On the client:

# cf-agent -KIv
...
cf3  -> Handling file existence constraints on /etc/cfengine3
cf3  -> Copy file /etc/cfengine3 from /srv/cfengine/sysconf/server/inputs check
cf3 No existing connection to 172.31.69.83 is established...
cf3 Set cfengine port number to 5308 = 5308
cf3  -> Connect to 172.31.69.83 = 172.31.69.83 on port 5308
cf3 LastSaw host 172.31.69.83 now
cf3 Loaded /var/lib/cfengine3/ppkeys/root-172.31.69.83.pub
cf3 .....................[.h.a.i.l.].................................
cf3 Strong authentication of server=172.31.69.83 connection confirmed
cf3 Server returned error:  Unspecified server refusal (see verbose server output)
cf3 Can't stat /srv/cfengine/sysconf/server/inputs in files.copyfrom promise
cf3  ?> defining promise result class Cfengine_Inputs_Updated_Failed
....
cf3     .........................................................
cf3     Promise handle: 
cf3     Promise made by: [cf-agent.cf      ] FAILED 172.31.69.83:///srv/cfengine/sysconf/server/inputs -> localhost:///etc/cfengine3

However, on the server (172.31.69.83), there's no reason why it can't stat the directory:

cyrus:/srv/cfengine/sysconf/server# ls -l /srv/cfengine/sysconf/server/inputs
total 52
-rw-r--r-- 1 root root 2142 Sep  6 21:54 cf-agent.cf
-rw-r--r-- 1 root root  831 Sep  6 18:31 cf-execd.cf
-rw-r--r-- 1 root root 4517 Sep  6 21:44 cf-serverd.cf
-rw-r--r-- 1 root root 3082 Sep  6 21:44 dns.cf
-rw-r--r-- 1 root root 2028 Sep  6 15:12 failsafe.cf
-rw-r--r-- 1 root root 5966 Sep  6 21:44 ldap-masters.cf
-rw-r--r-- 1 root root 4380 Sep  6 18:31 ldap-security.cf
-rw-r--r-- 1 root root 2735 Sep  6 08:21 lib-core.cf
-rw-r--r-- 1 root root 1506 Sep  6 21:45 lib-utils.cf
-rw-r--r-- 1 root root 2635 Sep  6 20:27 lib-vars.cf
-rw-r--r-- 1 root root 2057 Sep  3 17:46 nss.cf
-rw-r--r-- 1 root root 1472 Sep  6 18:31 packages.cf
-rw-r--r-- 1 root root 1257 Sep  6 18:01 pam-security.cf
-rw-r--r-- 1 root root 4019 Sep  6 19:32 promises.cf
-rw-r--r-- 1 root root 2808 Sep  3 17:22 site.cf
-rw-r--r-- 1 root root 1670 Sep  6 18:31 sudo-security.cf
-rw-r--r-- 1 root root  831 Sep  6 18:31 sys-security.cf
-rw-r--r-- 1 root root  890 Sep  6 18:31 sys-users.cf
cyrus:/srv/cfengine/sysconf/server# 

I don't see anything interesting server side either when running:

/usr/sbin/cf-serverd -d4 --verbose --no-fork

And the following does not have any complaints:

/usr/sbin/cf-promises -v

Any ideas?

I'm running cfengine3 on debian, v3.0.5+dfsg-1 - and the cf-agent.cf file is as follows:

bundle agent Update {
files:
    linux::
        "${cf3.path[inputs]}"
            action => immediate,
            move_obstructions => "true",
            depth_search => Recursive,
            copy_from => MirrorFrom(
                "${cf3.host[server]}",
                "${cf3.path[scm-inputs]}",
                "true",
                "0400"
            ),
            classes => DefineSoftClass("Cfengine_Inputs_Updated")
        ;

        "${cf3.path[sbin]}"
            comment => "Setting cf3 client sbin scripts: ${cf3.path[sbin]}/",
            action => immediate,
            depth_search => Recursive,
            copy_from => MirrorFrom(
                "${cf3.host[server]}",
                "${cf3.path[scm-cnt-scripts]}",
                "false",
                "0555"
            )
        ;


reports:
    Cfengine_Inputs_Updated::
        "[cf-agent.cf      ] Services:CFAgent:Inputs:Updated";
    Cfengine_Inputs_Updated_Failed::
        "[cf-agent.cf      ] FAILED ${cf3.host[server]}://${cf3.path[scm-inputs]} -> localhost://${cf3.path[inputs]}";
}

I lie, there is something interesting with a little more debugging...

AccessControl(/srv/cfengine/sysconf/server/inputs)
AccessControl, match(/srv/cfengine/sysconf/server/inputs,client.com.au) encrypt request=1
Examining rule in access list (/srv/cfengine/sysconf/server/inputs,/home/cfengine)?
cf3 Host client.com.au denied access to /srv/cfengine/sysconf/server/inputs
Unappending Host client.com.au denied access to /srv/cfengine/sysconf/server/inputs
cf3 Access control in sync
Unappending Access control in sync
Transaction Send[t 59][Packed text]
Attempting to send 67 bytes
SendSocketStream, sent 67
cf3 From (host=client.com.au,user=root,ip=172.31.69.3)
Unappending From (host=client.com.au,user=root,ip=172.31.69.3)
cf3 REFUSAL of request from connecting host: (SYNCH 1283777156 STAT /srv/cfengine/sysconf/server/inputs)
Unappending REFUSAL of request from connecting host: (SYNCH 1283777156 STAT /srv/cfengine/sysconf/server/inputs)
RecvSocketStream(8)
cf3  -> Accepting a connection

I'll keep looking.