3 ideas for ready/health checks:

• delay - wait a few seconds to make sure it doesn't fail (likely on by default)
• output - wait until a certain output appears in the logs
• http - make an http response, check the result

most of these are good for "ready" checks - knowing when the daemon has started and pf start can return 0. The http one could be used long-term though and repeat to make sure the daemon is still responsive.