#1162 Santa: per-tag and per-node client mode override Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Client mode (MONITOR/LOCKDOWN) is set per environment, so a LOCKDOWN pilot group needs its own environment. Workshop sets mode per host. Scope • Optional mode override on a tag or a node, using the same precedence as rules (node > tag > env). • Preflight returns the effective mode; it is included in what decides a clean sync only if needed (mode is config, not rules). • UI: set/clear the override from the Santa page (and node page if simple); Machines tab shows effective mode and its source. • Audit every change. Acceptance • A node with a LOCKDOWN override in a MONITOR environment receives LOCKDOWN at preflight; removing it reverts on next sync. • Tests for precedence and cross-environment rejection. jmpsec/osctrl