Rules
Alerts → Rules. Config the owner enables, disables, and tests.

Same chrome as the catalog: search, type / severity / enabled chips, 25 / 50 / 100.
Types (phase 1)
| Type | Fires when | Scope |
|---|---|---|
| Agent offline | last_seen_at older than N minutes (default 5) | One agent or all |
| Stale resource | The agent has not seen the resource for N hours (default 24) | Resource, project, or whole catalog |
| Cost threshold | Monthly run-rate for a currency is above an amount | Workspace + currency |
| Upcoming payment | A costs calendar item is within N days | Workspace |
Empty scope = the whole workspace. Several scope fields at once narrow with AND. An incompatible scope for the type (an agent on a cost threshold) is rejected.
Severity: info / warning / critical. Cooldown after resolve is in seconds (minimum 60).
Test evaluates whether the rule would fire now, without opening an incident. Turning the switch off stops evaluation; open incidents stay.
Deleting a rule does not delete incidents already created: the inbox may show the rule as missing.