It would seem the ‘pkg’ provider (for illumos/Solaris/OpenSolaris IPS) does not do the right thing with IPS package versions. We’re running OmniOS and seeing this:

kekkonen ~ % pfexec puppet apply -e 'package {"mdb": ensure => latest }'
Notice: Compiled catalog for kekkonen.niksula.hut.fi in environment production in 1.17 seconds
Notice: Finished catalog run in 6.39 seconds
kekkonen ~ % pfexec pkg update -nv mdb                                                  
            Packages to update:        1
     Estimated space available: 14.11 TB
Estimated space to be consumed: 24.61 MB
       Create boot environment:       No
Create backup boot environment:      Yes
          Rebuild boot archive:       No

Changed packages:
omnios
  developer/debug/mdb
    0.5.11,5.11-0.151006:20130731T194820Z -> 0.5.11,5.11-0.151006:20131019T183740Z

So puppet thinks there are no updates, but pkg correctly notices that an update is available (only the timestamp has changed, not the version, build release, or branch numbers).

puppet resource provides some insight into this:

kekkonen ~ % puppet resource package mdb
package { 'mdb':
  ensure => '0.5.11-0.151006',
}

This version number is not correct, it’s missing the build release (5.11) and timestamp.