A rules engine over the Real-Time Visitor Alerts stream. Define rules — when an alert matches (by id, minimum severity, kind, page contains, minimum fire-count, or device) run an action: flag the session, tag it, fire a webhook, or log it. Runs on demand or from cron over the persisted alert stream (rva_alerts); every produced action is idempotent per rule+alert so re-runs never duplicate, and flag/tag actions write a per-session record the rest of the hub can read. Transparent rules matching (not an LLM). Reads existing data — no extra tracking, cookieless. Feeds the Automation panel of the Visitor Intelligence hub.