Curated pack revision pins are never verified, so a pack silently applies to any revision

[giorgi-imerlishvili-elastic]

Severity: medium — likely the root cause behind the curated-pack series drops reported separately; makes pack fidelity claims unverifiable.

What happens

curated_packs/registry.yaml pins a revision and a content hash per pack:

  - gnet_id: 1860
    name: grafana_1860_node_exporter_full
    gnet_revision: 37
    dashboard_sha256: "d4313569a6a74471de08e3160c674e4b5c015f1385f385170232734f9124ea63"

Nothing in production code reads either field. The only references in the repo are a test asserting
the keys are present:

tests/test_curated_packs.py
  42:        assert "gnet_revision" in entry
  43:        assert "dashboard_sha256" in entry

Pack selection is by gnetId (with a title/tags fallback), so the pack applies to any revision
of dashboard 1860, then status_override: migrated stamps the result as clean.

Why it matters

The pins give a strong impression of version safety that isn't enforced. A newer upstream revision
that adds a panel target gets migrated against pack ES|QL written for an older revision, and the
added series is dropped with confidence=1.0 and no warning — which is exactly the Pressure/Irq
shape reported separately for the pack's hand-written queries. (Stated as the most likely
explanation, not proven: the exported JSON does not
carry a revision field, so I could not confirm the live revision number from the artifact.)

Suggested fix

Read the pins at migration time and act on a mismatch — at minimum a warning naming the pinned vs
actual revision, and ideally a confidence downgrade for panels covered by query_overrides. If
enforcement isn't wanted, drop the fields rather than pinning values nothing checks.

How this was found

Manual end-to-end test of #346: Grafana community dashboard 1860 migrated with
obs-migrate and uploaded to a local Kibana, then compared panel-by-panel
against the source Grafana rendering the same node_exporter metrics.

Environment

• Branch: pr-346 (feat!: curated dashboard packs, PromQL fidelity, and native-only dashboard artifacts)
• Source: Grafana OSS, community dashboard 1860 "Node Exporter Full" imported live (gnetId: 1860, JSON version: 101)
• Curated pack: grafana_1860_node_exporter_full (auto-activated by gnetId)
• Target: Elasticsearch + Kibana 9.5.0-SNAPSHOT (elastic-package stack), index metrics-node.prometheus-default, --field-profile prometheus_native
• Ingest: node_exporter scraped every 15 s into both Prometheus (for Grafana) and Elasticsearch (for Kibana), same series in both