1# Delivery Options
2 
3After the Plan Card is approved (Step 5) and the output format is chosen (Step 6), the workflow has a generated artifact. **Before printing it into the chat**, ask one more question — where should it go?
4 
5| Mode | When the user wants this | File |
6|---|---|---|
7| **A. Print in chat** | Quick one-off, copy-paste, just learning | [print.md](print.md) |
8| **B. Save to local folder** | Wants files on disk, will commit/run later | [save-local.md](save-local.md) |
9| **C. Sync to a GitHub repo** | Has an infra repo, wants the change as a PR | [github-pr.md](github-pr.md) |
10 
11> **Skip the question for Adapter 4 (Apply via MCP).** Delivery is moot — the resources get created in Azure directly.
12 
13## Asking
14 
15> *"Where should I drop this {format} artifact?"*
16> *1. Print in the chat (default for quick / one-off)*
17> *2. Save to a local folder — I'll suggest a path based on your current workspace*
18> *3. Sync to a GitHub repo as a new branch + PR*
19 
20If the user already implied a target ("save it to my infra repo" / "open a PR" / "just print it"), skip the question and use that mode.
21 
22## Re-emitting / changing delivery mid-flow
23 
24After delivery, the Plan Card is cached. The user can say:
25 
26| User says | Action |
27|---|---|
28| "also save it locally" | Re-run Mode B with the same artifact |
29| "open a PR instead" | Re-run Mode C |
30| "give me terraform now too" | Re-render that adapter, then re-ask delivery |
31| "delete that file you wrote" | `rm` the path that was written |
32 
33Never re-ask Plan Card questions when only the delivery target is changing.
34 
35## Safety checks (B and C)
36 
37| Check | Why |
38|---|---|
39| Don't overwrite without showing the diff and getting explicit yes | User may have manual edits |
40| Scrub `adminPassword` from generated files → replace with `${VM_ADMIN_PASSWORD}` env var | Repos leak passwords |
41| Never push directly to `main` / `master` / default branch — feature branch + PR only | Auditability and review |
42| Never `git push --force` (use `--force-with-lease` if a rewrite is truly needed) | Catastrophic on shared branches |
43| Emit a parameter placeholder for SSH keys, not the literal key contents | Keys committed to git stay there forever |
44| If the repo has `CODEOWNERS` for the path, mention who'll be auto-tagged | User shouldn't be surprised by review routing |
45