With the recognition that I'm not really part of core, I have some concerns about pulling in the efigy stuff. It's pretty cool, but I think it really blurs the lines of what osquery is. As I think about it, osquery is a tool for getting local system information. Pulling in efigy starts to talk about validating that information. One could, hypothetically, have that information centrally, and validate the fleet results against it. Or one could ship something nagios check style to the clients. As described, it sounds like basically shipping a specialize nagios check to the clients, which is then queried by osquery. 2 red flags for me. One is that it makes the purpose of osquery less clear. Is it to pull system information, or to be a general health check? Second, is that if it's a general health check, I want a general interface to it, likely leveraging the nagios prior art