And a run_once flag would likely have lots of residual cruft over time :/ but yeah a separate file that just uses the same parsers but osquery knows to run those only once would be cool, but that might still be post enroll