Scap3 currently follows the trebuchet model of tagging a revision and ssh-ing to machines to check out that tag, regardless of whether that tag represents an actual code change. Scap3, currently, then runs service restarts and port checks. Ideally it should not make changes to services, or run checks, if code doesn't change.
True idempotent behavior is fairly difficult to pull off. We can either half-ass it or we can use something like puppet for the bulk of our deployment logic.
I'm not the biggest puppet fan but I recognize that what this task is subtly proposing is to reinvent that wheel and I'm not sure we are ready to open that can of worms.