Record plugin hook sandbox limitations in marketplace docs

[greatest0fallt1me]

Summary

executeHook in src/services/pluginRegistry.ts is explicitly a stub that performs no code execution, yet the install route reports sandboxed: true and README does not mention plugins at all.

Why this matters

Plugin authors may believe their before_charge hooks run and enforce business rules when nothing executes.

Scope

Add a marketplace plugins section to README (or docs/) describing the manifest schema, lifecycle endpoints, that hooks are currently no-ops, and the intended sandbox design.

Relevant code in CalloraOrg/Callora-Backend:

• README.md
• src/services/pluginRegistry.ts
• src/routes/marketplace/plugins.ts

Priority

Low

Acceptance criteria

• Manifest fields are documented from pluginManifestSchema
• The no-op nature of hooks is explicit
• Endpoints and required auth are listed
• The sandboxed flag meaning is clarified

Validation

Review against npm test -- src/routes/marketplace/plugins.test.ts.

Non-goals

• Typo-only, formatting-only, or cosmetic changes.
• Unrelated refactors, dependency upgrades, or broad rewrites.
• Removing safeguards or weakening validation to make tests pass.

Contributor application

Before coding, describe the affected modules, proposed state/invariant changes, test strategy, compatibility considerations, and an estimate. Wait for assignment before starting implementation.

PR requirements

Use a feature branch and include Closes #<issue-number>. Address every criterion, map criteria to code and tests, explain security and failure-mode handling, and ensure CI passes.

Quality review

A maintainer will assess correctness, completeness, test depth, compatibility, observability, and adverse-case handling. A substantive implementation is required; merge or CI status alone does not guarantee reward eligibility.

---

Generated by Claude Code

[shobhamerabacha-star]

Hello team,

I would like to resolve this issue. Here is my proposed execution plan:

• Implementation: Implement robust automated tests covering Add focused test coverage for src/routes/index.ts with clean isolation and assertion checks.
• Testing: Verify all test cases pass locally and in the GitHub Actions CI workflow.

Happy to pick this up today—please assign to me!

[onyekachi66]

@onyekachi66 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

I would like to work on this issue having worked on similar issues in the past. Please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @onyekachi66 to this issue.

[drips-wave]

Congratulations, @onyekachi66! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.

🧑‍💻 @onyekachi66: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊