# Example — Full-stack feature

## User input

```
/agent-goal-skill add a "share via email" button to the dashboard reports. needs backend mail send + frontend modal. test it.
```

## Shaped output

````
```
/goal

# Goal
Ship a "Share via email" feature: dashboard report card gains a button that opens a modal to send the report by email, with backend SMTP send and frontend integration tests.

# Context
- Repo: <TODO: user fills in path>
- Affected layers: frontend (dashboard report card + modal component), backend (POST /api/reports/{id}/share/email), mail service (existing? confirm)
- Existing mail integration: <TODO: confirm Resend, SES, SMTP — affects test mocking strategy>
- Auth: assume existing session middleware applies to /api/reports/* — verify
- Branch: feat/share-via-email (create if not present)

# Constraints
- Do NOT add a new mail provider — reuse whatever the project already has
- Modal must be dismissible (Esc, outside click, X button) — accessibility
- Server route MUST validate the requester has read access to the report — no IDOR
- Rate-limit: 5 sends per user per minute (use existing rate-limit middleware if present)
- Don't ship without tests at both layers

# Done when
1. New backend route exists and integration test passes (auth + IDOR + happy path)
2. Frontend modal renders, sends, shows success/error toast
3. Component test exists for the modal (open, submit, dismiss flows)
4. `npm typecheck && npm test && npm run lint` all exit 0
5. Commit message format `feat(reports): share-via-email`

# On block
FAIL FAST. If the project doesn't have an existing mail integration to reuse, stop and ask. Don't pick a new provider unilaterally. Append the question to ~/.pending.md.

Token budget: 2M
```

**Sandbox:** `workspace-write`
**Reasoning effort:** `medium`
**Caveats:** Mail provider TODO is load-bearing — confirm before dispatching, otherwise the agent may invent.
````

## What the shaper did

- Decomposed "share via email" into three verifiable layers (backend route, frontend modal, tests)
- Added IDOR safety constraint (anti-vision)
- Sized token budget to medium scope (2M)
- Flagged the mail-provider TODO as load-bearing in Caveats
- Reused existing patterns rule (no new mail provider)