1# Plan Card
2 
3The Plan Card is the single source of truth for the create-flow. It renders **every decision** — explicit user answers and silent defaults — as a markdown table the user can read top-to-bottom and either approve or edit.
4 
5## Rendering rules
6 
71. **Cost + quota on the top half.** The user must see both without scrolling.
82. **Source column is mandatory.** Each row says where the value came from: `user`, `default`, `inferred`, or the MCP tool that produced it.
93. **Flag risky defaults with ⚠.** Open NSG to `*`, public IP exposed, no managed identity, password auth on Windows — all get a marker so the user can edit.
104. **No invisible state.** If you defaulted it, it goes in the card.
115. **Re-emit on every change.** When the user edits a row, render the full card again — diffs in chat are easy to miss.
12 
13## Schema
14 
15| Column | Required? | Notes |
16|---|---|---|
17| Setting | yes | Human-readable label (`Region`, `Size`, `OS disk`) |
18| Value | yes | The concrete value, in backticks if it's a literal |
19| Source | yes | `user` / `default` / `inferred` / `<tool name>` |
20 
21## Example — Linux dev VM in eastus
22 
23```markdown
24| Setting | Value | Source |
25|---|---|---|
26| Hosting model | Single VM | user |
27| Name | `dev-vm-01` | default (`<purpose>-vm-<nn>`) |
28| Region | `eastus` | user |
29| Resource group | `dev-vm-01-rg` (new) | default |
30| Image | `Ubuntu2404` | user |
31| Size | `Standard_D2s_v5` (2 vCPU / 8 GB) | default |
32| Auth | SSH key from `~/.ssh/id_rsa.pub` | inferred |
33| VNet | new `dev-vm-01-vnet` (`10.0.0.0/16`) | default |
34| Subnet | `default` (`10.0.0.0/24`) | default |
35| NSG | SSH 22 from your public IP (`203.0.113.42`) | default — ⚠ change to `*` only if needed |
36| Public IP | Standard, dynamic | default |
37| OS disk | 30 GB Premium SSD | default |
38| Boot diagnostics | Managed | default |
39| Estimated cost | ~$0.096/hr (~$70/mo) | from `compute_vm_list-skus` |
40| Quota | ✅ 4/100 vCPUs used in `standardDSv5Family` | from `compute_vm_check-quota` |
41```
42 
43## After rendering — single batched action picker
44 
45Render the Plan Card markdown **inline in the chat first** (so the user can read it), then ask **one** AskUserQuestion that combines approval + output format + delivery:
46 
47> *"Looks good? Pick how you want it delivered:"*
48>
49> 1. **Save Bicep to `./infra/{vm-name}/`** *(Recommended for repos)*
50> 2. **Print az CLI in chat** *(Quick copy-paste)*
51> 3. **Save Terraform to `./infra/{vm-name}/`**
52> 4. **Open GitHub PR with Bicep**
53> 5. **Apply live via Azure MCP** *(actually creates resources)*
54> 6. **Edit a row first** *(then re-render and re-ask)*
55 
56This collapses what used to be 3 sequential popups (approve → output format → delivery) into **1**.
57 
58Implementation: a single `AskUserQuestion` tool call with `header: "Deliver"`, `multiSelect: false`, and 6 options (the most likely combinations above) — the user can also pick "Other" to type a custom answer like "give me both bicep and terraform".
59 
60**If the user picks "Edit a row first":** then ask which row, update, re-render the full Plan Card, and re-ask the same batched action picker. Do not splinter into multiple popups.
61 
62**If the user already implied the answer in their original prompt** ("save bicep to ./infra" / "open a PR" / "just print az CLI" / "apply it"): **skip this prompt entirely** and proceed straight to delivery.
63 
64**Explicit-override fast path — skip the Plan Card table too.** If the user combines an explicit deliverable ("give me the Bicep", "just print az CLI") with an explicit refusal of dialog ("no questions", "skip planning", "no plan", "just do it"): **do not render the Plan Card markdown table.** Instead emit a single-line preview of the high-signal decisions — e.g. *"→ Deploying `Standard_D2s_v5` in `eastus`, NSG = your public IP only on 22, est. ~$70/mo"* — and follow it immediately with the requested artifact. End with a one-liner noting the full Plan Card is available on request if they want to edit rows. Step 4 validation gates still run.
65