> Ah, I think I just spotted a fatal flaw with this.  If everything is clean, `openais` will be enabled.

No, `openais` is never enabled when the option is enabled. We rely on a `chef-client` run to start it.