#1172 Santa: on-demand temporary MONITOR mode Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Developers sometimes need a short exit from LOCKDOWN. Workshop offers an audited, time-boxed switch to MONITOR that reverts automatically. Scope • Request (by user or admin) for MONITOR on one machine for a bounded duration, approved via the approval workflow or granted by an admin. • Implemented server-side as an expiring node mode override, delivered through the v1

client_mode

at preflight; the host reverts on its first sync after expiry. • Santa's own

mode_transition

/ temporary monitor mode is v2-only and not available to osctrl; do not depend on it. • Audit start, approval and expiry. Acceptance • Override expires server-side even if nobody acts; maximum duration is enforced. • Reversion latency is bounded by the sync interval (see #1179); document it. • Depends on: #1162, #1168, #1184 Protocol Third-party sync servers must use the stable v1 protos (

buf.build/gen/go/northpolesec/protos/protocolbuffers/go/sync

).

syncv2

is internal to North Pole Security and is being removed from the published protos (northpolesec/santa#1270). jmpsec/osctrl