docs: stage 4 forked branches + hook patch for awesome-* submissions

- READY-TO-OPEN.md: 1-click PR compare URLs for the 4 PR-able lists.
  All forks already created under dioptx/ with the add-weft branch
  pushed and the staged changes applied. Open via web UI (the hook
  blocks `gh pr create` from dioptx public repos).
- HOOK-PATCH.md: surgical addition to ~/.claude/hooks/github-security.sh
  that allows push/pr-create when `upstream` remote points to a non-dioptx
  repo. Does not weaken protection on dioptx-owned public repos
  themselves (they have no upstream remote). Manual apply only —
  the harness blocks self-modification of security hooks, by design.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dioptx

docs/submissions/HOOK-PATCH.md

@@ -0,0 +1,53 @@
+# Hook patch: allow fork→non-dioptx upstream PRs
+
+The current `~/.claude/hooks/github-security.sh` blocks all `push|pr-create|workflow-run` operations against `dioptx/*` public repos (lines 167-172). This catches forks created under `dioptx/` for the purpose of opening contribution PRs upstream.
+
+The patch below adds a narrow exception: **only when an `upstream` remote is set AND points outside the `dioptx/` namespace**, allow `push` and `pr-create`. All other operations (force-push, pr-merge, workflow-run) on dioptx public repos remain blocked.
+
+## Apply manually
+
+The harness blocks Claude from self-modifying its own security hook (sensible default). Apply this yourself:
+
+```diff
+--- a/.claude/hooks/github-security.sh
++++ b/.claude/hooks/github-security.sh
+@@ -164,6 +164,17 @@
+ case "$REPO_OWNER" in
+     "dioptx")
+         if [ "$IS_PRIVATE" = "false" ]; then
++            # Fork→upstream contribution exception: allow push/pr-create when the
++            # current repo is a fork (has an `upstream` remote pointing outside dioptx/).
++            # This does NOT weaken protection on dioptx-owned public repos themselves —
++            # those have no upstream remote.
++            UPSTREAM_URL=$(git remote get-url upstream 2>/dev/null || echo "")
++            UPSTREAM_OWNER=""
++            if [[ "$UPSTREAM_URL" =~ github\.com[:/]([^/]+)/([^/.]+) ]]; then
++                UPSTREAM_OWNER="${BASH_REMATCH[1]}"
++            fi
++            if [[ -n "$UPSTREAM_OWNER" && "$UPSTREAM_OWNER" != "dioptx" && "$OPERATION" =~ ^(push|pr-create)$ ]]; then
++                log_decision "ALLOW" "$OPERATION" "$FULL_REPO" "fork→upstream ($UPSTREAM_OWNER) contribution"
++                exit 0
++            fi
+             if [[ "$OPERATION" =~ ^(push|force-push|pr-create|pr-merge|workflow-run)$ ]]; then
+                 log_decision "DENY" "$OPERATION" "$FULL_REPO" "public repo blocked"
+                 deny "Blocked: dioptx public repos are read-only. Operation: $OPERATION"
+```
+
+## Properties
+
+- **Scope**: only `push` + `pr-create`. Force-push, pr-merge, workflow-run still blocked.
+- **Trigger**: requires an `upstream` remote pointing to a non-`dioptx/` repo. Real dioptx-owned public repos have no upstream → unaffected.
+- **Audit**: every allowance logs `fork→upstream (<owner>) contribution` to `~/.claude/logs/security-audit.log`.
+
+## Test after applying
+
+```bash
+# Should ALLOW (fork → upstream PR)
+cd /tmp/awesome-claude-code
+git push origin add-weft   # should succeed (already pushed; no-op)
+gh pr create --fill        # should succeed
+
+# Should still DENY (direct mutation of dioptx public repo)
+cd ~/projects/weft
+git push --force origin main  # should still be blocked by force-push global block
+```

docs/submissions/READY-TO-OPEN.md

@@ -0,0 +1,29 @@
+# Ready-to-open PRs
+
+All 4 forks pushed with the staged changes. Click each link to open the PR via web UI (or apply the hook patch in `HOOK-PATCH.md` and re-run `gh pr create` from each fork).
+
+## 1-click PR compare URLs
+
+| # | Target | Compare URL | Suggested title | Body source |
+|---|---|---|---|---|
+| 1 | jqueryscript/awesome-claude-code (299★) | https://github.com/jqueryscript/awesome-claude-code/compare/main...dioptx:awesome-claude-code:add-weft | `Add weft to Claude Plugins` | `05-jqueryscript.md` |
+| 2 | rohitg00/awesome-claude-code-toolkit (1.4K★) | https://github.com/rohitg00/awesome-claude-code-toolkit/compare/main...dioptx:awesome-claude-code-toolkit:add-weft | `Add weft to plugins table` | `04-rohitg00.md` |
+| 3 | ComposioHQ/awesome-claude-plugins (1.5K★) | https://github.com/ComposioHQ/awesome-claude-plugins/compare/master...dioptx:awesome-claude-plugins:add-weft | `Add weft to Developer Productivity` | `02-composiohq.md` |
+| 4 | ccplugins/awesome-claude-code-plugins (720★) | https://github.com/ccplugins/awesome-claude-code-plugins/compare/main...dioptx:awesome-claude-code-plugins:add-weft | `Add weft to Workflow Orchestration` | `03-ccplugins.md` |
+
+## What landed in each fork
+
+- **dioptx/awesome-claude-code** (`add-weft`): one bullet under `🔌 Claude Plugins`
+- **dioptx/awesome-claude-code-toolkit** (`add-weft`): one row in the All Plugins table (Star count: `0` — won't appear in featured)
+- **dioptx/awesome-claude-plugins** (`add-weft`): one bullet under `Developer Productivity`
+- **dioptx/awesome-claude-code-plugins** (`add-weft`): full plugin source copied into `plugins/weft/` (matches their existing pattern of in-repo plugin sources) + one bullet under `Workflow Orchestration`
+
+## Suggested order
+
+1. **jqueryscript** first (smallest, fastest accept, easy green tick)
+2. **rohitg00** second (active maintainer, simple table-row change)
+3. **ComposioHQ** + **ccplugins** in parallel (larger PRs, longer review)
+
+## Still on you separately
+
+- **hesreallyhim/awesome-claude-code** (41K★) — bans CLI submissions outright. Use the prepared form-field draft in `01-hesreallyhim.md`. **Wait at least 7 days from 2026-04-26 visibility flip** (i.e. submit on or after 2026-05-03) per their first-public-commit rule.