docs(api): Document plus-tag starter-credit eligibility

[mmabrouk]

Context

A person can sign up as jane+1@gmail.com, jane+2@gmail.com, and so on, and each account gets its own starter-credit grant. Those addresses are one inbox. The digit rule does not catch this, because it only applies to work domains and because plus tags are letters, not digits.

This PR is the design for closing that hole. No code yet.

Changes

The eligibility section in docs/design/starter-credits-bridge/design.md now states the plus-tag rule, what a refused signup sees, and the mailbox tricks this rule does not catch.

Before: jane+1@gmail.com and jane+2@gmail.com both qualify.

After (once implemented): any local part that contains + is refused, except @agenta.ai. Signup still succeeds. The person just does not get the free Agenta connection. The check is hardcoded, like the free-mail list, so the PostHog payload does not have to change.

anti-abuse-research.md is the survey of libraries and services that can own the rest (disposable domains, Gmail-dot twins, hosted fraud products). Shortlist: disposable-email-domains + email-normalize locally, UserCheck if we want a vendor, Trueguard or Cloudflare AAP only after email-string tricks stop being the problem.

Tests / notes

Docs only. Implementation waits on approval of two decisions, posted on this PR.

How to review: read the new eligibility subsections in design.md first, then the shortlist at the bottom of anti-abuse-research.md.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Blocked		Aug 24, 2026 2:03pm

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mmabrouk]

🤖 The AI agent says:

This is the design-only PR for the plus-tag eligibility rule. Please decide these two things so implementation can follow.

🔸 Decision needed: where does the plus rule live?

• A (recommended). Hardcode it, like the free-mail list. Exception: @agenta.ai. No PostHog payload change. A required new MintPolicy field would stop every mint until the flag was edited.
• B. Add block_plus_aliases to the PostHog payload. Matches block_digit_locals. Needs a payload edit to turn on. The uncommitted WIP already in this workspace is this shape, defaulted off, and it has no @agenta.ai exception. Do not land that as-is.

🔸 Decision needed: ship the homemade plus ban now, or wait for a library?

• A (recommended). Ship the plus check first. One function, closes the farm we can see today, sends no email to a vendor.
• B. Skip the homemade rule and go straight to disposable-email-domains + email-normalize. Closes plus tags and Gmail-dot twins and Mailinator. Two small MIT/CC0/BSD packages. Still no vendor.
• C. Call UserCheck (domain endpoint) instead. They own disposable + freemail + canonical form. Domain-only call does not send the local part.

Research shortlist is in anti-abuse-research.md. I would do A now, then B as the follow-up, and only spike C if B is not enough.

Comment lgtm / implement it plus your A/B/C picks and I will implement on a follow-up lane against release/v0.114.0.

[mmabrouk]

🤖 The AI agent says:

Implementation is in #6258. Hardcoded plus-tag ban, except @agenta.ai. Digit rule is also skipped on that domain so name+1@agenta.ai works. No disposable-email libraries.