OS X Lion group membership not updated

Switching to puppet (2.7.3) for managing my OS X Lion systems, I'm finding group membership not being updated. Couldn't find a dup for this, hope the information helps...

Starting out, user dt is not a member of group dt-grp:

<pre>

1. dscl . read /groups/dt-grp | grep GroupMembership
   GroupMembership:
   </pre>

...Run puppet, says it adds to the group:

<pre>

1. puppet agent --test --environment production
   info: Caching catalog for cypress.keck.waisman.wisc.edu
   info: Applying configuration version '1315332406'
   notice: /Stage[main]/Users_test/User[dt]/groups: groups changed '' to 'dt-grp'
   notice: Finished catalog run in 0.89 seconds
   </pre>

...but the user still isn't part of the group:

<pre>

1. dscl . read /groups/dt-grp | grep GroupMembership
   GroupMembership:
   </pre>

...Hrm, let's add the user manually...just like the puppet code does...

<pre>

1. dseditgroup -o edit -n . -a dt dt-grp
2. dscl . read /groups/dt-grp | grep GroupMembership
   GroupMembership: dt
   </pre>

...But puppet still tries to add the user to the group...

<pre>

1. puppet agent --test --environment production
   info: Caching catalog for cypress.keck.waisman.wisc.edu
   info: Applying configuration version '1315332406'
   notice: /Stage[main]/Users_test/User[dt]/groups: groups changed '' to 'dt-grp'
   notice: Finished catalog run in 0.83 seconds
   </pre>