0.7.1` | Keeps the NetBox-native multi-branch workflow stable while hardening cable ingestion, retry handling, and shard re-planning for large runs. |
-| `v0.7.0` | Splits the remaining sync orchestration, reporting, and validation helpers into dedicated boundaries, adds shard heartbeat visibility, and preserves the NetBox-native branch workflow. |
-| `v0.6.5` | Adds audited validation force-allow overrides and routing evidence enrichment while reducing skipped routing rows through conservative NQE-side identity inference. |
-| `v0.6.4` | Adds beta optional routing and peering imports for `netbox-routing` and `netbox-peering-manager`, including BGP peers, BGP address families, OSPF objects, peering sessions, routing diagnostics, and query-ID-aware built-in map handling. |
-| `v0.6.3` | Models Forward aggregate interfaces as native NetBox LAGs, attaches member interfaces through `Interface.lag`, and keeps the MTU value sourced from Forward's normalized interface field. |
-| `v0.6.2` | Canonicalizes duplicate global-table IP address rows by host IP before import and records row-scoped apply/delete failures as ingestion issues without aborting the rest of the shard. |
-| `v0.6.1` | Filters interface IP rows that NetBox cannot assign, such as subnet network IDs and IPv4 broadcasts, while reporting aggregate diagnostics for filtered addresses. |
-| `v0.6.0` | Adds beta native `dcim.module` import for chassis modules and similar bay-aware hardware, improves inventory item normalization, and avoids duplicate generic inventory rows when beta module sync is enabled. |
-| `v0.5.9.1` | Keeps job logs visible during execution by persisting plugin log entries into the native NetBox job log tab while preserving the full plugin ingestion log view. |
-| `v0.5.9` | Balances query preflight and workload fetch with bounded parallelism, reducing long planning pauses on large datasets. |
-| `v0.5.8` | Defers event flushing until commit so large prefix ingestions do not trip transaction state changes mid-run. |
-| `v0.5.5` | Applies a consistent model conflict policy for cable sync rows: skip occupied-interface conflicts, aggregate warning spam, and keep non-conflict updates/creates unchanged. |
-| `v0.5.4` | Persists ingestion change counters so list/detail values stay consistent after branch merge cleanup, matching merge summaries. |
-| `v0.5.3` | Surfaces preflight activity and elapsed phase timing on sync detail, emits early phase logs before ingestion rows, and sets source status to `Syncing` while runs are active. |
-| `v0.5.2.1` | Fixes plugin admin version display and ships inferred cable query parser compatibility update (no `let` declarations) while preserving synthetic endpoint filtering. |
-| `v0.4.0` | Corrects built-in IPv4/IPv6 prefix NQE filters to exclude host routes (`/32` and `/128`) from prefix import and validates the behavior against a live smoke dataset. |
-| `v0.3.1` | Adds optional data-file-aware device type alias maps, a Device Type Library alias data-file builder, and documentation for the snapshot requirement while keeping the default no-data-file maps available. |
-| `v0.3.0.1` | Fixes the validation-run list UI by removing unsupported edit actions from read-only validation records, and adds Playwright coverage for the validation-run list route. |
-| `v0.3.0` | Adds the NetBox 4.5.8-validated harness architecture with first-class validation runs, drift policies, query-fetch boundaries, model-result reporting, and Playwright-covered UI workflow validation. |
-| `v0.2.4` | Hardens native multi-branch resilience with adaptive shard splitting and retry on branch-budget overflow, plus model-density tracking to keep large initial syncs within NetBox branching guidance. |
-| `v0.2.3` | Adds native sync preflight validation before full multi-branch planning so invalid model/query rows fail earlier in the UI/API run path. |
-| `v0.2.2` | NQE-only correction release: filters zero-length prefixes, broadens interface coverage for IP assignment targets, and enforces inventory `part_id` length limits. |
-| `v0.2.1` | Makes NetBox-native multi-branch execution the only UI/API sync path and exposes the branch budget in the sync form. |
-| `v0.2.0` | Adds NetBox-native multi-branch baseline syncs for large datasets, uses NetBox outbound proxy routing for Forward API calls, and keeps branch event queues bounded during large imports. |
-| `v0.1.6.0` | Adds explicit diff baselines, Forward `nqe-diffs` execution for eligible `query_id` maps, and updated large-dataset guidance for baseline versus incremental syncs. |
-| `v0.1.5.1` | Patch release that validates and hardens null-VRF coalesce behavior and inventory-item serial bounds against the live dataset. |
-| `v0.1.5` | Fixes null VRF coalesce handling, imports loopback interfaces for IP attachment, and hardens inventory-item identity fallbacks. |
-| `v0.1.4.2` | CI/package patch release that applies repository formatting/import-order fixes and publishes a clean artifact line. |
-| `v0.1.4.1` | Patch release that bounds built-in `dcim.virtualchassis` names/domains to NetBox field limits. |
-| `v0.1.4` | Hardened built-in NQE mappings and docs for large real-world datasets. |
-| `v0.1.3` | Enforced deterministic model identity contracts during sync ingestion. |
-| `v0.1.2` | Improved ingestion safety, diagnostics, and compatibility with custom NetBox data. |
-| `v0.1.1` | Added pagination, shared built-in NQE helpers, and release/doc cleanup. |
-| `v0.1.0` | Initial unsupported NetBox plugin release with built-in Forward sync workflow and seeded NQE maps. |
+</details>
 
 ## Support
 
-Forward Field Integration is an officially maintained Forward Networks integration
-for NetBox. Supported NetBox and `netbox-branching` versions are listed in the
-Release Compatibility table above; support targets the latest released version.
+This is a **field integration** maintained by a Forward Networks SE — a reference
+integration, **not an officially supported Forward Networks product**, provided
+as-is with no SLA. Supported NetBox and `netbox-branching` versions are listed in
+the Release Compatibility table above; fixes target the latest released version.
 
 - **Bugs / feature requests:** open a GitHub issue using the provided templates.
 - **Security vulnerabilities:** report privately per [SECURITY.md](SECURITY.md) —

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/README.md

@@ -1,14 +1,74 @@
-# Forward Field Integration
+# Forward Integration for NetBox
 
-**Forward Field Integration** (`forward_netbox`) is a NetBox plugin that syncs Forward inventory into NetBox through direct Forward API connectivity and NQE while preserving the branch-backed sync, diff, and merge workflow.
+**Forward Integration for NetBox** (`forward_netbox`) is a NetBox plugin that syncs Forward Networks inventory into NetBox.
 
-Forward 26.6 is the baseline for async NQE.
+[![PyPI](https://img.shields.io/pypi/v/forward-netbox)](https://pypi.org/project/forward-netbox/)
+[![CI](https://github.com/forwardnetworks/forward-netbox/actions/workflows/ci.yml/badge.svg)](https://github.com/forwardnetworks/forward-netbox/actions/workflows/ci.yml)
+
+## Status
+
+- **Support model:** field integration reference — **not** an officially
+  supported Forward Networks product.
+- **Requires:** NetBox `4.6.4`, `netbox-branching` `1.1.0+`; Forward `26.6`
+  baseline for async NQE (full matrix in
+  [Release Compatibility](#release-compatibility)).
+- **Distribution:** PyPI (`forward-netbox`) + GitHub releases.
+
+## What It Does
+
+It pulls your Forward-discovered inventory into NetBox — devices, interfaces, IP addresses, prefixes, VLANs, VRFs, cables, LAGs, MAC addresses, and inventory items. It runs Forward NQE against a chosen snapshot, stages every change in a `netbox_branching` branch so you can review the diff, then merges when it looks right.
+
+On top of the import it adds scope control (sync only devices carrying chosen Forward tags), orphan pruning, per-device analysis (reachability, connectivity blast-radius, CVE exposure), a drift report, and snapshot selection.
+
+## What It Does Not Do
+
+- **It does not write back to Forward.** The sync is one-way, Forward → NetBox;
+  Forward stays the source of truth and the plugin keeps NetBox populated from
+  what Forward collected. (The drift report only *compares* the two.)
+- **It is not a source of truth for Forward configuration or intent** — it
+  populates NetBox from Forward's collected snapshot, nothing more.
+- **It does not require** the optional `netbox-routing` / `netbox-peering-manager`
+  plugins unless you enable the beta BGP/OSPF maps.
+
+## Screenshots
+
+**Sync — health, enabled models, and actions**
+
+![Forward sync detail](docs/assets/screenshots/sync-detail.png)
+
+**Staged ingestion — progress, snapshot metrics, and issues**
+
+![Forward ingestion detail](docs/assets/screenshots/ingestion-diff.png)
+
+**Drift report — per-model NetBox-vs-Forward divergence**
+
+![Drift report](docs/assets/screenshots/drift-report.png)
+
+**Forward sources**
+
+![Forward sources list](docs/assets/screenshots/sources.png)
+
+## Architecture
+
+Forward NQE runs against a selected snapshot to fetch inventory, each model's
+rows are staged into a `netbox_branching` branch as a reviewable per-model diff,
+and you merge when the changes look correct. Large baselines can use a
+`Fast bootstrap` direct-write backend; steady-state runs use Branching with
+Forward `nqe-diffs` so every change is reviewable. See the
+[Architecture Flow](docs/02_Reference/architecture-flow.md) reference for detail.
 
 ## Release Compatibility
 
+Latest release requires NetBox `4.6.4` and `netbox-branching` `1.1.0+`. Expand for the full per-release history and notes.
+
+<details>
+<summary>Release compatibility history</summary>
+
 | Plugin Release | NetBox Version | Status |
 | --- | --- | --- |
-| `v2.3.0` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; GA/enterprise hardening: encrypted Forward credential at rest, PyPI Trusted Publishing + SBOM, Prometheus metrics + stuck-job alert, populated-DB upgrade test, dead-code removal (multi_branch/density-learning), reliability fixes (jittered/Retry-After backoff, SaaS rate clamp, PK-anchored device prune), and supported-product framing. Drop-in from 2.2.5 — stored credentials auto-encrypt on save; rotating SECRET_KEY requires re-entering them. |
+| `v2.3.2` | `4.6.4` required; needs netbox-branching `1.1.0+` | Current release; Feature: optional import of Forward SNMP endpoints (e.g. Avocent console servers) as NetBox devices — off by default (`sync_endpoints`), enabled per source and scoped by the same device tags. |
+| `v2.3.1` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.3.2`;  |
+| `v2.3.0` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.3.1`; GA/enterprise hardening: encrypted Forward credential at rest, PyPI Trusted Publishing + SBOM, Prometheus metrics + stuck-job alert, populated-DB upgrade test, dead-code removal (multi_branch/density-learning), reliability fixes (jittered/Retry-After backoff, SaaS rate clamp, PK-anchored device prune), and supported-product framing. Drop-in from 2.2.5 — stored credentials auto-encrypt on save; rotating SECRET_KEY requires re-entering them. |
 | `v2.2.5` | `4.6.4` required; needs netbox-branching `1.1.0+` | Superseded by `v2.3.0`; Feature: operator-selectable **Sync Device Tags** — pick which Forward device tags (e.g. `Mgmt_*`) become NetBox device tags (replaces the hardcoded feature-tag set); Fix dependency-preview AttributeError + vsys job pile-up guard (hung pending); test/require NetBox 4.6.4 |
 | `v2.2.4` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.5`; Hotfix: device-analysis NQE (bare foreach) errored refresh + CVE list; surface job errors into job.data |
 | `v2.2.3` | `4.6.3` required; needs netbox-branching `1.1.0+` | Superseded by `v2.2.4`; Field-feedback fixes: delete-count labeling, vsys/vdom auto-link, skip empty VRFs, per-device CVE list, churn pinpoint, query-ID status clarify |
@@ -104,91 +164,14 @@ Forward 26.6 is the baseline for async NQE.
 | `v0.3.0.1` | `4.5.8` validated; `4.5.x` only | Superseded by `v0.3.1` |
 | `v0.3.0` | `4.5.8` validated; `4.5.x` only | Superseded by `v0.3.0.1` |
 
-## Version History
-
-| Release | Summary |
-| --- | --- |
-| `v1.5.0.1` | Fixes platform NQE query (`normalizePlatformName`), adds `--overwrite` to validation-org repair, hardens org-publish commit to retry on 409 INVALID_CHANGE_PATH. |
-| `v1.5.0` | Hardens ingest throughput: adaptive async-NQE poll backoff, ndjson streaming, webhook/event-rule signal suppression during apply, targeted validation on existing objects (skips DB-hitting uniqueness checks in both bulk engine paths), and async advanced-reachability trigger (FWD-53559). Full suite green on NetBox 4.5.9 and 4.6.2. |
-| `v1.4.3` | Hardens query provenance with source-backed query-id repair during preflight, adds async execution path readiness for 26.6 with resilient NDJSON/JSONL result handling, and proves CIMC/APIC platform/type updates from command-source evidence while preserving prior 1.4 protections. |
-| `v1.4.2` | Adds CIMC platform separation, visible query-drift repair and dependency preview on the sync detail page, and keeps module-bay merge hardening plus parent-interface description preservation. |
-| `v1.4.1.1` | Prevents optional module sync from creating `dcim.modulebay` side-effect changes during merge, skips missing module bays with a readiness/import warning, and keeps LAG member rows from clearing existing parent interface descriptions. |
-| `v1.4.1` | Publishes the 1.4 patch release line with query-ID drift remediation and support-bundle diagnostics on top of the parent-device contract and release surfaces. |
-| `v1.3.6` | Enforces a hard parent-device sync contract so child models cannot run without `dcim.device`, preventing stale sync configs from skipping the device shard and breaking dependent imports. |
-| `v1.3.5.5` | Adds compressed support-bundle ZIP downloads with optional password protection and folds live source/query-drift/data-file diagnostics into the troubleshooting bundle. |
-| `v1.3.5.4` | Republishes the `v1.3.5.3` query-contract hardening as the prior patch release. |
-| `v1.3.5.3` | Preserves the claimed-step and payload-compaction protections from `v1.3.5.2`, adds strict shipped-query parameter-contract validation, strips legacy tag aliases from runtime NQE payloads, and keeps support-bundle previews summary-only. |
-| `v1.3.5.2` | Prevents shard execution drift by tying resume/overlap workers to the claimed execution step and compacts sync execution payloads (`plan_items`, workload previews, and advisory branch summaries) so large runs remain user-visible but lightweight in UI/log exports. |
-| `v1.3.5.1` | Removes the raw `model_results` payload from sync telemetry summaries and stops unparameterized query IDs from inheriting source-level tag parameters, which keeps sync-detail rendering responsive while preserving the saved-query-ID path. |
-| `v1.3.5` | Tightens the saved-query-ID path for 1.3.x, keeps shipped maps parameter-compatible with `forward_netbox_shard_keys`, and uses command-inventory signals to avoid misclassifying ACI platforms during repeat syncs. |
-| `v1.3.4` | Makes non-retryable Branching merge errors operator-visible by persisting the failure reason before the job terminates, marks branches still stuck in `Merging` as `Failed`, preserves timeout/transient retry behavior, and adds disabled-by-default async NQE client support for the future Forward 26.6 execution API. |
-| `v1.3.3` | Refreshes shipped NQE syntax so saved query IDs accept the standard `forward_netbox_shard_keys` parameter payload, republishes the saved validation-folder query set, and validates the affected saved query IDs against a live Forward SaaS dataset. |
-| `v1.3.2` | Adds optional `netbox-cisco-aci` plugin support with disabled-by-default ACI fabric, pod, node, tenant, VRF, and filter maps; keeps deeper ACI policy maps conservative until source identity is proven; and hardens duplicate ACI node observations so repeat syncs remain no-op when source data is unchanged. |
-| `v1.3.1` | Fixes repeat prefix sync accounting by treating unchanged NetBox `ipam.prefix` rows as unchanged, avoids dependency VRF metadata rewrites from prefix/IP/FHRP imports, removes the legacy sync column-filter shard path, and preserves the `v1.3.0` parameterized NQE path. |
-| `v1.3.0` | Eliminates default Forward NQE column-filter shard fetches in favor of query-side `forward_netbox_shard_keys` parameters, keeps local shard safety filtering, and preserves branch boundaries while reducing Forward SaaS API/NQE pressure. |
-| `v1.2.3` | Coalesces compatible sibling shard column-filter fetches into bounded EQUALS_ANY requests, caches prefetched sibling rows locally to avoid repeated Forward calls, and surfaces local Branching change-explainability summaries in support bundles and the ingestion UI. |
-| `v1.2.2` | Adds operator-visible Forward API usage budgets/rate evidence in Sync Health and support bundles, extends repeat-sync no-op hardening across key adapters, and persists successful staged deletes into ingestion statistics so active delete shards are visible before merge accounting catches up. |
-| `v1.2.1` | Fixes repeat prefix sync churn where otherwise unchanged `ipam.prefix` rows could be updated only because the VRF foreign key was re-resolved; built-in prefix maps now use exact `prefix + vrf` identity while prefix shard fetches still use parameterized NQE. |
-| `v1.2.0` | Adds optional NetBox-native HSRP/VRRP FHRP import from Forward native FHRP state, bounded access/native interface VLAN assignment from existing site-scoped VLANs, keeps FHRP upgrade behavior safe for existing 1.1 IPAM data, and hardens current NetBox job-test compatibility. |
-| `v1.1.1` | Adds optional NetBox-native HSRP/FHRP import from Forward native FHRP state, keeps FHRP upgrade behavior safe for existing 1.1 IPAM data, and hardens current NetBox job-test compatibility. |
-| `v1.1.0` | Adds Forward SaaS API request pacing, parameterized prefix shard execution, single-pass interface NQE, configured max-shard persistence in smoke evidence, and release-validation gates for API/NQE scale validation. |
-| `v1.0.0` | Introduced the first `v1.0.0` release line and initial API/NQE release validation flow before the 1.1 runtime and request-pacing enhancements. |
-| `v0.9.4.6` | Tightens delete-heavy `dcim.device` cleanup planning to about 500 planned delete rows per 10k branch-change budget after live shard evidence showed the earlier estimate was still too high. |
-| `v0.9.4.5` | Plans delete-heavy `dcim.device` cleanup shards with a conservative row budget so tag-scope prune runs do not pack thousands of cascading device deletes into one Branching shard. |
-| `v0.9.4.4` | Clarifies large branching progress by clamping utilization display to 100% during intermediate accounting overshoots and showing current shard row progress in the ingestion UI. |
-| `v0.9.4.3` | Converts NetBox protected-reference delete failures into dependency skips so large tag-scope prune/device cleanup runs continue without shard-failing delete rows. |
-| `v0.9.4.1.1` | Keeps the shared 4.5/4.6 branch line, execution ledger, support logging, and scale hardening while preserving the read-only advisory surfaces from `v0.9.0`. |
-| `v0.9.0` | Adds read-only analysis, workload preview, advisory summaries, and native log export for troubleshooting while keeping lifecycle enrichment and predict deferred. |
-| `v0.8.6.3` | Hardens beta routing scope resolution, filters invalid BGP ASN rows in shipped NQE, skips positionless virtual-chassis rows conservatively, and lets fast bootstrap retain its diff baseline when only optional model issues remain. |
-| `v0.8.6.2` | Hardens issue and job-log rendering for JSON safety when unexpected nested payload objects leak into failure data. |
-| `v0.8.6.1` | Clarifies NQE map bulk edit labels and help text so operators use repository query paths and understand query IDs are resolved automatically during sync and diff execution. |
-| `v0.8.6` | Publishes flattened built-in NQE to Forward org repositories, filters IPv4 host/any/loopback prefix artifacts, reports IP rows missing imported parent prefixes on full baselines, and prevents stale virtual-chassis/device/routing row failures from blocking unrelated models. |
-| `v0.8.5` | Makes the beta routing and module maps broadly available by default, preserves the conservative bundled virtual chassis map, handles Forward repository query lookups that return a `queries` list, and makes failed sync activity show the terminal failure instead of stale row heartbeat text. |
-| `v0.8.3` | Isolates stale or invalid per-model query output, rejects virtual-chassis rows missing `vc_position`, records row issues without aborting later multi-branch shards, and prevents dirty runs from becoming diff baselines. |
-| `v0.8.2` | Adds portable repository `query_path` execution with Forward-backed selectors, true native bulk edit for publishing bundled NQE into the Forward Org Repository, binding selected maps to repository paths, restoring bundled raw NQE, and clearer skipping for IP address rows whose interface cannot be resolved. |
-| `v0.8.1.1` | Emits `vc_position` in the built-in virtual chassis NQE map for vPC and MLAG memberships so NetBox does not reject virtual chassis device assignments without a member position. |
-| `v0.8.1` | Runs fast bootstrap inside native NetBox change tracking, shows branchless ingestion changes from `ObjectChange` rows, updates fast-bootstrap counters from real object changes, warns about undersized worker timeouts, and retries transient Forward API HTTP timeouts/gateway responses. |
-| `v0.8.0` | Adds an opt-in fast bootstrap direct-write backend for trusted large baselines, keeps NQE validation and row adapters shared with Branching, and skips LAG cable endpoints that NetBox cannot cable directly. |
-| `v0.7.1` | Keeps the NetBox-native multi-branch workflow stable while hardening cable ingestion, retry handling, and shard re-planning for large runs. |
-| `v0.7.0` | Splits the remaining sync orchestration, reporting, and validation helpers into dedicated boundaries, adds shard heartbeat visibility, and preserves the NetBox-native branch workflow. |
-| `v0.6.5` | Adds audited validation force-allow overrides and routing evidence enrichment while reducing skipped routing rows through conservative NQE-side identity inference. |
-| `v0.6.4` | Adds beta optional routing and peering imports for `netbox-routing` and `netbox-peering-manager`, including BGP peers, BGP address families, OSPF objects, peering sessions, routing diagnostics, and query-ID-aware built-in map handling. |
-| `v0.6.3` | Models Forward aggregate interfaces as native NetBox LAGs, attaches member interfaces through `Interface.lag`, and keeps the MTU value sourced from Forward's normalized interface field. |
-| `v0.6.2` | Canonicalizes duplicate global-table IP address rows by host IP before import and records row-scoped apply/delete failures as ingestion issues without aborting the rest of the shard. |
-| `v0.6.1` | Filters interface IP rows that NetBox cannot assign, such as subnet network IDs and IPv4 broadcasts, while reporting aggregate diagnostics for filtered addresses. |
-| `v0.6.0` | Adds beta native `dcim.module` import for chassis modules and similar bay-aware hardware, improves inventory item normalization, and avoids duplicate generic inventory rows when beta module sync is enabled. |
-| `v0.5.9.1` | Keeps job logs visible during execution by persisting plugin log entries into the native NetBox job log tab while preserving the full plugin ingestion log view. |
-| `v0.5.9` | Balances query preflight and workload fetch with bounded parallelism, reducing long planning pauses on large datasets. |
-| `v0.5.8` | Defers event flushing until commit so large prefix ingestions do not trip transaction state changes mid-run. |
-| `v0.5.5` | Applies a consistent model conflict policy for cable sync rows: skip occupied-interface conflicts, aggregate warning spam, and keep non-conflict updates/creates unchanged. |
-| `v0.5.4` | Persists ingestion change counters so list/detail values stay consistent after branch merge cleanup, matching merge summaries. |
-| `v0.5.3` | Surfaces preflight activity and elapsed phase timing on sync detail, emits early phase logs before ingestion rows, and sets source status to `Syncing` while runs are active. |
-| `v0.5.2.1` | Fixes plugin admin version display and ships inferred cable query parser compatibility update (no `let` declarations) while preserving synthetic endpoint filtering. |
-| `v0.4.0` | Corrects built-in IPv4/IPv6 prefix NQE filters to exclude host routes (`/32` and `/128`) from prefix import and validates the behavior against a live smoke dataset. |
-| `v0.3.1` | Adds optional data-file-aware device type alias maps, a Device Type Library alias data-file builder, and documentation for the snapshot requirement while keeping the default no-data-file maps available. |
-| `v0.3.0.1` | Fixes the validation-run list UI by removing unsupported edit actions from read-only validation records, and adds Playwright coverage for the validation-run list route. |
-| `v0.3.0` | Adds the NetBox 4.5.8-validated harness architecture with first-class validation runs, drift policies, query-fetch boundaries, model-result reporting, and Playwright-covered UI workflow validation. |
-| `v0.2.4` | Hardens native multi-branch resilience with adaptive shard splitting and retry on branch-budget overflow, plus model-density tracking to keep large initial syncs within NetBox branching guidance. |
-| `v0.2.3` | Adds native sync preflight validation before full multi-branch planning so invalid model/query rows fail earlier in the UI/API run path. |
-| `v0.2.2` | NQE-only correction release: filters zero-length prefixes, broadens interface coverage for IP assignment targets, and enforces inventory `part_id` length limits. |
-| `v0.2.1` | Makes NetBox-native multi-branch execution the only UI/API sync path and exposes the branch budget in the sync form. |
-| `v0.2.0` | Adds NetBox-native multi-branch baseline syncs for large datasets, uses NetBox outbound proxy routing for Forward API calls, and keeps branch event queues bounded during large imports. |
-| `v0.1.6.0` | Adds explicit diff baselines, Forward `nqe-diffs` execution for eligible `query_id` maps, and updated large-dataset guidance for baseline versus incremental syncs. |
-| `v0.1.5.1` | Patch release that validates and hardens null-VRF coalesce behavior and inventory-item serial bounds against the live dataset. |
-| `v0.1.5` | Fixes null VRF coalesce handling, imports loopback interfaces for IP attachment, and hardens inventory-item identity fallbacks. |
-| `v0.1.4.2` | CI/package patch release that applies repository formatting/import-order fixes and publishes a clean artifact line. |
-| `v0.1.4.1` | Patch release that bounds built-in `dcim.virtualchassis` names/domains to NetBox field limits. |
-| `v0.1.4` | Hardened built-in NQE mappings and docs for large real-world datasets. |
-| `v0.1.3` | Enforced deterministic model identity contracts during sync ingestion. |
-| `v0.1.2` | Improved ingestion safety, diagnostics, and compatibility with custom NetBox data. |
-| `v0.1.1` | Added pagination, shared built-in NQE helpers, and release/doc cleanup. |
-| `v0.1.0` | Initial unsupported NetBox plugin release with built-in Forward sync workflow and seeded NQE maps. |
+</details>
 
 ## Support
 
-Forward Field Integration is an officially maintained Forward Networks integration
-for NetBox. Supported NetBox and `netbox-branching` versions are listed in the
-Release Compatibility table above; support targets the latest released version.
+This is a **field integration** maintained by a Forward Networks SE — a reference
+integration, **not an officially supported Forward Networks product**, provided
+as-is with no SLA. Supported NetBox and `netbox-branching` versions are listed in
+the Release Compatibility table above; fixes target the latest released version.
 
 - **Bugs / feature requests:** open a GitHub issue using the provided templates.
 - **Security vulnerabilities:** report privately per [SECURITY.md](SECURITY.md) —

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/forward_netbox/__init__.py

@@ -6,9 +6,9 @@ except ModuleNotFoundError:  # pragma: no cover - tooling imports outside NetBox
 
 class NetboxForwardConfig(PluginConfig):
     name = "forward_netbox"
-    verbose_name = "Forward Field Integration"
+    verbose_name = "Forward"
     description = "Sync Forward data into NetBox using built-in NQE queries."
-    version = "2.3.0"
+    version = "2.3.2"
     base_url = "forward"
     min_version = "4.6.4"
 

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/forward_netbox/forms.py

@@ -436,6 +436,16 @@ class ForwardSourceForm(NetBoxModelForm):
                 "filtered in NetBox."
             ),
         )
+        self.fields["sync_endpoints"] = forms.BooleanField(
+            required=False,
+            label="Import SNMP Endpoints as Devices",
+            help_text=(
+                "Also import Forward SNMP endpoints (generic SSH/SNMP devices "
+                "Forward collects but does not model as first-class devices, "
+                "e.g. Avocent console servers) as NetBox devices, scoped by the "
+                "same device tags."
+            ),
+        )
         self.fields["sync_device_tags"] = FlexibleMultipleChoiceField(
             required=False,
             choices=(),
@@ -605,6 +615,7 @@ class ForwardSourceForm(NetBoxModelForm):
         self.fields["device_tag_include_tags"].initial = include_initial
         self.fields["device_tag_exclude_tags"].initial = exclude_initial
         self.fields["sync_device_tags"].initial = sync_tags_initial
+        self.fields["sync_endpoints"].initial = bool(parameters.get("sync_endpoints"))
         self.fields["device_tag_include_tags"].choices = [
             (tag, tag) for tag in include_initial
         ]
@@ -840,6 +851,7 @@ class ForwardSourceForm(NetBoxModelForm):
             ),
             "apply_device_scope_tags": bool(cleaned.get("apply_device_scope_tags")),
             "sync_device_tags": sync_device_tags,
+            "sync_endpoints": bool(cleaned.get("sync_endpoints")),
         }
         self.instance.type = source_type
         self.instance.url = (
@@ -1033,6 +1045,7 @@ class ForwardSourceForm(NetBoxModelForm):
                 self.cleaned_data.get("apply_device_scope_tags")
             ),
             "sync_device_tags": sync_device_tags,
+            "sync_endpoints": bool(self.cleaned_data.get("sync_endpoints")),
         }
         self.instance.status = ForwardSourceStatusChoices.NEW
         return super().save(*args, **kwargs)

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/forward_netbox/navigation.py

@@ -79,7 +79,7 @@ device_analysis = PluginMenuItem(
 )
 
 menu = PluginMenu(
-    label="Forward Field Integration",
+    label="Forward",
     icon_class="mdi mdi-cloud-sync",
     groups=(
         ("Data Sync", (source, sync, ingestion, validation_run)),

forward_netbox-2.3.2/forward_netbox/queries/forward_devices.nqe

@@ -0,0 +1,82 @@
+/**
+ * @intent Devices collected by Forward (plus optional SNMP endpoints)
+ * @description Devices to add or update in NetBox via POST/PATCH to
+ * /api/dcim/devices/. When sync_endpoints is true, generic SNMP endpoints that
+ * Forward collects but does not model as first-class devices (e.g. Avocent
+ * console servers) are also emitted as device rows, identified from standard
+ * MIB-2 (sysName/sysDescr/sysObjectId) with per-vendor overlays, and scoped by
+ * the same device tags.
+ */
+
+import "netbox_utilities";
+
+@query
+f(forward_netbox_shard_keys: List<String>, sync_endpoints: Bool, device_tag_include_tags: List<String>, device_tag_include_match: String, device_tag_exclude_tags: List<String>) =
+foreach row in (
+  (
+    foreach device in network.devices
+    where device.snapshotInfo.result == DeviceSnapshotResult.completed
+    where device.platform.vendor != Vendor.FORWARD_CUSTOM
+    where isEmpty(forward_netbox_shard_keys) || device.name in forward_netbox_shard_keys
+    let model = toString(device.platform.model)
+    let role_name = replace(toString(device.platform.deviceType), "DeviceType.", "")
+    let site_name = if isPresent(device.locationName) then toLowerCase(device.locationName) else "unknown"
+    let platform_name = normalizeDevicePlatformName(device)
+    let manufacturer_name = canonicalManufacturerName(device.platform.vendor)
+    let manufacturer_slug = slugify(manufacturer_name)
+    select {
+      name: device.name,
+      manufacturer: manufacturer_name,
+      device_type: model,
+      device_type_slug: slugifyNetboxModel(model),
+      site: site_name,
+      site_slug: slugify(site_name),
+      role: role_name,
+      role_slug: slugify(role_name),
+      role_color: "9e9e9e",
+      platform: platform_name,
+      platform_slug: slugify(platform_name),
+      status: "active",
+      manufacturer_slug: manufacturer_slug
+    }
+  )
+  +
+  (
+    // SNMP endpoints (opt-in): generic SSH/SNMP devices Forward collects but
+    // does not model. Generic identity from MIB-2; Avocent overlay by enterprise
+    // OID 10418. Scoped by the same device tags (endpoints carry tagNames).
+    foreach endpoint in network.endpoints
+    where sync_endpoints
+    where !isEmpty(endpoint.snmpOutputs)
+    where isEmpty(device_tag_include_tags)
+      || (device_tag_include_match == "all"
+        && all(foreach tag in device_tag_include_tags select tag in endpoint.tagNames))
+      || (device_tag_include_match != "all"
+        && any(foreach tag in device_tag_include_tags select tag in endpoint.tagNames))
+    where isEmpty(device_tag_exclude_tags)
+      || !any(foreach tag in device_tag_exclude_tags select tag in endpoint.tagNames)
+    let sysDescrOpt = max(foreach o in endpoint.snmpOutputs where o.requestedOid == "1.3.6.1.2.1.1.1" select max(foreach e in o.rawOidEntries select e.rawValue))
+    let sysObjIdOpt = max(foreach o in endpoint.snmpOutputs where o.requestedOid == "1.3.6.1.2.1.1.2" select max(foreach e in o.rawOidEntries select e.rawValue))
+    let sysDescr = if isPresent(sysDescrOpt) then sysDescrOpt else "SNMP Endpoint"
+    let isAvocent = matches(if isPresent(sysObjIdOpt) then sysObjIdOpt else "", "*10418*")
+    let ep_manuf = if isAvocent then "Avocent" else replaceRegexMatches(sysDescr, re` .*`, "")
+    let ep_role = if isAvocent then "Console Server" else "SNMP Endpoint"
+    let ep_site = if isPresent(endpoint.locationName) then toLowerCase(endpoint.locationName) else "unknown"
+    select {
+      name: endpoint.name,
+      manufacturer: ep_manuf,
+      device_type: sysDescr,
+      device_type_slug: slugifyNetboxModel(sysDescr),
+      site: ep_site,
+      site_slug: slugify(ep_site),
+      role: ep_role,
+      role_slug: slugify(ep_role),
+      role_color: "9e9e9e",
+      platform: ep_manuf,
+      platform_slug: slugify(ep_manuf),
+      status: "active",
+      manufacturer_slug: slugify(ep_manuf)
+    }
+  )
+)
+select row;

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/forward_netbox/templates/forward_netbox/forwardsync_drift_report.html

@@ -11,6 +11,16 @@
 {% endblock extra_controls %}
 
 {% block content %}
+{% if drift_stale %}
+  <div class="alert alert-warning d-flex align-items-center" role="alert">
+    <i class="mdi mdi-alert me-2" aria-hidden="true"></i>
+    <div>
+      {% trans "This drift is computed from a dependency preview, but a newer sync has run since — the numbers below are stale." %}
+      {% trans "Preview:" %} {{ preview_at|placeholder }} · {% trans "Last sync:" %} {{ last_sync_at|placeholder }}.
+      {% trans "Re-run Preview Dependencies for current drift." %}
+    </div>
+  </div>
+{% endif %}
 <div class="row mb-3">
   <div class="col col-md-4">
     <div class="card">

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/forward_netbox/templates/forward_netbox/inc/brand_bar.html

@@ -1,7 +1,7 @@
 {% load static %}
 {% load i18n %}
 {% comment %}
-Forward Field Integration brand bar. Self-contained, theme-aware (logo wordmark
+Forward Integration for NetBox brand bar. Self-contained, theme-aware (logo wordmark
 uses currentColor), no global NetBox style overrides. ff3506 is Forward's accent.
 {% endcomment %}
 <style>
@@ -10,8 +10,8 @@ uses currentColor), no global NetBox style overrides. ff3506 is Forward's accent
 .fwd-brand-bar .fwd-name{font-weight:600;font-size:.8rem;letter-spacing:.01em;}
 .fwd-brand-bar .fwd-tag{font-size:.72rem;opacity:.6;margin-left:auto;}
 </style>
-<div class="fwd-brand-bar" title="Forward Field Integration">
+<div class="fwd-brand-bar" title="Forward Integration for NetBox">
   <img class="fwd-logo" src="{% static 'forward_netbox/img/fn-logo.svg' %}" alt="Forward">
-  <span class="fwd-name">{% trans "Field Integration" %}</span>
+  <span class="fwd-name">{% trans "Forward" %}</span>
   <span class="fwd-tag">{% trans "Forward Networks · NetBox" %}</span>
 </div>

{forward_netbox-2.3.0 → forward_netbox-2.3.2}/forward_netbox/tests/test_brand_bar.py

@@ -3,14 +3,14 @@ from django.test import TestCase
 
 
 class BrandBarTemplateTest(TestCase):
-    """The Forward Field Integration brand bar must render the logo + label, and
+    """The Forward Integration for NetBox brand bar must render the logo + label, and
     must NOT leak its template comment as visible text (a multi-line {# #} comment
     is not a comment in Django and rendered literally on the page)."""
 
     def test_brand_bar_renders_without_leaking_comment(self):
         html = render_to_string("forward_netbox/inc/brand_bar.html")
         self.assertIn("fwd-brand-bar", html)
-        self.assertIn("Field Integration", html)
+        self.assertIn(">Forward</span>", html)
         self.assertIn("fn-logo.svg", html)
         # The {% comment %} block must be stripped — none of its words appear.
         self.assertNotIn("Self-contained", html)