As I understand it the update policies compare the hash of cf_promises_validated in /var/cfengine/masterfiles/ on the policy server to the hash of /var/cfengine/inputs/cf_promises_validated locally, if they differe then a full scan is performed and any files that are different will be updated.