this task is ambiguous. are you saying it shouldn't run all checks or that it should?

deploy-local runs all checks since a given machine doesn't know what group it's in unless that group is passed from deploy on the deploy host. I could see this being problematic with puppet-automated scap-runs.

one more reason the whole deployment graph should be built on the deploy host and distributed to the targets for execution.

Eventually we will have a competent competitor to puppet ...named scap

Exactly, It fails in puppet runs but works in deploy from tin (or it fails silently which is unlikely)