v0.2.9.1: wire pacman scanner, GATE-006 TODO

server/internal/api/handlers/updates.go

@@ -348,7 +348,7 @@ func (h *UpdateHandler) ReportUpdates(c *gin.Context) {
 // (digest pinning vs. available-upgrade lists) and will be handled separately.
 func scanEcosystemSupported(ecosystem string) bool {
 	switch ecosystem {
-	case "dnf", "apt":
+	case "dnf", "apt", "pacman":
 		return true
 	default:
 		return false
@@ -994,7 +994,10 @@ func gatedTargetAhead(packageType, targetVersion, currentVersion string) bool {
 		// Exact equality is the only portable no-op guard here. Dry-run and exact
 		// hash binding decide installability.
 		return target != current
-	case "dnf":
+	case "dnf", "pacman":
+		// pacman's vercmp is derived from rpm's, and Arch's epoch:pkgver-pkgrel
+		// format maps cleanly to RPM's epoch:version-release. The same comparison
+		// logic applies to both.
 		return rpmEVRAhead(target, current)
 	default:
 		return utils.CompareVersions(target, current) > 0

server/internal/database/queries/subsystems.go

@@ -371,6 +371,8 @@ func (q *SubsystemQueries) createDefaultSubsystemsInternal(exec interface {
 			defaults = append(defaults, models.AgentSubsystem{AgentID: agentID, Subsystem: "windows", Enabled: true, AutoRun: true, IntervalMinutes: 60})
 		case "docker":
 			defaults = append(defaults, models.AgentSubsystem{AgentID: agentID, Subsystem: "docker", Enabled: true, AutoRun: true, IntervalMinutes: 15})
+		case "pacman":
+			defaults = append(defaults, models.AgentSubsystem{AgentID: agentID, Subsystem: "pacman", Enabled: true, AutoRun: true, IntervalMinutes: 15})
 		}
 	}
 

server/internal/services/supply_chain.go

@@ -801,6 +801,13 @@ func CheckOSVVulnerabilities(pkgName, ecosystem, version string) *SupplyChainChe
 // checked against OSV.dev. Broader than before — runs for all ecosystems that
 // have an OSV.dev mapping, even when coverage is sparse. A nil result is honest
 // visibility (the check ran, nothing found).
+//
+// TODO(GATE-006): pacman is wired as a scanner but OSV.dev does not yet cover
+// Arch Linux (as of 2026-06). When OSV adds Arch support, add "pacman" here
+// and flip EcosystemFromPackageType to return "Arch". Track via OSV.dev
+// ecosystem registry — search for "arch" or "archlinux". Until then, pacman
+// updates skip the supply-chain check and rely on the capability gate + hash
+// verification for install safety.
 func NeedsSupplyChainCheck(pkgType string) bool {
 	switch pkgType {
 	case "npm", "pypi", "apt", "dnf":
@@ -826,10 +833,11 @@ func CanServerFetchArtifact(pkgType string) bool {
 // NeedsCapabilityGate returns true if the ecosystem routes mutation through
 // the capability-token path (consumer.go → redflag-helper). Server-fetched
 // ecosystems (npm/pypi) and agent-sourced ecosystems (dnf/apt) both use it
-// when the minter is enabled.
+// when the minter is enabled. pacman routes through the gate for privilege
+// isolation and artifact hashing even though OSV does not cover Arch.
 func NeedsCapabilityGate(pkgType string) bool {
 	switch pkgType {
-	case "dnf", "apt", "npm", "pypi":
+	case "dnf", "apt", "npm", "pypi", "pacman":
 		return true
 	}
 	return false
@@ -838,7 +846,9 @@ func NeedsCapabilityGate(pkgType string) bool {
 // EcosystemFromPackageType maps RedFlag package types to OSV.dev ecosystems.
 // Best-effort: dnf maps to AlmaLinux (closest supported RHEL-family ecosystem),
 // apt maps to Debian. Unmapped types return the raw package type — OSV.dev will
-// return empty results for unrecognized ecosystems rather than error.
+// return empty results for unrecognized ecosystems rather than error. pacman
+// returns "Arch" for future OSV coverage; as of 2026-06 OSV.dev does not support
+// Arch Linux, so NeedsSupplyChainCheck returns false for pacman.
 func EcosystemFromPackageType(pkgType string) string {
 	switch pkgType {
 	case "npm":
@@ -849,6 +859,8 @@ func EcosystemFromPackageType(pkgType string) string {
 		return "Debian"
 	case "dnf":
 		return "AlmaLinux"
+	case "pacman":
+		return "Arch"
 	}
 	return pkgType
 }

server/internal/version/versions.go

@@ -15,8 +15,8 @@ import (
 // tag — the release gate enforces this. ldflags may override at build time;
 // the release pipeline injects the tag so binaries and source agree.
 var (
-	AgentVersion    = "0.2.9.0"
-	ConfigVersion   = "0.2.9.0"
+	AgentVersion    = "0.2.9.1"
+	ConfigVersion   = "0.2.9.1"
 	MinAgentVersion = "0.1.22"
 )