fix(api): Refuse plus-tag emails for starter credits

[mmabrouk]

Context

A person can sign up as jane+1@gmail.com, jane+2@gmail.com, and so on. Each account gets its own starter-credit grant. Those addresses are one inbox.

Changes

_mint_policy_allows now refuses any local part that contains +, except @agenta.ai (case-insensitive). The allowlist also skips the work-domain digit rule, so name+1@agenta.ai works for internal testers.

Signup still succeeds. No key is minted. A warning logs rule=plus_local_part and the domain only.

The check is hardcoded. It is not a PostHog field, so the live payload does not have to change.

Before: jane+1@gmail.com gets a grant.

After: jane+1@gmail.com does not. jane@gmail.com still does. jane+1@agenta.ai still does.

Tests / notes

• 72 starter-credits-bridge unit tests passed, including the new plus-tag cases.
• ruff format + check clean on the touched files.
• Stacked on credits-starter-seeding ([feat] Seed starter credits at signup via budget-capped proxy keys (EE) #6138). Base is that branch, not release/v0.114.0.
• Design: docs(api): Document plus-tag starter-credit eligibility #6256.

How to review

Read the new constant in types.py, then the two checks in _mint_policy_allows, then TestMintPolicyAllows / TestRefusalLogging.

[mmabrouk]

🤖 The AI agent says:

Ready for review. This is the homemade plus-tag ban from #6256, with the @agenta.ai exception you asked for. Disposable-email libraries are not in this PR.

Please check:

• jane+1@gmail.com is refused, jane@gmail.com is allowed, jane+1@agenta.ai is allowed
• Signup still succeeds when the grant is skipped
• No PostHog payload change is required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Error		Aug 24, 2026 3:15pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• release/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 978f1529-af46-4d80-aa66-0d6bb2b966bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mmabrouk]

🤖 The AI agent says:

Stripped recommended_for_new_agents=True from this PR. It was a leaked hunk from another lane, not part of the plus-tag rule. On this stack that field does not exist, so it would have crashed every seed.

Current head 51619b96b3. The diff against credits-starter-seeding is only the plus-tag allowlist, the two eligibility checks, and the plus-tag tests.