From 867a3559d50356c43c46adee858820cb2502ae8f Mon Sep 17 00:00:00 2001
From: ytnobody <ytnobody@gmail.com>
Date: Tue, 28 Jul 2026 12:35:22 +0900
Subject: [PATCH] feat(monitoring): add production health checks with
 auto-issue filing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a new internal/healthcheck package and run_health_checks MCP tool
(Issue #190): a project can declare [[health_checks]] command entries
in harness.toml, and the tool runs each one (30s timeout), returning
{name, ok, output} per check. Failing checks with no existing open
issue open a new "production-incident"-labeled issue (deduped by an
"[health-check: <name>]" title prefix); checks that recover get a
one-time "recovered at <time>" comment on the matching issue (never
auto-closed). Unconfigured projects see no change in behavior.

Wires health_checks_since into .hermit/superintendent-state.json
(get_loop_state/update_loop_state) and adds a new Superintendent-cycle
step (both HERMIT's own CLAUDE.md and the scaffolding template) that
calls run_health_checks on a 5-minute cadence, mirroring how
run_requirements_sweep is tracked hourly.

Assumption: the issue body referenced ".hermit/config.yaml" as the
existing test_command config file, but the actual config file in this
codebase is harness.toml ([requirements].test_command) — health_checks
follows the same harness.toml convention as [[repos]] etc.

Closes #190
---
 .claude/settings.json                       |   3 +-
 CLAUDE.md                                   |  21 +-
 cmd/hermit/main.go                          |  42 +++-
 cmd/hermit/serve_test.go                    |  12 +-
 cmd/hermit/templates/CLAUDE.md.tmpl         |  23 ++-
 cmd/hermit/templates/harness.toml.tmpl      |  15 ++
 cmd/hermit/unit_test.go                     |  81 ++++++++
 internal/healthcheck/github_adapter.go      |  75 ++++++++
 internal/healthcheck/github_adapter_test.go | 178 +++++++++++++++++
 internal/healthcheck/healthcheck.go         | 108 +++++++++++
 internal/healthcheck/healthcheck_test.go    |  95 ++++++++++
 internal/healthcheck/issues.go              |  46 +++++
 internal/healthcheck/reconcile.go           |  83 ++++++++
 internal/healthcheck/reconcile_test.go      | 200 ++++++++++++++++++++
 internal/mcp/req_test.go                    |   2 +-
 internal/mcp/server.go                      |  11 +-
 internal/mcp/tools.go                       |  51 ++++-
 internal/mcp/tools_test.go                  | 167 +++++++++++++++-
 internal/state/state.go                     |   9 +-
 internal/state/state_test.go                |   6 +-
 20 files changed, 1183 insertions(+), 45 deletions(-)
 create mode 100644 internal/healthcheck/github_adapter.go
 create mode 100644 internal/healthcheck/github_adapter_test.go
 create mode 100644 internal/healthcheck/healthcheck.go
 create mode 100644 internal/healthcheck/healthcheck_test.go
 create mode 100644 internal/healthcheck/issues.go
 create mode 100644 internal/healthcheck/reconcile.go
 create mode 100644 internal/healthcheck/reconcile_test.go

diff --git a/.claude/settings.json b/.claude/settings.json
index 4b9fabd..b72b40b 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -40,7 +40,8 @@
       "mcp__hermit__run_requirements_sweep",
       "mcp__hermit__now",
       "mcp__hermit__get_loop_state",
-      "mcp__hermit__update_loop_state"
+      "mcp__hermit__update_loop_state",
+      "mcp__hermit__run_health_checks"
     ]
   }
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index 913063d..8c34fdf 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -43,15 +43,20 @@ Because this cycle now runs with the full tool access of the invoking context (n
 7. Run the requirements reconcile sweep roughly once an hour using `run_requirements_sweep`, tracking a separate "last requirements-sweep time" across passes the same way step 5 tracks its own PR-comment-check "since" timestamp (store the current time before calling):
    - Only call `run_requirements_sweep` when at least 3600 seconds have elapsed since the last recorded sweep time; otherwise skip this step for the current pass (do not call the tool early — it runs the configured `test_command` for every requirement and shouldn't be wasted on sub-hourly passes)
    - Update the stored last-sweep timestamp to now after calling
-8. If there are no Issues, end this pass — the recurring cron trigger starts the next pass
-9. For each Issue (up to 4 at a time):
-   a. Mark as in-progress with `assign_issue` (assignee: your own username)
-   b. Create a worktree with `create_worktree` (base_branch: default branch)
-10. **Spawn all Engineers for the Issues prepared in step 9 in parallel at once using the Agent tool** (`run_in_background: true`, so this inline pass can wait for them without blocking on each one sequentially)
+8. Run the production health-check sweep roughly every 5 minutes using `run_health_checks` (Issue #190), tracking a separate "last health-check time" across passes (`health_checks_since`) the same way step 7 tracks its own requirements-sweep timestamp:
+   - Only call `run_health_checks` when at least 300 seconds have elapsed since the last recorded health-check time; otherwise skip this step for the current pass
+   - `run_health_checks` itself runs each configured `[[health_checks]]` command, opens a deduped `production-incident`-labeled Issue for any newly-failing check, and posts a one-time "recovered at ..." comment on the corresponding Issue for any check that has returned to passing (never auto-closing it) — no further action is needed here beyond calling the tool and updating the timestamp
+   - Update the stored last-health-check timestamp to now after calling
+   - If no `[[health_checks]]` are configured for this project, the tool is a no-op; keep calling it on cadence anyway rather than special-casing it away, so a project that later adds health checks starts getting swept without a CLAUDE.md change
+9. If there are no Issues, end this pass — the recurring cron trigger starts the next pass
+10. For each Issue (up to 4 at a time):
+    a. Mark as in-progress with `assign_issue` (assignee: your own username)
+    b. Create a worktree with `create_worktree` (base_branch: default branch)
+11. **Spawn all Engineers for the Issues prepared in step 10 in parallel at once using the Agent tool** (`run_in_background: true`, so this inline pass can wait for them without blocking on each one sequentially)
     - Information to pass to each Engineer: Issue number, title, body, `worktree_path` and `branch` returned by `create_worktree`
     - If the parallel count exceeds 4, process the first 4 and defer the rest to the next pass
-11. Wait for all Engineers to complete
-12. Run `check_ci_status` on the PR for each Issue (including PRs from Engineers spawned on an earlier pass that are still awaiting evaluation — use `list_prs` to find open HERMIT PRs)
+12. Wait for all Engineers to complete
+13. Run `check_ci_status` on the PR for each Issue (including PRs from Engineers spawned on an earlier pass that are still awaiting evaluation — use `list_prs` to find open HERMIT PRs)
     - If CI is failing: the tool automatically posts an investigation comment listing the failing checks; skip merging and wait for fixes
     - If CI is passing: run `evaluate_risk`
       - LOW / MEDIUM: run `merge_pr` with `worktree_path` and `branch` so the worktree is cleaned up automatically after a successful merge
@@ -61,7 +66,7 @@ Because this cycle now runs with the full tool access of the invoking context (n
         - Check whether the branch is stale relative to the base branch in a way that could hide semantic conflicts, not just textual `mergeable` conflicts
         - Post your findings as a separate PR comment via `add_issue_comment`: a short summary of what changed, anything concerning, and an explicit recommendation (e.g. "looks safe to merge pending approval" vs. "found X, should be fixed first")
         - Skip merging and wait for a human decision
-13. End the pass with a short report of what was done, and return control to the prompt — do **not** loop back to step 1 yourself; the recurring cron job fires the next pass
+14. End the pass with a short report of what was done, and return control to the prompt — do **not** loop back to step 1 yourself; the recurring cron job fires the next pass
 
 ---
 
diff --git a/cmd/hermit/main.go b/cmd/hermit/main.go
index e84d3af..9154ee3 100644
--- a/cmd/hermit/main.go
+++ b/cmd/hermit/main.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/ytnobody/hermit/internal/git"
 	gh "github.com/ytnobody/hermit/internal/github"
+	"github.com/ytnobody/hermit/internal/healthcheck"
 	"github.com/ytnobody/hermit/internal/mcp"
 	"github.com/ytnobody/hermit/internal/notification"
 	"github.com/ytnobody/hermit/internal/permissions"
@@ -79,6 +80,17 @@ func (r RiskConfig) toRiskConfig() risk.Config {
 	}
 }
 
+// HealthCheckEntry is a single [[health_checks]] entry: a named production
+// health check HERMIT runs periodically via the run_health_checks MCP tool
+// (Issue #190). Only Type "command" (the default when empty) is supported
+// today; entries with any other Type are skipped by healthcheck.RunChecks
+// as a forward-compatible no-op.
+type HealthCheckEntry struct {
+	Name    string `toml:"name"`
+	Command string `toml:"command"`
+	Type    string `toml:"type"`
+}
+
 type Config struct {
 	GitHub struct {
 		Owner              string `toml:"owner"`
@@ -164,7 +176,14 @@ type Config struct {
 		// needing to opt in.
 		Paths []string `toml:"paths"`
 	} `toml:"requirements"`
-	Security struct {
+	// HealthChecks is the [[health_checks]] array of tables (Issue #190):
+	// production health-check commands run periodically by the
+	// run_health_checks MCP tool. An empty/omitted list means the project
+	// has not opted into production health checks, in which case
+	// run_health_checks is a no-op — existing projects see no change in
+	// behavior.
+	HealthChecks []HealthCheckEntry `toml:"health_checks"`
+	Security     struct {
 		// TrustedAuthorAssociations is the allowlist of GitHub
 		// "author_association" values (e.g. "OWNER", "MEMBER",
 		// "COLLABORATOR", "CONTRIBUTOR", "FIRST_TIME_CONTRIBUTOR", "NONE")
@@ -530,6 +549,8 @@ func cmdServe() {
 		TestCommand: cfg.Requirements.TestCommand,
 	}
 
+	healthChecks := resolveHealthChecks(cfg)
+
 	model := mcp.ModelConfig{
 		Superintendent:       cfg.Model.Superintendent,
 		Engineer:             cfg.Model.Engineer,
@@ -539,7 +560,7 @@ func cmdServe() {
 		AnalystEffort:        resolveAnalystEffort(cfg),
 	}
 
-	if err := mcp.Serve(client, cfg.GitHub.RateLimitThreshold, rootDir, prefix, cfg.Agent.LoopInterval, cfg.Notification.WebhookURL, cfg.Notification.Type, repos, cfg.Agent.TriggerComment, readinessCfg, defaultRiskCfg, repoRiskCfgs, model, requirementsCfg, cfg.Agent.MaxEngineers); err != nil {
+	if err := mcp.Serve(client, cfg.GitHub.RateLimitThreshold, rootDir, prefix, cfg.Agent.LoopInterval, cfg.Notification.WebhookURL, cfg.Notification.Type, repos, cfg.Agent.TriggerComment, readinessCfg, defaultRiskCfg, repoRiskCfgs, model, requirementsCfg, cfg.Agent.MaxEngineers, healthChecks); err != nil {
 		fatal(err.Error())
 	}
 }
@@ -705,6 +726,23 @@ func resolveRequirementsDoc(cfg Config) string {
 	return defaultRequirementsDoc
 }
 
+// resolveHealthChecks converts cfg's [[health_checks]] entries (TOML shape)
+// into []healthcheck.Check for the run_health_checks MCP tool (Issue #190).
+// Entries missing a name or command are skipped rather than passed through
+// as a broken check, since an empty Command would otherwise run `sh -c ""`
+// (a vacuous success) on every sweep.
+func resolveHealthChecks(cfg Config) []healthcheck.Check {
+	var checks []healthcheck.Check
+	for _, e := range cfg.HealthChecks {
+		if e.Name == "" || e.Command == "" {
+			log.Printf("health_checks: skipping entry with missing name or command: %+v", e)
+			continue
+		}
+		checks = append(checks, healthcheck.Check{Name: e.Name, Command: e.Command, Type: e.Type})
+	}
+	return checks
+}
+
 // runRequirementsSweep runs the requirements reconcile sweep (Issue #106) at
 // `hermit serve` startup: it parses the requirements document for "## REQ-xxx:"
 // blocks, runs each requirement's test via the configured test_command, and
diff --git a/cmd/hermit/serve_test.go b/cmd/hermit/serve_test.go
index 6e67c26..c9df513 100644
--- a/cmd/hermit/serve_test.go
+++ b/cmd/hermit/serve_test.go
@@ -103,8 +103,8 @@ language      = "ja"
 				continue
 			}
 			tools, _ := msg.Result["tools"].([]any)
-			if len(tools) != 20 {
-				t.Errorf("expected 20 tools, got %d", len(tools))
+			if len(tools) != 21 {
+				t.Errorf("expected 21 tools, got %d", len(tools))
 			}
 			return
 		case <-deadline:
@@ -207,8 +207,8 @@ language      = "ja"
 				continue
 			}
 			tools, _ := msg.Result["tools"].([]any)
-			if len(tools) != 20 {
-				t.Errorf("expected 20 tools, got %d", len(tools))
+			if len(tools) != 21 {
+				t.Errorf("expected 21 tools, got %d", len(tools))
 			}
 			return
 		case <-deadline:
@@ -314,8 +314,8 @@ language      = "ja"
 				continue
 			}
 			tools, _ := msg.Result["tools"].([]any)
-			if len(tools) != 20 {
-				t.Errorf("expected 20 tools, got %d", len(tools))
+			if len(tools) != 21 {
+				t.Errorf("expected 21 tools, got %d", len(tools))
 			}
 			return
 		case <-deadline:
diff --git a/cmd/hermit/templates/CLAUDE.md.tmpl b/cmd/hermit/templates/CLAUDE.md.tmpl
index 2431c77..ec60fb5 100644
--- a/cmd/hermit/templates/CLAUDE.md.tmpl
+++ b/cmd/hermit/templates/CLAUDE.md.tmpl
@@ -24,19 +24,24 @@
    - Only call `run_requirements_sweep` when at least 3600 seconds have elapsed since the last recorded sweep time; otherwise skip this step for the current pass
    - Update the stored last-sweep timestamp to now after calling
    - Note this is distinct from step 5: step 5 is about a human dictating new/changed requirements via conversation; this step is about detecting when already-declared requirements have silently regressed or gone unimplemented in the code, by re-running the reconcile sweep against the current requirements document
-7. If there are no non-requirements Issues, end this pass — the recurring cron trigger starts the next pass
-8. For each remaining Issue (up to {{ .MaxEngineers }} at a time), perform a granularity check:
+7. Run the production health-check sweep roughly every 5 minutes using `run_health_checks` (Issue #190), tracking a "last health-check time" across passes (`health_checks_since`) the same way step 6 tracks its own requirements-sweep timestamp:
+   - Only call `run_health_checks` when at least 300 seconds have elapsed since the last recorded health-check time; otherwise skip this step for the current pass
+   - `run_health_checks` itself runs each configured `[[health_checks]]` command, opens a deduped `production-incident`-labeled Issue for any newly-failing check, and posts a one-time "recovered at ..." comment on the corresponding Issue for any check that has returned to passing (never auto-closing it) — no further action is needed here beyond calling the tool and updating the timestamp
+   - Update the stored last-health-check timestamp to now after calling
+   - If no `[[health_checks]]` are configured for this project, the tool is a no-op; keep calling it on cadence anyway rather than special-casing it away
+8. If there are no non-requirements Issues, end this pass — the recurring cron trigger starts the next pass
+9. For each remaining Issue (up to {{ .MaxEngineers }} at a time), perform a granularity check:
    - If the Issue body is empty, extremely short, or covers multiple independent features, judge it as **ambiguous or too large**
    - Ambiguous/oversized Issues: post a `[Clarification Needed]` comment via `add_issue_comment` and skip
    - For Issues of appropriate scope only:
      a. Mark as in-progress with `assign_issue` (assignee: your own username)
      b. Create a worktree with `create_worktree` (base_branch: default branch)
-9. **Spawn all Engineers for the Issues prepared in step 8 in parallel at once using the Agent tool** (`run_in_background: true`, so this inline pass can wait for them without blocking on each one sequentially)
-   - Information to pass to each Engineer: Issue number, title, body, `worktree_path` and `branch` returned by `create_worktree`
-   - Call the Agent tool with `model: "{{ .EngineerModel }}"`{{ if .EngineerEffort }} and `effort: "{{ .EngineerEffort }}"`{{ end }} so each Engineer runs with the model{{ if .EngineerEffort }}/effort{{ end }} configured in `harness.toml`'s `[model]` section
-   - If the parallel count exceeds {{ .MaxEngineers }}, process the first {{ .MaxEngineers }} and defer the rest to the next pass
-10. Wait for all Engineers to complete
-11. Run `evaluate_risk` on the PR for each Issue (including PRs opened by Engineers spawned on an earlier pass that are still awaiting evaluation — use `list_prs` to find open HERMIT PRs)
+10. **Spawn all Engineers for the Issues prepared in step 9 in parallel at once using the Agent tool** (`run_in_background: true`, so this inline pass can wait for them without blocking on each one sequentially)
+    - Information to pass to each Engineer: Issue number, title, body, `worktree_path` and `branch` returned by `create_worktree`
+    - Call the Agent tool with `model: "{{ .EngineerModel }}"`{{ if .EngineerEffort }} and `effort: "{{ .EngineerEffort }}"`{{ end }} so each Engineer runs with the model{{ if .EngineerEffort }}/effort{{ end }} configured in `harness.toml`'s `[model]` section
+    - If the parallel count exceeds {{ .MaxEngineers }}, process the first {{ .MaxEngineers }} and defer the rest to the next pass
+11. Wait for all Engineers to complete
+12. Run `evaluate_risk` on the PR for each Issue (including PRs opened by Engineers spawned on an earlier pass that are still awaiting evaluation — use `list_prs` to find open HERMIT PRs)
     - LOW / MEDIUM: run `merge_pr` with `worktree_path`/`branch` so the worktree is cleaned up automatically
     - HIGH: `evaluate_risk` auto-posts a generic risk comment (`⚠️ HERMIT: HIGH risk detected.\nReasons: [...]`) restating the `risk_reasons`. That comment is not a review — before skipping, perform a substantive review of the PR yourself:
       - Read the actual diff (not just the file paths / line counts in `risk_reasons`)
@@ -44,7 +49,7 @@
       - Check whether the branch is stale relative to the base branch in a way that could hide semantic conflicts, not just textual `mergeable` conflicts
       - Post your findings as a separate PR comment via `add_issue_comment`: a short summary of what changed, anything concerning, and an explicit recommendation (e.g. "looks safe to merge pending approval" vs. "found X, should be fixed first")
       - Skip merging and wait for a human decision
-12. End the pass with a short report of what was done, and return control to the prompt — do **not** loop back to step 1 yourself; the recurring cron job fires the next pass
+13. End the pass with a short report of what was done, and return control to the prompt — do **not** loop back to step 1 yourself; the recurring cron job fires the next pass
 
 ---
 
diff --git a/cmd/hermit/templates/harness.toml.tmpl b/cmd/hermit/templates/harness.toml.tmpl
index 9b3b5e3..3dc59de 100644
--- a/cmd/hermit/templates/harness.toml.tmpl
+++ b/cmd/hermit/templates/harness.toml.tmpl
@@ -79,3 +79,18 @@ analyst_effort         = "{{ .AnalystEffort }}"  # reasoning effort: low/medium/
 
 # [run]
 # failure_notify_threshold = 3  # `hermit run`: consecutive failed passes before a [notification] webhook fires (default: 3)
+
+# [[health_checks]]
+# # Production health checks run periodically by the run_health_checks MCP
+# # tool (Issue #190). Each entry's command is run with a 30s timeout; exit
+# # code 0 means healthy. A failing check with no existing open issue opens
+# # one labeled "production-incident" (deduped by an "[health-check: <name>]"
+# # title prefix); a check that recovers gets a one-time "recovered at ..."
+# # comment on that issue (it is never auto-closed). Omitting this section
+# # entirely (the default) means run_health_checks is a no-op.
+# name    = "api-health"
+# command = "curl -sf https://example.com/healthz"
+# # type: only "command" is supported today (default when omitted); other
+# # values are reserved for future check mechanisms (e.g. "http") and are
+# # skipped if set to anything else.
+# type    = "command"
diff --git a/cmd/hermit/unit_test.go b/cmd/hermit/unit_test.go
index 54e3ef0..555b729 100644
--- a/cmd/hermit/unit_test.go
+++ b/cmd/hermit/unit_test.go
@@ -1165,3 +1165,84 @@ func TestResolveAnalystEffort_FallsBackToSuperintendentEffort(t *testing.T) {
 		t.Errorf("resolveAnalystEffort() = %q, want configured %q", got, "medium")
 	}
 }
+
+// --- health_checks (Issue #190) ---
+
+// TestLoadConfig_HealthChecks verifies that [[health_checks]] entries in
+// harness.toml are parsed into Config.HealthChecks.
+func TestLoadConfig_HealthChecks(t *testing.T) {
+	dir := t.TempDir()
+	content := `[github]
+owner = "owner"
+repo  = "repo"
+
+[[health_checks]]
+name    = "api-health"
+command = "curl -sf https://example.com/healthz"
+
+[[health_checks]]
+name    = "db-health"
+command = "pg_isready"
+type    = "command"
+`
+	if err := os.WriteFile(filepath.Join(dir, "harness.toml"), []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	prev, _ := os.Getwd()
+	os.Chdir(dir)
+	defer os.Chdir(prev)
+
+	cfg := loadConfig()
+	if len(cfg.HealthChecks) != 2 {
+		t.Fatalf("expected 2 health_checks entries, got %d: %+v", len(cfg.HealthChecks), cfg.HealthChecks)
+	}
+	if cfg.HealthChecks[0].Name != "api-health" || cfg.HealthChecks[0].Command != "curl -sf https://example.com/healthz" {
+		t.Errorf("unexpected first health check: %+v", cfg.HealthChecks[0])
+	}
+	if cfg.HealthChecks[1].Name != "db-health" || cfg.HealthChecks[1].Type != "command" {
+		t.Errorf("unexpected second health check: %+v", cfg.HealthChecks[1])
+	}
+}
+
+// TestLoadConfig_HealthChecks_Omitted verifies that a project with no
+// [[health_checks]] section at all parses to a nil/empty slice — the
+// "unconfigured is a no-op" contract from Issue #190.
+func TestLoadConfig_HealthChecks_Omitted(t *testing.T) {
+	dir := t.TempDir()
+	content := `[github]
+owner = "owner"
+repo  = "repo"
+`
+	if err := os.WriteFile(filepath.Join(dir, "harness.toml"), []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	prev, _ := os.Getwd()
+	os.Chdir(dir)
+	defer os.Chdir(prev)
+
+	cfg := loadConfig()
+	if len(cfg.HealthChecks) != 0 {
+		t.Errorf("expected no health_checks entries, got %+v", cfg.HealthChecks)
+	}
+	if got := resolveHealthChecks(cfg); len(got) != 0 {
+		t.Errorf("resolveHealthChecks() = %v, want empty", got)
+	}
+}
+
+// TestResolveHealthChecks_SkipsIncompleteEntries verifies that entries
+// missing a name or command are skipped rather than passed through as a
+// broken check (which would otherwise silently run `sh -c ""`, a vacuous
+// success, on every sweep).
+func TestResolveHealthChecks_SkipsIncompleteEntries(t *testing.T) {
+	cfg := Config{
+		HealthChecks: []HealthCheckEntry{
+			{Name: "good-check", Command: "exit 0"},
+			{Name: "", Command: "exit 0"},
+			{Name: "no-command", Command: ""},
+		},
+	}
+	got := resolveHealthChecks(cfg)
+	if len(got) != 1 || got[0].Name != "good-check" {
+		t.Errorf("resolveHealthChecks() = %+v, want only good-check", got)
+	}
+}
diff --git a/internal/healthcheck/github_adapter.go b/internal/healthcheck/github_adapter.go
new file mode 100644
index 0000000..2458522
--- /dev/null
+++ b/internal/healthcheck/github_adapter.go
@@ -0,0 +1,75 @@
+package healthcheck
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	gh "github.com/ytnobody/hermit/internal/github"
+)
+
+// ghClient is the subset of *github.Client the GitHub-backed IssueClient
+// adapter needs. It is defined locally (rather than depending on the
+// concrete *github.Client) so it can be satisfied by a lightweight fake in
+// tests, mirroring internal/requirements/github_adapter.go's ghClient.
+type ghClient interface {
+	ListOpenIssues(label string) ([]gh.Issue, error)
+	CreateIssue(title, body string) (int, error)
+	AddLabel(number int, label string) error
+	HasCommentMatching(number int, trigger string) (bool, error)
+	PostComment(number int, body string) error
+}
+
+// GitHubIssueClient adapts a GitHub client to the IssueClient interface used
+// by Reconcile, deduping against open issues by matching the
+// "[health-check: <name>]" title prefix (see TitlePrefix).
+type GitHubIssueClient struct {
+	client ghClient
+}
+
+// NewGitHubIssueClient wraps client for use as a Reconcile IssueClient.
+func NewGitHubIssueClient(client ghClient) *GitHubIssueClient {
+	return &GitHubIssueClient{client: client}
+}
+
+func (g *GitHubIssueClient) FindOpenIssue(name string) (int, bool, error) {
+	issues, err := g.client.ListOpenIssues("")
+	if err != nil {
+		return 0, false, err
+	}
+	prefix := TitlePrefix(name)
+	for _, issue := range issues {
+		if strings.HasPrefix(issue.Title, prefix) {
+			return issue.Number, true, nil
+		}
+	}
+	return 0, false, nil
+}
+
+func (g *GitHubIssueClient) CreateIncidentIssue(name, command, output string, detectedAt time.Time) (int, error) {
+	title := fmt.Sprintf("%s health check failing", TitlePrefix(name))
+	body := fmt.Sprintf(
+		"## Production health check failure\n\n"+
+			"- **Check name**: %s\n"+
+			"- **Command**: `%s`\n"+
+			"- **Detected at**: %s\n\n"+
+			"### Output\n\n```\n%s\n```\n",
+		name, command, detectedAt.UTC().Format(time.RFC3339), output,
+	)
+	num, err := g.client.CreateIssue(title, body)
+	if err != nil {
+		return 0, err
+	}
+	if err := g.client.AddLabel(num, IncidentLabel); err != nil {
+		return num, err
+	}
+	return num, nil
+}
+
+func (g *GitHubIssueClient) HasRecoveredComment(number int) (bool, error) {
+	return g.client.HasCommentMatching(number, RecoveredTrigger)
+}
+
+func (g *GitHubIssueClient) PostRecoveredComment(number int, recoveredAt time.Time) error {
+	return g.client.PostComment(number, fmt.Sprintf("%s %s", RecoveredTrigger, recoveredAt.UTC().Format(time.RFC3339)))
+}
diff --git a/internal/healthcheck/github_adapter_test.go b/internal/healthcheck/github_adapter_test.go
new file mode 100644
index 0000000..c7d558f
--- /dev/null
+++ b/internal/healthcheck/github_adapter_test.go
@@ -0,0 +1,178 @@
+package healthcheck
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	gh "github.com/ytnobody/hermit/internal/github"
+)
+
+type fakeGHClient struct {
+	openIssues []gh.Issue
+	comments   map[int][]string
+	createdN   int
+
+	listErr        error
+	createErr      error
+	addLabelErr    error
+	hasCommentErr  error
+	postCommentErr error
+
+	addedLabels []string
+	posted      []string
+}
+
+func newFakeGHClient() *fakeGHClient {
+	return &fakeGHClient{comments: map[int][]string{}}
+}
+
+func (f *fakeGHClient) ListOpenIssues(label string) ([]gh.Issue, error) {
+	if f.listErr != nil {
+		return nil, f.listErr
+	}
+	return f.openIssues, nil
+}
+
+func (f *fakeGHClient) CreateIssue(title, body string) (int, error) {
+	if f.createErr != nil {
+		return 0, f.createErr
+	}
+	f.createdN++
+	f.openIssues = append(f.openIssues, gh.Issue{Number: f.createdN, Title: title, Body: body})
+	return f.createdN, nil
+}
+
+func (f *fakeGHClient) AddLabel(number int, label string) error {
+	if f.addLabelErr != nil {
+		return f.addLabelErr
+	}
+	f.addedLabels = append(f.addedLabels, label)
+	return nil
+}
+
+func (f *fakeGHClient) HasCommentMatching(number int, trigger string) (bool, error) {
+	if f.hasCommentErr != nil {
+		return false, f.hasCommentErr
+	}
+	for _, c := range f.comments[number] {
+		if strings.Contains(strings.ToLower(c), strings.ToLower(trigger)) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (f *fakeGHClient) PostComment(number int, body string) error {
+	if f.postCommentErr != nil {
+		return f.postCommentErr
+	}
+	f.comments[number] = append(f.comments[number], body)
+	f.posted = append(f.posted, body)
+	return nil
+}
+
+func TestGitHubIssueClient_FindOpenIssue_MatchesTitlePrefix(t *testing.T) {
+	fake := newFakeGHClient()
+	fake.openIssues = []gh.Issue{
+		{Number: 1, Title: "unrelated issue"},
+		{Number: 2, Title: TitlePrefix("api-health") + " health check failing"},
+	}
+	client := NewGitHubIssueClient(fake)
+
+	num, found, err := client.FindOpenIssue("api-health")
+	if err != nil {
+		t.Fatalf("FindOpenIssue() error = %v", err)
+	}
+	if !found || num != 2 {
+		t.Errorf("FindOpenIssue() = (%d, %v), want (2, true)", num, found)
+	}
+
+	// A different check name must not match.
+	_, found, err = client.FindOpenIssue("other-check")
+	if err != nil {
+		t.Fatalf("FindOpenIssue() error = %v", err)
+	}
+	if found {
+		t.Errorf("should not match an issue for a different check name")
+	}
+}
+
+func TestGitHubIssueClient_CreateIncidentIssue_EmbedsDetailsAndLabels(t *testing.T) {
+	fake := newFakeGHClient()
+	client := NewGitHubIssueClient(fake)
+	now := time.Date(2026, 7, 28, 12, 0, 0, 0, time.UTC)
+
+	num, err := client.CreateIncidentIssue("api-health", "curl -sf https://example.com/healthz", "connection refused", now)
+	if err != nil {
+		t.Fatalf("CreateIncidentIssue() error = %v", err)
+	}
+	if len(fake.openIssues) != 1 {
+		t.Fatalf("expected 1 issue to be created, got %d", len(fake.openIssues))
+	}
+	issue := fake.openIssues[0]
+	if issue.Number != num {
+		t.Errorf("issue.Number = %d, want %d", issue.Number, num)
+	}
+	if !strings.HasPrefix(issue.Title, TitlePrefix("api-health")) {
+		t.Errorf("issue.Title = %q, want it to start with %q", issue.Title, TitlePrefix("api-health"))
+	}
+	for _, want := range []string{"api-health", "curl -sf https://example.com/healthz", "connection refused", "2026-07-28T12:00:00Z"} {
+		if !strings.Contains(issue.Body, want) {
+			t.Errorf("issue.Body = %q, want it to contain %q", issue.Body, want)
+		}
+	}
+	if len(fake.addedLabels) != 1 || fake.addedLabels[0] != IncidentLabel {
+		t.Errorf("addedLabels = %v, want [%q]", fake.addedLabels, IncidentLabel)
+	}
+
+	// The just-created issue must now be discoverable by FindOpenIssue too.
+	found, ok, err := client.FindOpenIssue("api-health")
+	if err != nil || !ok || found != num {
+		t.Errorf("FindOpenIssue() = (%d, %v, %v), want (%d, true, nil)", found, ok, err, num)
+	}
+}
+
+func TestGitHubIssueClient_RecoveredComment_OnceOnly(t *testing.T) {
+	fake := newFakeGHClient()
+	client := NewGitHubIssueClient(fake)
+	now := time.Date(2026, 7, 28, 13, 30, 0, 0, time.UTC)
+
+	has, err := client.HasRecoveredComment(1)
+	if err != nil {
+		t.Fatalf("HasRecoveredComment() error = %v", err)
+	}
+	if has {
+		t.Errorf("expected no recovered comment yet")
+	}
+
+	if err := client.PostRecoveredComment(1, now); err != nil {
+		t.Fatalf("PostRecoveredComment() error = %v", err)
+	}
+	if len(fake.posted) != 1 || !strings.Contains(fake.posted[0], "2026-07-28T13:30:00Z") {
+		t.Errorf("posted = %v, want a comment mentioning the timestamp", fake.posted)
+	}
+
+	has, err = client.HasRecoveredComment(1)
+	if err != nil {
+		t.Fatalf("HasRecoveredComment() error = %v", err)
+	}
+	if !has {
+		t.Errorf("expected HasRecoveredComment to report true after posting")
+	}
+}
+
+func TestGitHubIssueClient_FindOpenIssue_PropagatesListError(t *testing.T) {
+	fake := newFakeGHClient()
+	fake.listErr = errFake
+	client := NewGitHubIssueClient(fake)
+	if _, _, err := client.FindOpenIssue("api-health"); err == nil {
+		t.Fatalf("expected error to propagate from ListOpenIssues")
+	}
+}
+
+var errFake = &fakeErr{"boom"}
+
+type fakeErr struct{ msg string }
+
+func (e *fakeErr) Error() string { return e.msg }
diff --git a/internal/healthcheck/healthcheck.go b/internal/healthcheck/healthcheck.go
new file mode 100644
index 0000000..c26755c
--- /dev/null
+++ b/internal/healthcheck/healthcheck.go
@@ -0,0 +1,108 @@
+// Package healthcheck implements the production health-check sweep
+// described in HERMIT Issue #190: a project can declare a list of
+// [[health_checks]] commands in harness.toml, and the Superintendent loop
+// periodically runs them, opening (deduped) GitHub issues for newly-failing
+// checks and posting a one-time "recovered" comment when a previously
+// failing check starts passing again.
+//
+// This intentionally mirrors internal/requirements' config-loading,
+// command-execution/timeout, and MCP-tool-registration patterns (see
+// internal/requirements/runner.go and internal/requirements/reconcile.go) so
+// the two sweeps stay consistent for anyone reading both.
+package healthcheck
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"time"
+)
+
+// Check is a single configured health check.
+type Check struct {
+	// Name identifies the check (used in the issue title-prefix dedup
+	// convention "[health-check: <name>]" — see TitlePrefix).
+	Name string
+	// Command is the shell command executed to determine health. Exit code
+	// 0 is treated as healthy (ok:true); any other exit code, or a command
+	// that fails to start, is treated as unhealthy (ok:false).
+	Command string
+	// Type selects the check mechanism. Only "command" (the zero value
+	// also defaults to "command") is supported today; any other value is
+	// skipped by RunChecks as a forward-compatible no-op (e.g. a future
+	// "http" type declared in harness.toml by a newer HERMIT version).
+	Type string
+}
+
+// Result is the outcome of running a single Check.
+type Result struct {
+	Name   string `json:"name"`
+	Ok     bool   `json:"ok"`
+	Output string `json:"output"`
+}
+
+// Timeout is the maximum duration a single health-check command may run
+// before being treated as a failure. It is a var (not a const) so tests can
+// shrink it to keep the timeout path fast to exercise; production code
+// should treat it as a constant and leave it at its default value.
+var Timeout = 30 * time.Second
+
+// WaitDelay bounds how long a timed-out check's CombinedOutput call may
+// additionally block waiting for output pipes to close (see runOne). Also a
+// var so tests can shrink it.
+var WaitDelay = 2 * time.Second
+
+// TypeCommand is the only currently-supported Check.Type value.
+const TypeCommand = "command"
+
+// RunChecks executes each configured check's command and returns one Result
+// per supported check, in the same order as checks. Checks whose Type is
+// set to anything other than "" or "command" are silently skipped (not
+// included in the returned slice) — see Check.Type.
+func RunChecks(checks []Check) []Result {
+	results := make([]Result, 0, len(checks))
+	for _, c := range checks {
+		if c.Type != "" && c.Type != TypeCommand {
+			continue
+		}
+		results = append(results, runOne(c))
+	}
+	return results
+}
+
+// runOne runs a single check's command with a Timeout deadline, via
+// `sh -c` (matching requirements.CommandRunner's convention).
+func runOne(c Check) Result {
+	ctx, cancel := context.WithTimeout(context.Background(), Timeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "sh", "-c", c.Command)
+	// WaitDelay bounds how long CombinedOutput waits for the output pipes
+	// to close after the process is killed. Without it, a command whose
+	// shell forks a grandchild that inherits stdout/stderr (rather than
+	// exec-replacing itself, which depends on the shell) can leave
+	// CombinedOutput blocked for the grandchild's full runtime even though
+	// the immediate child was killed on the Timeout deadline — silently
+	// defeating the timeout. See https://pkg.go.dev/os/exec#Cmd.WaitDelay.
+	cmd.WaitDelay = WaitDelay
+	out, err := cmd.CombinedOutput()
+	output := string(out)
+
+	if ctx.Err() == context.DeadlineExceeded {
+		return Result{
+			Name:   c.Name,
+			Ok:     false,
+			Output: appendNote(output, fmt.Sprintf("(timed out after %s)", Timeout)),
+		}
+	}
+	return Result{Name: c.Name, Ok: err == nil, Output: output}
+}
+
+// appendNote appends note to output on its own trailing line, avoiding a
+// leading blank line when output is empty.
+func appendNote(output, note string) string {
+	if output == "" {
+		return note
+	}
+	return output + "\n" + note
+}
diff --git a/internal/healthcheck/healthcheck_test.go b/internal/healthcheck/healthcheck_test.go
new file mode 100644
index 0000000..2d098ba
--- /dev/null
+++ b/internal/healthcheck/healthcheck_test.go
@@ -0,0 +1,95 @@
+package healthcheck
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestRunChecks_Passed(t *testing.T) {
+	results := RunChecks([]Check{{Name: "ok-check", Command: "echo all-good; exit 0"}})
+	if len(results) != 1 {
+		t.Fatalf("len(results) = %d, want 1", len(results))
+	}
+	r := results[0]
+	if r.Name != "ok-check" {
+		t.Errorf("Name = %q, want %q", r.Name, "ok-check")
+	}
+	if !r.Ok {
+		t.Errorf("Ok = false, want true (output=%q)", r.Output)
+	}
+	if !strings.Contains(r.Output, "all-good") {
+		t.Errorf("Output = %q, want it to contain %q", r.Output, "all-good")
+	}
+}
+
+func TestRunChecks_Failed(t *testing.T) {
+	results := RunChecks([]Check{{Name: "bad-check", Command: "echo something-broke; exit 1"}})
+	if len(results) != 1 {
+		t.Fatalf("len(results) = %d, want 1", len(results))
+	}
+	r := results[0]
+	if r.Ok {
+		t.Errorf("Ok = true, want false")
+	}
+	if !strings.Contains(r.Output, "something-broke") {
+		t.Errorf("Output = %q, want it to contain %q", r.Output, "something-broke")
+	}
+}
+
+func TestRunChecks_Timeout(t *testing.T) {
+	origTimeout, origWaitDelay := Timeout, WaitDelay
+	// Shrink the timeout (and its WaitDelay grace period) for the test so
+	// it runs fast; restore both after.
+	Timeout = 50 * time.Millisecond
+	WaitDelay = 50 * time.Millisecond
+	defer func() { Timeout, WaitDelay = origTimeout, origWaitDelay }()
+
+	results := RunChecks([]Check{{Name: "slow-check", Command: "sleep 5"}})
+	if len(results) != 1 {
+		t.Fatalf("len(results) = %d, want 1", len(results))
+	}
+	r := results[0]
+	if r.Ok {
+		t.Errorf("Ok = true, want false (command should have timed out)")
+	}
+	if !strings.Contains(r.Output, "timed out") {
+		t.Errorf("Output = %q, want it to mention the timeout", r.Output)
+	}
+}
+
+func TestRunChecks_MultipleInOrder(t *testing.T) {
+	results := RunChecks([]Check{
+		{Name: "first", Command: "exit 0"},
+		{Name: "second", Command: "exit 1"},
+	})
+	if len(results) != 2 {
+		t.Fatalf("len(results) = %d, want 2", len(results))
+	}
+	if results[0].Name != "first" || !results[0].Ok {
+		t.Errorf("results[0] = %+v, want ok first", results[0])
+	}
+	if results[1].Name != "second" || results[1].Ok {
+		t.Errorf("results[1] = %+v, want failing second", results[1])
+	}
+}
+
+func TestRunChecks_SkipsUnsupportedType(t *testing.T) {
+	results := RunChecks([]Check{
+		{Name: "command-check", Command: "exit 0", Type: "command"},
+		{Name: "http-check", Command: "irrelevant", Type: "http"},
+		{Name: "default-type-check", Command: "exit 0"},
+	})
+	var names []string
+	for _, r := range results {
+		names = append(names, r.Name)
+	}
+	if len(results) != 2 {
+		t.Fatalf("results = %v, want only the two supported (command-type) checks", names)
+	}
+	for _, n := range names {
+		if n == "http-check" {
+			t.Errorf("unsupported type=http check %q should have been skipped, got results = %v", n, names)
+		}
+	}
+}
diff --git a/internal/healthcheck/issues.go b/internal/healthcheck/issues.go
new file mode 100644
index 0000000..1467e19
--- /dev/null
+++ b/internal/healthcheck/issues.go
@@ -0,0 +1,46 @@
+package healthcheck
+
+import (
+	"fmt"
+	"time"
+)
+
+// IncidentLabel is the GitHub label applied to every issue this package
+// opens for a failing health check.
+const IncidentLabel = "production-incident"
+
+// TitlePrefix returns the "[health-check: <name>]" title-prefix convention
+// used to identify/dedupe the GitHub issue for a given check name. Per
+// Issue #190, dedup is judged by scanning open issue titles for this exact
+// prefix (not a hidden marker comment, unlike internal/requirements' sweep)
+// so a human skimming the issue list can immediately tell which check an
+// incident issue is about.
+func TitlePrefix(name string) string {
+	return fmt.Sprintf("[health-check: %s]", name)
+}
+
+// RecoveredTrigger is the substring HasRecoveredComment implementations
+// look for in an issue's comments to decide whether the one-time recovery
+// comment has already been posted (see PostRecoveredComment).
+const RecoveredTrigger = "recovered at"
+
+// IssueClient is the subset of GitHub issue operations the health-check
+// reconcile needs. It is deliberately narrow so tests can supply an
+// in-memory fake, mirroring internal/requirements.IssueClient.
+type IssueClient interface {
+	// FindOpenIssue reports whether an open issue already exists for the
+	// given check name (matched via TitlePrefix), and its issue number if
+	// so.
+	FindOpenIssue(name string) (number int, found bool, err error)
+	// CreateIncidentIssue opens a new production-incident-labeled issue for
+	// a failing check, embedding the check name, command, failure output,
+	// and detection time into the issue body.
+	CreateIncidentIssue(name, command, output string, detectedAt time.Time) (number int, err error)
+	// HasRecoveredComment reports whether the given issue already has a
+	// one-time "recovered at ..." comment posted on it.
+	HasRecoveredComment(number int) (bool, error)
+	// PostRecoveredComment posts the one-time "recovered at <time>" comment
+	// on the given issue. The issue is never closed by this package (Issue
+	// #190 explicitly excludes auto-close).
+	PostRecoveredComment(number int, recoveredAt time.Time) error
+}
diff --git a/internal/healthcheck/reconcile.go b/internal/healthcheck/reconcile.go
new file mode 100644
index 0000000..2aed69e
--- /dev/null
+++ b/internal/healthcheck/reconcile.go
@@ -0,0 +1,83 @@
+package healthcheck
+
+import "time"
+
+// Summary is the aggregated outcome of Reconcile: the raw per-check Results
+// (already produced by RunChecks) plus counts of the side effects Reconcile
+// performed against GitHub.
+type Summary struct {
+	// Results is the same slice passed in, returned here so a single
+	// Summary value carries everything an MCP tool response needs.
+	Results []Result
+	// IssuesOpened is the number of new production-incident issues opened
+	// this call (one per newly-failing check that had no matching open
+	// issue yet).
+	IssuesOpened int
+	// RecoveredComments is the number of one-time "recovered at ..."
+	// comments posted this call.
+	RecoveredComments int
+}
+
+// Reconcile runs the dedup/issue-filing/recovery-comment logic described in
+// Issue #190 against results (already produced by RunChecks for the given
+// checks). now is passed in (rather than computed internally) so
+// callers/tests control the timestamp recorded in issue bodies/comments.
+//
+// checks is used only to look up each result's original command (for the
+// incident issue body) by name; results not present in checks (which
+// should not happen in normal use, since results comes from
+// RunChecks(checks)) are treated as having an empty command rather than
+// erroring.
+//
+// For each result:
+//   - ok:false with no existing open issue (matched via TitlePrefix) ->
+//     a new production-incident issue is opened.
+//   - ok:false with an existing open issue -> no-op (already tracked,
+//     Issue #190 explicitly excludes ongoing-failure progress comments).
+//   - ok:true with an existing open issue that has no "recovered at ..."
+//     comment yet -> that one-time comment is posted (the issue is never
+//     closed).
+//   - ok:true with an existing open issue that already has the recovered
+//     comment, or ok:true with no open issue at all -> no-op.
+func Reconcile(checks []Check, results []Result, issues IssueClient, now time.Time) (Summary, error) {
+	commands := make(map[string]string, len(checks))
+	for _, c := range checks {
+		commands[c.Name] = c.Command
+	}
+
+	summary := Summary{Results: results}
+	for _, r := range results {
+		num, found, err := issues.FindOpenIssue(r.Name)
+		if err != nil {
+			return summary, err
+		}
+
+		if !r.Ok {
+			if found {
+				continue
+			}
+			if _, err := issues.CreateIncidentIssue(r.Name, commands[r.Name], r.Output, now); err != nil {
+				return summary, err
+			}
+			summary.IssuesOpened++
+			continue
+		}
+
+		// r.Ok == true
+		if !found {
+			continue
+		}
+		already, err := issues.HasRecoveredComment(num)
+		if err != nil {
+			return summary, err
+		}
+		if already {
+			continue
+		}
+		if err := issues.PostRecoveredComment(num, now); err != nil {
+			return summary, err
+		}
+		summary.RecoveredComments++
+	}
+	return summary, nil
+}
diff --git a/internal/healthcheck/reconcile_test.go b/internal/healthcheck/reconcile_test.go
new file mode 100644
index 0000000..033b030
--- /dev/null
+++ b/internal/healthcheck/reconcile_test.go
@@ -0,0 +1,200 @@
+package healthcheck
+
+import (
+	"testing"
+	"time"
+)
+
+// fakeIssueClient is an in-memory IssueClient for testing Reconcile,
+// mirroring the style of internal/requirements' test fakes.
+type fakeIssueClient struct {
+	// openIssues maps check name -> issue number, for issues considered
+	// "open" for this test.
+	openIssues map[string]int
+	// recoveredComments tracks which issue numbers already have the
+	// one-time recovered comment.
+	recoveredComments map[int]bool
+
+	created          []createdIssue
+	postedRecovered  []int
+	nextIssueNumber  int
+	findOpenIssueErr error
+	createIssueErr   error
+	hasRecoveredErr  error
+	postRecoveredErr error
+}
+
+type createdIssue struct {
+	name, command, output string
+	detectedAt            time.Time
+}
+
+func newFakeIssueClient() *fakeIssueClient {
+	return &fakeIssueClient{
+		openIssues:        map[string]int{},
+		recoveredComments: map[int]bool{},
+		nextIssueNumber:   100,
+	}
+}
+
+func (f *fakeIssueClient) FindOpenIssue(name string) (int, bool, error) {
+	if f.findOpenIssueErr != nil {
+		return 0, false, f.findOpenIssueErr
+	}
+	num, ok := f.openIssues[name]
+	return num, ok, nil
+}
+
+func (f *fakeIssueClient) CreateIncidentIssue(name, command, output string, detectedAt time.Time) (int, error) {
+	if f.createIssueErr != nil {
+		return 0, f.createIssueErr
+	}
+	f.nextIssueNumber++
+	num := f.nextIssueNumber
+	f.openIssues[name] = num
+	f.created = append(f.created, createdIssue{name: name, command: command, output: output, detectedAt: detectedAt})
+	return num, nil
+}
+
+func (f *fakeIssueClient) HasRecoveredComment(number int) (bool, error) {
+	if f.hasRecoveredErr != nil {
+		return false, f.hasRecoveredErr
+	}
+	return f.recoveredComments[number], nil
+}
+
+func (f *fakeIssueClient) PostRecoveredComment(number int, recoveredAt time.Time) error {
+	if f.postRecoveredErr != nil {
+		return f.postRecoveredErr
+	}
+	f.recoveredComments[number] = true
+	f.postedRecovered = append(f.postedRecovered, number)
+	return nil
+}
+
+func TestReconcile_FailingCheck_NoExistingIssue_OpensIssue(t *testing.T) {
+	client := newFakeIssueClient()
+	checks := []Check{{Name: "api-health", Command: "curl -sf https://example.com/healthz"}}
+	results := []Result{{Name: "api-health", Ok: false, Output: "connection refused"}}
+	now := time.Date(2026, 7, 28, 12, 0, 0, 0, time.UTC)
+
+	summary, err := Reconcile(checks, results, client, now)
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if summary.IssuesOpened != 1 {
+		t.Fatalf("IssuesOpened = %d, want 1", summary.IssuesOpened)
+	}
+	if len(client.created) != 1 {
+		t.Fatalf("created issues = %d, want 1", len(client.created))
+	}
+	got := client.created[0]
+	if got.name != "api-health" || got.command != checks[0].Command || got.output != "connection refused" || !got.detectedAt.Equal(now) {
+		t.Errorf("created issue = %+v, want matching name/command/output/detectedAt", got)
+	}
+}
+
+func TestReconcile_FailingCheck_ExistingOpenIssue_NoDuplicate(t *testing.T) {
+	client := newFakeIssueClient()
+	client.openIssues["api-health"] = 42
+	checks := []Check{{Name: "api-health", Command: "curl -sf https://example.com/healthz"}}
+	results := []Result{{Name: "api-health", Ok: false, Output: "still down"}}
+
+	summary, err := Reconcile(checks, results, client, time.Now())
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if summary.IssuesOpened != 0 {
+		t.Errorf("IssuesOpened = %d, want 0 (should dedupe against existing open issue)", summary.IssuesOpened)
+	}
+	if len(client.created) != 0 {
+		t.Errorf("created issues = %d, want 0", len(client.created))
+	}
+	if len(client.postedRecovered) != 0 {
+		t.Errorf("postedRecovered = %v, want none (check is still failing)", client.postedRecovered)
+	}
+}
+
+func TestReconcile_RecoveredCheck_PostsOneTimeComment(t *testing.T) {
+	client := newFakeIssueClient()
+	client.openIssues["api-health"] = 42
+	checks := []Check{{Name: "api-health", Command: "curl -sf https://example.com/healthz"}}
+	results := []Result{{Name: "api-health", Ok: true, Output: "200 OK"}}
+	now := time.Date(2026, 7, 28, 13, 0, 0, 0, time.UTC)
+
+	summary, err := Reconcile(checks, results, client, now)
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if summary.RecoveredComments != 1 {
+		t.Fatalf("RecoveredComments = %d, want 1", summary.RecoveredComments)
+	}
+	if len(client.postedRecovered) != 1 || client.postedRecovered[0] != 42 {
+		t.Errorf("postedRecovered = %v, want [42]", client.postedRecovered)
+	}
+	// The issue itself must never be closed by Reconcile — fakeIssueClient
+	// has no Close method at all, so a compile-time guarantee already holds;
+	// this assertion documents the intent for a human reader.
+	if _, stillOpen := client.openIssues["api-health"]; !stillOpen {
+		t.Errorf("issue should remain open (no auto-close), openIssues = %v", client.openIssues)
+	}
+}
+
+func TestReconcile_RecoveredCheck_AlreadyCommented_DoesNotDuplicate(t *testing.T) {
+	client := newFakeIssueClient()
+	client.openIssues["api-health"] = 42
+	client.recoveredComments[42] = true
+	checks := []Check{{Name: "api-health", Command: "curl -sf https://example.com/healthz"}}
+	results := []Result{{Name: "api-health", Ok: true, Output: "200 OK"}}
+
+	summary, err := Reconcile(checks, results, client, time.Now())
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if summary.RecoveredComments != 0 {
+		t.Errorf("RecoveredComments = %d, want 0 (already posted)", summary.RecoveredComments)
+	}
+	if len(client.postedRecovered) != 0 {
+		t.Errorf("postedRecovered = %v, want none", client.postedRecovered)
+	}
+}
+
+func TestReconcile_PassingCheck_NoExistingIssue_NoOp(t *testing.T) {
+	client := newFakeIssueClient()
+	checks := []Check{{Name: "api-health", Command: "curl -sf https://example.com/healthz"}}
+	results := []Result{{Name: "api-health", Ok: true, Output: "200 OK"}}
+
+	summary, err := Reconcile(checks, results, client, time.Now())
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if summary.IssuesOpened != 0 || summary.RecoveredComments != 0 {
+		t.Errorf("summary = %+v, want no-op", summary)
+	}
+}
+
+func TestReconcile_MultipleChecks_Independent(t *testing.T) {
+	client := newFakeIssueClient()
+	client.openIssues["recovering-check"] = 7
+	checks := []Check{
+		{Name: "failing-check", Command: "false"},
+		{Name: "recovering-check", Command: "true"},
+		{Name: "passing-check", Command: "true"},
+	}
+	results := []Result{
+		{Name: "failing-check", Ok: false, Output: "boom"},
+		{Name: "recovering-check", Ok: true, Output: "ok now"},
+		{Name: "passing-check", Ok: true, Output: "ok"},
+	}
+
+	summary, err := Reconcile(checks, results, client, time.Now())
+	if err != nil {
+		t.Fatalf("Reconcile() error = %v", err)
+	}
+	if summary.IssuesOpened != 1 {
+		t.Errorf("IssuesOpened = %d, want 1", summary.IssuesOpened)
+	}
+	if summary.RecoveredComments != 1 {
+		t.Errorf("RecoveredComments = %d, want 1", summary.RecoveredComments)
+	}
+}
diff --git a/internal/mcp/req_test.go b/internal/mcp/req_test.go
index 771408f..48efb1e 100644
--- a/internal/mcp/req_test.go
+++ b/internal/mcp/req_test.go
@@ -275,7 +275,7 @@ func checkCreateWorktreeOutput(t *testing.T, _ *server.MCPServer) map[string]any
 	t.Chdir(repo)
 
 	srv := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(srv, &mockGithubClient{}, 0, t.TempDir(), "req002schema/gh-test", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4)
+	registerTools(srv, &mockGithubClient{}, 0, t.TempDir(), "req002schema/gh-test", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4, nil)
 
 	got := mustToolJSON(t, callTool(t, srv, "create_worktree", map[string]any{
 		"issue_number": float64(163),
diff --git a/internal/mcp/server.go b/internal/mcp/server.go
index 1400595..87abd9b 100644
--- a/internal/mcp/server.go
+++ b/internal/mcp/server.go
@@ -3,6 +3,7 @@ package mcp
 import (
 	"github.com/mark3labs/mcp-go/server"
 	gh "github.com/ytnobody/hermit/internal/github"
+	"github.com/ytnobody/hermit/internal/healthcheck"
 	"github.com/ytnobody/hermit/internal/readiness"
 	"github.com/ytnobody/hermit/internal/risk"
 )
@@ -43,9 +44,13 @@ type RequirementsConfig struct {
 // [agent].max_engineers value from harness.toml (REQ-011): the maximum
 // number of Engineers the Superintendent spawns in parallel per pass. It is
 // surfaced read-only via get_config so the Superintendent can reference the
-// configured value instead of a hardcoded number.
-func Serve(client *gh.Client, rateLimitThreshold int, rootDir string, branchPrefix string, loopInterval int, webhookURL string, webhookType string, repos []gh.RepoConfig, triggerComment string, readinessCfg readiness.Config, defaultRiskConfig risk.Config, repoRiskConfigs map[string]risk.Config, model ModelConfig, requirementsCfg RequirementsConfig, maxEngineers int) error {
+// configured value instead of a hardcoded number. healthChecks is the
+// resolved [[health_checks]] list from harness.toml used by the
+// run_health_checks MCP tool (Issue #190); an empty/nil slice means the
+// project has not configured any production health checks, in which case
+// run_health_checks is a no-op.
+func Serve(client *gh.Client, rateLimitThreshold int, rootDir string, branchPrefix string, loopInterval int, webhookURL string, webhookType string, repos []gh.RepoConfig, triggerComment string, readinessCfg readiness.Config, defaultRiskConfig risk.Config, repoRiskConfigs map[string]risk.Config, model ModelConfig, requirementsCfg RequirementsConfig, maxEngineers int, healthChecks []healthcheck.Check) error {
 	s := server.NewMCPServer("hermit", "1.0.0")
-	registerTools(s, client, rateLimitThreshold, rootDir, branchPrefix, loopInterval, webhookURL, webhookType, repos, triggerComment, readinessCfg, defaultRiskConfig, repoRiskConfigs, model, requirementsCfg, maxEngineers)
+	registerTools(s, client, rateLimitThreshold, rootDir, branchPrefix, loopInterval, webhookURL, webhookType, repos, triggerComment, readinessCfg, defaultRiskConfig, repoRiskConfigs, model, requirementsCfg, maxEngineers, healthChecks)
 	return server.ServeStdio(s)
 }
diff --git a/internal/mcp/tools.go b/internal/mcp/tools.go
index 3298f72..b3f30a0 100644
--- a/internal/mcp/tools.go
+++ b/internal/mcp/tools.go
@@ -12,6 +12,7 @@ import (
 	"github.com/ytnobody/hermit/internal/cihistory"
 	"github.com/ytnobody/hermit/internal/git"
 	gh "github.com/ytnobody/hermit/internal/github"
+	"github.com/ytnobody/hermit/internal/healthcheck"
 	"github.com/ytnobody/hermit/internal/lessons"
 	"github.com/ytnobody/hermit/internal/notification"
 	"github.com/ytnobody/hermit/internal/readiness"
@@ -54,6 +55,11 @@ type githubClient interface {
 	// requirements.NewGitHubIssueClient — see requirements.ghClient, which
 	// this interface must remain a superset of.
 	CreateIssue(title, body string) (int, error)
+	// AddLabel is used by the run_health_checks tool to label newly-opened
+	// production-incident issues via healthcheck.NewGitHubIssueClient — see
+	// healthcheck.ghClient, which this interface must remain a superset of
+	// (Issue #190).
+	AddLabel(number int, label string) error
 }
 
 // resolveRiskConfig returns the risk.Config to apply for the given owner/repo
@@ -71,7 +77,7 @@ func resolveRiskConfig(owner, repo string, defaultRiskConfig risk.Config, repoRi
 	return defaultRiskConfig
 }
 
-func registerTools(s *server.MCPServer, client githubClient, rateLimitThreshold int, rootDir string, branchPrefix string, loopInterval int, webhookURL string, webhookType string, repos []gh.RepoConfig, triggerComment string, readinessCfg readiness.Config, defaultRiskConfig risk.Config, repoRiskConfigs map[string]risk.Config, model ModelConfig, requirementsCfg RequirementsConfig, maxEngineers int) {
+func registerTools(s *server.MCPServer, client githubClient, rateLimitThreshold int, rootDir string, branchPrefix string, loopInterval int, webhookURL string, webhookType string, repos []gh.RepoConfig, triggerComment string, readinessCfg readiness.Config, defaultRiskConfig risk.Config, repoRiskConfigs map[string]risk.Config, model ModelConfig, requirementsCfg RequirementsConfig, maxEngineers int, healthChecks []healthcheck.Check) {
 	s.AddTool(
 		mcp.NewTool("get_default_branch",
 			mcp.WithDescription("リポジトリのデフォルトブランチ名を返す"),
@@ -554,7 +560,7 @@ func registerTools(s *server.MCPServer, client githubClient, rateLimitThreshold
 
 	s.AddTool(
 		mcp.NewTool("get_loop_state",
-			mcp.WithDescription("Returns the cadence-tracking timestamps persisted in .hermit/superintendent-state.json: pr_comments_since, issue_comments_since, and requirements_sweep_since (RFC3339, omitted if never recorded) — the 'since' values the Superintendent cycle uses to decide when it last checked PR comments, checked Issue comments, and ran the requirements sweep. Also reports last_success_tick and consecutive_failures, written by `hermit run`'s own tick loop. This file is owned by HERMIT's Go side: read/write the three cadence timestamps only via this tool and update_loop_state, never by hand-writing the JSON file."),
+			mcp.WithDescription("Returns the cadence-tracking timestamps persisted in .hermit/superintendent-state.json: pr_comments_since, issue_comments_since, requirements_sweep_since, and health_checks_since (RFC3339, omitted if never recorded) — the 'since' values the Superintendent cycle uses to decide when it last checked PR comments, checked Issue comments, ran the requirements sweep, and ran the health-check sweep. Also reports last_success_tick and consecutive_failures, written by `hermit run`'s own tick loop. This file is owned by HERMIT's Go side: read/write these cadence timestamps only via this tool and update_loop_state, never by hand-writing the JSON file."),
 		),
 		func(ctx context.Context, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 			st, err := state.Load(state.Path(rootDir))
@@ -568,10 +574,11 @@ func registerTools(s *server.MCPServer, client githubClient, rateLimitThreshold
 
 	s.AddTool(
 		mcp.NewTool("update_loop_state",
-			mcp.WithDescription("Updates one or more of the cadence-tracking timestamps in .hermit/superintendent-state.json: pr_comments_since, issue_comments_since, requirements_sweep_since, each an RFC3339 timestamp. Only the fields provided are changed; omitted fields are left as-is. Call the now tool first to get an authoritative current timestamp to pass in, then use this instead of writing the JSON file directly. Returns the full updated state."),
+			mcp.WithDescription("Updates one or more of the cadence-tracking timestamps in .hermit/superintendent-state.json: pr_comments_since, issue_comments_since, requirements_sweep_since, health_checks_since, each an RFC3339 timestamp. Only the fields provided are changed; omitted fields are left as-is. Call the now tool first to get an authoritative current timestamp to pass in, then use this instead of writing the JSON file directly. Returns the full updated state."),
 			mcp.WithString("pr_comments_since", mcp.Description("RFC3339 timestamp to record as the last PR-review-comment check time")),
 			mcp.WithString("issue_comments_since", mcp.Description("RFC3339 timestamp to record as the last Issue-comment check time")),
 			mcp.WithString("requirements_sweep_since", mcp.Description("RFC3339 timestamp to record as the last requirements-sweep time")),
+			mcp.WithString("health_checks_since", mcp.Description("RFC3339 timestamp to record as the last health-check sweep time")),
 		),
 		func(ctx context.Context, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 			statePath := state.Path(rootDir)
@@ -600,6 +607,13 @@ func registerTools(s *server.MCPServer, client githubClient, rateLimitThreshold
 				}
 				st.RequirementsSweepSince = &t
 			}
+			if v := req.GetString("health_checks_since", ""); v != "" {
+				t, err := time.Parse(time.RFC3339, v)
+				if err != nil {
+					return mcp.NewToolResultError(fmt.Sprintf("health_checks_since: %v", err)), nil
+				}
+				st.HealthChecksSince = &t
+			}
 			if err := state.Save(statePath, st); err != nil {
 				return mcp.NewToolResultError(err.Error()), nil
 			}
@@ -757,6 +771,36 @@ func registerTools(s *server.MCPServer, client githubClient, rateLimitThreshold
 			return mcp.NewToolResultText(string(b)), nil
 		},
 	)
+
+	s.AddTool(
+		mcp.NewTool("run_health_checks",
+			mcp.WithDescription("Runs the production health checks configured under [[health_checks]] in harness.toml (Issue #190): executes each check's command (30s timeout) and returns {name, ok, output} for each. For any failing check (ok:false) with no existing open GitHub issue (matched by an \"[health-check: <name>]\" title prefix), opens a new issue labeled production-incident containing the check name, command, output, and detection time — deduped so a check that is still failing does not open a second issue. For any check that has returned to passing (ok:true) while a matching open issue exists, posts a one-time \"recovered at <time>\" comment on that issue (never auto-closes it). No-ops when no health_checks are configured (returns an empty results list), so unconfigured projects see no change in behavior. The Superintendent loop should call this roughly every 5 minutes (tracking its own \"last health-check\" timestamp via health_checks_since, the same way it tracks requirements_sweep_since), not on every cycle."),
+		),
+		func(ctx context.Context, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+			if len(healthChecks) == 0 {
+				b, _ := json.Marshal(map[string]any{
+					"results":            []healthcheck.Result{},
+					"issues_opened":      0,
+					"recovered_comments": 0,
+				})
+				return mcp.NewToolResultText(string(b)), nil
+			}
+			results := healthcheck.RunChecks(healthChecks)
+			summary, err := healthcheck.Reconcile(healthChecks, results, healthcheck.NewGitHubIssueClient(client), time.Now())
+			if err != nil {
+				return mcp.NewToolResultError(err.Error()), nil
+			}
+			b, err := json.Marshal(map[string]any{
+				"results":            summary.Results,
+				"issues_opened":      summary.IssuesOpened,
+				"recovered_comments": summary.RecoveredComments,
+			})
+			if err != nil {
+				return mcp.NewToolResultError(err.Error()), nil
+			}
+			return mcp.NewToolResultText(string(b)), nil
+		},
+	)
 }
 
 // loopStateResponse converts a state.LoopState into the JSON-friendly shape
@@ -775,6 +819,7 @@ func loopStateResponse(st state.LoopState) map[string]any {
 	setIfNotNil("pr_comments_since", st.PRCommentsSince)
 	setIfNotNil("issue_comments_since", st.IssueCommentsSince)
 	setIfNotNil("requirements_sweep_since", st.RequirementsSweepSince)
+	setIfNotNil("health_checks_since", st.HealthChecksSince)
 	setIfNotNil("last_success_tick", st.LastSuccessTick)
 	return resp
 }
diff --git a/internal/mcp/tools_test.go b/internal/mcp/tools_test.go
index 28358e6..bf13238 100644
--- a/internal/mcp/tools_test.go
+++ b/internal/mcp/tools_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/mark3labs/mcp-go/server"
 	"github.com/ytnobody/hermit/internal/cihistory"
 	gh "github.com/ytnobody/hermit/internal/github"
+	"github.com/ytnobody/hermit/internal/healthcheck"
 	"github.com/ytnobody/hermit/internal/lessons"
 	"github.com/ytnobody/hermit/internal/readiness"
 	"github.com/ytnobody/hermit/internal/requirements"
@@ -120,8 +121,8 @@ func (m *mockGithubClient) GetPRStatusInRepo(_ int, _, _ string) (*gh.PRStatus,
 	return m.prStatus, m.prStatusErr
 }
 
-func (m *mockGithubClient) PostComment(_ int, _ string) error {
-	return nil
+func (m *mockGithubClient) PostComment(number int, body string) error {
+	return m.PostCommentInRepo(number, body, "", "")
 }
 
 func (m *mockGithubClient) PostCommentInRepo(number int, body, owner, repo string) error {
@@ -174,6 +175,10 @@ func (m *mockGithubClient) GetIssueCommentsInRepo(number int, _ string, _, _ str
 	return m.issueCommentsByNumber[number], nil
 }
 
+func (m *mockGithubClient) AddLabel(number int, label string) error {
+	return m.AddLabelInRepo(number, label, "", "")
+}
+
 func (m *mockGithubClient) AddLabelInRepo(number int, label, owner, repo string) error {
 	if m.addLabelErr != nil {
 		return m.addLabelErr
@@ -218,7 +223,7 @@ func newTestServerWithTrigger(t *testing.T, client githubClient, trigger string)
 func newTestServerWithReadiness(t *testing.T, client githubClient, trigger string, readinessCfg readiness.Config) *server.MCPServer {
 	t.Helper()
 	s := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, trigger, readinessCfg, risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4)
+	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, trigger, readinessCfg, risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4, nil)
 	return s
 }
 
@@ -228,14 +233,14 @@ func newTestServerWithReadiness(t *testing.T, client githubClient, trigger strin
 func newTestServerWithRisk(t *testing.T, client githubClient, defaultRiskConfig risk.Config, repoRiskConfigs map[string]risk.Config) *server.MCPServer {
 	t.Helper()
 	s := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), defaultRiskConfig, repoRiskConfigs, ModelConfig{}, RequirementsConfig{}, 4)
+	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), defaultRiskConfig, repoRiskConfigs, ModelConfig{}, RequirementsConfig{}, 4, nil)
 	return s
 }
 
 func newTestServerWithModel(t *testing.T, client githubClient, model ModelConfig) *server.MCPServer {
 	t.Helper()
 	s := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, model, RequirementsConfig{}, 4)
+	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, model, RequirementsConfig{}, 4, nil)
 	return s
 }
 
@@ -245,7 +250,7 @@ func newTestServerWithModel(t *testing.T, client githubClient, model ModelConfig
 func newTestServerWithMaxEngineers(t *testing.T, client githubClient, maxEngineers int) *server.MCPServer {
 	t.Helper()
 	s := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, maxEngineers)
+	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, maxEngineers, nil)
 	return s
 }
 
@@ -255,7 +260,7 @@ func newTestServerWithRoot(t *testing.T, client githubClient) (*server.MCPServer
 	t.Helper()
 	root := t.TempDir()
 	s := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(s, client, 0, root, "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4)
+	registerTools(s, client, 0, root, "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4, nil)
 	return s, root
 }
 
@@ -266,10 +271,19 @@ func newTestServerWithRequirements(t *testing.T, client githubClient, requiremen
 	t.Helper()
 	root := t.TempDir()
 	s := server.NewMCPServer("hermit-test", "0.0.0")
-	registerTools(s, client, 0, root, "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, requirementsCfg, 4)
+	registerTools(s, client, 0, root, "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, requirementsCfg, 4, nil)
 	return s, root
 }
 
+// newTestServerWithHealthChecks is like newTestServer but also wires a
+// []healthcheck.Check list for the run_health_checks MCP tool (Issue #190).
+func newTestServerWithHealthChecks(t *testing.T, client githubClient, checks []healthcheck.Check) *server.MCPServer {
+	t.Helper()
+	s := server.NewMCPServer("hermit-test", "0.0.0")
+	registerTools(s, client, 0, t.TempDir(), "hermit/issue-", 120, "", "", nil, "", readiness.DefaultConfig(), risk.DefaultConfig(), nil, ModelConfig{}, RequirementsConfig{}, 4, checks)
+	return s
+}
+
 func callTool(t *testing.T, s *server.MCPServer, name string, args map[string]any) *mcp.CallToolResult {
 	t.Helper()
 	st := s.GetTool(name)
@@ -1800,3 +1814,140 @@ func TestRunRequirementsSweep_NoTestCommand_SkipsWithReason(t *testing.T) {
 		t.Errorf("expected no issues to be opened when the sweep is skipped, got %v", mock.createdIssueTitles)
 	}
 }
+
+// --- run_health_checks (Issue #190) ---
+
+func TestRunHealthChecks_NoChecksConfigured_NoOp(t *testing.T) {
+	mock := &mockGithubClient{}
+	s := newTestServerWithHealthChecks(t, mock, nil)
+
+	got := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+
+	results, _ := got["results"].([]any)
+	if len(results) != 0 {
+		t.Errorf("expected empty results when no health_checks are configured, got %v", results)
+	}
+	if issuesOpened, _ := got["issues_opened"].(float64); issuesOpened != 0 {
+		t.Errorf("expected issues_opened=0, got %v", got["issues_opened"])
+	}
+	if len(mock.createdIssueTitles) != 0 {
+		t.Errorf("expected no issues created, got %v", mock.createdIssueTitles)
+	}
+}
+
+func TestRunHealthChecks_ReturnsNameOkOutputPerCheck(t *testing.T) {
+	mock := &mockGithubClient{}
+	checks := []healthcheck.Check{
+		{Name: "passing-check", Command: `echo "all good"; exit 0`},
+		{Name: "failing-check", Command: `echo "boom"; exit 1`},
+	}
+	s := newTestServerWithHealthChecks(t, mock, checks)
+
+	got := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+	results, _ := got["results"].([]any)
+	if len(results) != 2 {
+		t.Fatalf("expected 2 results, got %d: %v", len(results), results)
+	}
+	first, _ := results[0].(map[string]any)
+	if first["name"] != "passing-check" || first["ok"] != true {
+		t.Errorf("results[0] = %v, want name=passing-check ok=true", first)
+	}
+	if out, _ := first["output"].(string); !strings.Contains(out, "all good") {
+		t.Errorf("results[0].output = %q, want it to contain %q", out, "all good")
+	}
+	second, _ := results[1].(map[string]any)
+	if second["name"] != "failing-check" || second["ok"] != false {
+		t.Errorf("results[1] = %v, want name=failing-check ok=false", second)
+	}
+}
+
+func TestRunHealthChecks_FailingCheck_NoExistingIssue_OpensProductionIncidentIssue(t *testing.T) {
+	mock := &mockGithubClient{}
+	checks := []healthcheck.Check{{Name: "api-health", Command: `echo "connection refused"; exit 1`}}
+	s := newTestServerWithHealthChecks(t, mock, checks)
+
+	got := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+	if issuesOpened, _ := got["issues_opened"].(float64); issuesOpened != 1 {
+		t.Fatalf("expected issues_opened=1, got %v (full: %v)", got["issues_opened"], got)
+	}
+	if len(mock.createdIssueTitles) != 1 {
+		t.Fatalf("expected exactly one issue to be created, got %d: %v", len(mock.createdIssueTitles), mock.createdIssueTitles)
+	}
+	title := mock.createdIssueTitles[0]
+	if !strings.Contains(title, healthcheck.TitlePrefix("api-health")) {
+		t.Errorf("created issue title = %q, want it to contain %q", title, healthcheck.TitlePrefix("api-health"))
+	}
+	if len(mock.addedLabels) != 1 || mock.addedLabels[0].label != healthcheck.IncidentLabel {
+		t.Errorf("addedLabels = %v, want a single %q label", mock.addedLabels, healthcheck.IncidentLabel)
+	}
+}
+
+func TestRunHealthChecks_FailingCheck_ExistingOpenIssue_NoDuplicate(t *testing.T) {
+	mock := &mockGithubClient{
+		issues: []gh.Issue{
+			{Number: 5, Title: healthcheck.TitlePrefix("api-health") + " health check failing"},
+		},
+	}
+	checks := []healthcheck.Check{{Name: "api-health", Command: "exit 1"}}
+	s := newTestServerWithHealthChecks(t, mock, checks)
+
+	got := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+	if issuesOpened, _ := got["issues_opened"].(float64); issuesOpened != 0 {
+		t.Errorf("expected issues_opened=0 (should dedupe against existing open issue), got %v", got["issues_opened"])
+	}
+	if len(mock.createdIssueTitles) != 0 {
+		t.Errorf("expected no duplicate issue to be created, got %v", mock.createdIssueTitles)
+	}
+}
+
+func TestRunHealthChecks_RecoveredCheck_PostsOneTimeComment(t *testing.T) {
+	mock := &mockGithubClient{
+		issues: []gh.Issue{
+			{Number: 5, Title: healthcheck.TitlePrefix("api-health") + " health check failing"},
+		},
+	}
+	checks := []healthcheck.Check{{Name: "api-health", Command: "exit 0"}}
+	s := newTestServerWithHealthChecks(t, mock, checks)
+
+	got := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+	if recovered, _ := got["recovered_comments"].(float64); recovered != 1 {
+		t.Fatalf("expected recovered_comments=1, got %v (full: %v)", got["recovered_comments"], got)
+	}
+	if len(mock.postedComments) != 1 || mock.postedComments[0].number != 5 {
+		t.Fatalf("expected one recovered comment posted on issue #5, got %+v", mock.postedComments)
+	}
+	if !strings.Contains(mock.postedComments[0].body, healthcheck.RecoveredTrigger) {
+		t.Errorf("recovered comment body = %q, want it to contain %q", mock.postedComments[0].body, healthcheck.RecoveredTrigger)
+	}
+
+	// The issue itself must never be closed by run_health_checks — verify no
+	// close-issue side channel was exercised by re-running with the same
+	// mock state (still "open" from the test's perspective) and confirming
+	// the comment is now suppressed as already-posted, not re-created via
+	// some auto-close/reopen path.
+	mock.commentMatchByIssue = map[int]bool{5: true}
+	got2 := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+	if recovered, _ := got2["recovered_comments"].(float64); recovered != 0 {
+		t.Errorf("expected recovered_comments=0 on second call (already posted), got %v", got2["recovered_comments"])
+	}
+	if len(mock.postedComments) != 1 {
+		t.Errorf("expected no additional recovered comment posted, got %+v", mock.postedComments)
+	}
+}
+
+func TestRunHealthChecks_PassingCheck_NoExistingIssue_NoOp(t *testing.T) {
+	mock := &mockGithubClient{}
+	checks := []healthcheck.Check{{Name: "api-health", Command: "exit 0"}}
+	s := newTestServerWithHealthChecks(t, mock, checks)
+
+	got := mustToolJSON(t, callTool(t, s, "run_health_checks", map[string]any{}))
+	if issuesOpened, _ := got["issues_opened"].(float64); issuesOpened != 0 {
+		t.Errorf("expected issues_opened=0, got %v", got["issues_opened"])
+	}
+	if recovered, _ := got["recovered_comments"].(float64); recovered != 0 {
+		t.Errorf("expected recovered_comments=0 (no issue to comment on), got %v", got["recovered_comments"])
+	}
+	if len(mock.createdIssueTitles) != 0 || len(mock.postedComments) != 0 {
+		t.Errorf("expected no side effects, got created=%v posted=%v", mock.createdIssueTitles, mock.postedComments)
+	}
+}
diff --git a/internal/state/state.go b/internal/state/state.go
index 595d55a..e532086 100644
--- a/internal/state/state.go
+++ b/internal/state/state.go
@@ -8,9 +8,9 @@
 //     each pass.
 //   - The get_loop_state / update_loop_state MCP tools (internal/mcp),
 //     called from inside a Superintendent pass, own
-//     PRCommentsSince / IssueCommentsSince / RequirementsSweepSince — the
-//     three "since" timestamps the Superintendent cycle previously had to
-//     hand-write into the file itself.
+//     PRCommentsSince / IssueCommentsSince / RequirementsSweepSince /
+//     HealthChecksSince — the "since" timestamps the Superintendent cycle
+//     previously had to hand-write into the file itself.
 //
 // Either writer only ever does a load-modify-save round trip, and the two
 // never run concurrently by construction: `hermit run` blocks on the
@@ -56,6 +56,9 @@ type LoopState struct {
 	// RequirementsSweepSince is the last time run_requirements_sweep ran, set
 	// via update_loop_state.
 	RequirementsSweepSince *time.Time `json:"requirements_sweep_since,omitempty"`
+	// HealthChecksSince is the last time run_health_checks ran, set via
+	// update_loop_state (Issue #190).
+	HealthChecksSince *time.Time `json:"health_checks_since,omitempty"`
 	// LastSuccessTick is the wall-clock time of the most recent
 	// `hermit run` pass that completed without error. Written directly by
 	// internal/runloop, not via an MCP tool.
diff --git a/internal/state/state_test.go b/internal/state/state_test.go
index ff9df4f..f21d9d0 100644
--- a/internal/state/state_test.go
+++ b/internal/state/state_test.go
@@ -13,7 +13,7 @@ func TestLoadMissingFileReturnsZeroValue(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Load: unexpected error: %v", err)
 	}
-	if st.PRCommentsSince != nil || st.IssueCommentsSince != nil || st.RequirementsSweepSince != nil {
+	if st.PRCommentsSince != nil || st.IssueCommentsSince != nil || st.RequirementsSweepSince != nil || st.HealthChecksSince != nil {
 		t.Fatalf("Load on missing file: want zero-value LoopState, got %+v", st)
 	}
 	if st.ConsecutiveFailures != 0 {
@@ -30,6 +30,7 @@ func TestSaveThenLoadRoundTrips(t *testing.T) {
 		PRCommentsSince:        &now,
 		IssueCommentsSince:     &now,
 		RequirementsSweepSince: &now,
+		HealthChecksSince:      &now,
 		LastSuccessTick:        &now,
 		ConsecutiveFailures:    2,
 	}
@@ -50,6 +51,9 @@ func TestSaveThenLoadRoundTrips(t *testing.T) {
 	if got.RequirementsSweepSince == nil || !got.RequirementsSweepSince.Equal(now) {
 		t.Errorf("RequirementsSweepSince = %v, want %v", got.RequirementsSweepSince, now)
 	}
+	if got.HealthChecksSince == nil || !got.HealthChecksSince.Equal(now) {
+		t.Errorf("HealthChecksSince = %v, want %v", got.HealthChecksSince, now)
+	}
 	if got.LastSuccessTick == nil || !got.LastSuccessTick.Equal(now) {
 		t.Errorf("LastSuccessTick = %v, want %v", got.LastSuccessTick, now)
 	}