feat(languages): ship the missing python and typescript hooks

The python and typescript bundles carried rules and a coverage script but no pre-commit hook, so any project installing one got no credential scan on commit. Both now ship all four components the README documents: the shared secret scan, a validate-on-edit hook, settings wiring, and a seed CLAUDE.md. Verified against a real repo: a commit carrying an AWS key is refused.

install-lang now warns when a bundle is missing a documented component. That's the half that keeps this from recurring. Whoever adds the sixth bundle will forget something too, and today the installer prints success either way.

Two things fell out of the build. node --check is unusable on TypeScript: it ignores --experimental-strip-types, so it rejects valid TS and accepts broken TS. The hook uses tsc filtered to syntactic diagnostics instead. And completing the bundles means every pair now collides on settings.json and pre-commit, so no two compose without FORCE=1. The earlier "bundles already compose" reading rested on these two being incomplete. Filed for a real decision; clock-panel is the project that wants it.

Also stamps :LAST_REVIEWED: at task creation, with a lint checker to catch misses. Writing a task is reviewing it, so leaving the stamp off pushed every fresh task to the top of the next review batch to be re-derived by someone with less context than its author had. Tonight's sweep sent the staleness count from 13 to 22 while the list got more accurate.

2 files changed, 89 insertions, 0 deletions

diff --git a/claude-templates/.ai/scripts/lint-org.el b/claude-templates/.ai/scripts/lint-org.el
index 47e8bf1..1bd4582 100644
--- a/claude-templates/.ai/scripts/lint-org.el
+++ b/claude-templates/.ai/scripts/lint-org.el
@@ -38,6 +38,7 @@
 ;;   empty-heading                     bare stars with no title
 ;;   malformed-priority-cookie         [#x]-shaped token org rejected
 ;;   level2-done-without-closed        completed level-2 task with no CLOSED
+;;   task-missing-last-reviewed        open level-2 task with no :LAST_REVIEWED:
 ;;   subtask-done-not-dated            level-3+ done sub-task still a DONE keyword
 ;;   dated-log-heading-active-timestamp  dated-log heading with a live SCHEDULED/DEADLINE
 ;;   (anything else)                   surfaced as judgment with checker name
@@ -526,6 +527,42 @@ the live file on the next `task-sorted'."
                "level-2 DONE/CANCELLED has no CLOSED date — add CLOSED: [YYYY-MM-DD Day]; task-sorted's aging step archives an undated completed task immediately"))))))))
 
 ;;; ---------------------------------------------------------------------------
+;;; task-missing-last-reviewed check (claude-rules/todo-format.md)
+;;
+;; A task is stamped `:LAST_REVIEWED:' when it is *created*, not a review cycle
+;; later.  An agent filing a task has just written its body and graded its
+;; priority, which is a review by any honest reading — so a fresh task that
+;; carries no stamp reads as "never reviewed" and lands at the top of the next
+;; staleness batch, where re-reviewing it is pure ceremony.  Every task filed
+;; during the 2026-07-23 sweep hit exactly that, which is what prompted the rule.
+;;
+;; Judgment-only, deliberately.  The stamp's whole value is that its date is
+;; true, and nothing here can know when an unstamped task was actually last
+;; looked at.  Auto-stamping today's date would convert a "nobody has reviewed
+;; this" signal into a false "reviewed today" one — worse than the gap it
+;; closes.  Flag it; a human or the filing workflow supplies the honest date.
+;;
+;; Scope matches `task-review-staleness.sh' exactly (level-2, open keyword,
+;; priority cookie), so the checker and the staleness count never disagree
+;; about which headings are in the review pool.
+
+(defun lo--check-task-missing-last-reviewed ()
+  "Flag an open level-2 task with a priority cookie and no `:LAST_REVIEWED:'."
+  (save-excursion
+    (goto-char (point-min))
+    (let ((case-fold-search nil))
+      (while (re-search-forward "^\\*\\* \\(TODO\\|DOING\\|VERIFY\\) \\[#[A-D]\\]" nil t)
+        (let ((hline (line-number-at-pos))
+              (entry-end (save-excursion (outline-next-heading) (point))))
+          (save-excursion
+            (forward-line 1)
+            (unless (re-search-forward "^[ \t]*:LAST_REVIEWED:[ \t]*[[0-9]"
+                                       entry-end t)
+              (lo--emit-judgment
+               'task-missing-last-reviewed hline
+               "task has no :LAST_REVIEWED: — stamp it at creation with today's date (a task you just wrote and graded is reviewed); otherwise it enters the next staleness batch as never-reviewed"))))))))
+
+;;; ---------------------------------------------------------------------------
 ;;; level-3+ dated-header check (claude-rules/todo-format.md)
 ;;
 ;; The inverse of the level-2 check above.  A completed sub-task — a heading at
@@ -627,6 +664,7 @@ left unmodified and mechanical entries are recorded with :preview t."
           (lo--check-empty-headings)
           (lo--check-malformed-priority-cookies)
           (lo--check-level2-done-without-closed)
+          (lo--check-task-missing-last-reviewed)
           (lo--check-subtask-done-not-dated)
           (lo--check-dated-log-active-timestamp)
           (when (and (not lo-check-only) (buffer-modified-p))
diff --git a/claude-templates/.ai/scripts/tests/test-lint-org.el b/claude-templates/.ai/scripts/tests/test-lint-org.el
index 30a79bd..9a72bef 100644
--- a/claude-templates/.ai/scripts/tests/test-lint-org.el
+++ b/claude-templates/.ai/scripts/tests/test-lint-org.el
@@ -859,3 +859,54 @@ heading, so it is not flagged — only two-or-more indented stars are."
 
 (provide 'test-lint-org)
 ;;; test-lint-org.el ends here
+
+;;; ---------------------------------------------------------------------------
+;;; task-missing-last-reviewed (claude-rules/todo-format.md)
+
+(ert-deftest lo-task-without-last-reviewed-is-judgment ()
+  "An open level-2 task with no :LAST_REVIEWED: is flagged."
+  (let* ((out (lo-test--run "* Open Work\n** TODO [#B] A task :feature:\nBody.\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-task-with-last-reviewed-is-clean ()
+  "A task carrying the property is not flagged."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] A task :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: 2026-07-23\n:END:\n"
+                                    "Body.\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-task-last-reviewed-accepts-org-timestamp ()
+  "The org-native [YYYY-MM-DD Day] form counts, matching the staleness script."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] A task :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: [2026-07-23 Thu]\n:END:\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-done-task-without-last-reviewed-is-clean ()
+  "Completed tasks leave the review pool, so they are never flagged."
+  (let* ((out (lo-test--run (concat "* Open Work\n** DONE [#B] A task :feature:\n"
+                                    "CLOSED: [2026-07-23 Thu]\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-subtask-without-last-reviewed-is-clean ()
+  "Only level-2 tasks are in the review pool; deeper headings are not."
+  (let* ((out (lo-test--run (concat "* Open Work\n** TODO [#B] Parent :feature:\n"
+                                    ":PROPERTIES:\n:LAST_REVIEWED: 2026-07-23\n:END:\n"
+                                    "*** TODO A sub-task\n")))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-cookieless-task-without-last-reviewed-is-clean ()
+  "The staleness script selects on a priority cookie, so match that scope."
+  (let* ((out (lo-test--run "* Open Work\n** TODO Manual testing and validation\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should-not (memq 'task-missing-last-reviewed (lo-test--checkers js)))))
+
+(ert-deftest lo-verify-task-without-last-reviewed-is-judgment ()
+  "VERIFY is in the review pool too."
+  (let* ((out (lo-test--run "* Open Work\n** VERIFY [#B] Waiting on Craig\n"))
+         (js (lo-test--judgments (plist-get out :issues))))
+    (should (memq 'task-missing-last-reviewed (lo-test--checkers js)))))