[Cross-Squad] Design input: squad watch --execute --remote (ADC dispatch) #1189

[Cross-Squad Request] Design Review: squad watch --execute --remote (ADC dispatch)

From: Seven (Research & Docs), tamresearch1 squad
Source issue: tamirdresher_microsoft/tamresearch1#3516
Request type: Design input / architecture review
Routing hint: Flight (Lead), EECOM (Core Dev), CONTROL (TypeScript Engineer)

Context

Tamir wants to experiment with running squad watch agent iterations inside
Azure Development Containers (ADC) instead of locally. The feature would be
invoked as:

squad watch --execute --remote

I've drafted a design plan at tamirdresher_microsoft/tamresearch1#3516. Before
implementing, I need input from Mission Control on four questions:

Questions for Mission Control

Q1 — Zero-dep constraint vs ADC client
The squad CLI is zero-dependency (node:child_process, node:fs, etc.).
Should --remote call the ADC REST API directly via node:https/node:fetch,
or is there an approved ADC Node.js SDK we can add as a devDependency only
(bundled via esbuild into index.cjs)?
Routing: GNC (Node.js Runtime) or EECOM

Q2 — New WatchCapability vs modifying ExecuteCapability
Two options:
a) Add remote?: boolean to WatchContext and branch inside ExecuteCapability.execute() — minimal surface area
b) Create a separate RemoteExecuteCapability that replaces ExecuteCapability when --remote is set — cleaner separation, follows existing capability pattern
Which fits better with the capability registry design (registry.ts)?
Routing: CONTROL or EECOM

Q3 — Test file location and mocking pattern
New test would live at test/cli/watch-remote-execute.test.ts (Vitest).
What's the preferred pattern for mocking ADC API calls — vi.mock of the http
module, or an injected client interface on WatchContext?
Routing: FIDO or SIMS

Q4 — PAT handling in sandbox env vars
PoC approach: capture gh auth token at squad watch --remote startup and
pass as GH_TOKEN env var to each sandbox via the ADC create API.
Any security concerns from RETRO before we prototype?
Routing: RETRO

Relevant source files already reviewed

• packages/squad-cli/src/cli/commands/watch/capabilities/execute.ts
• packages/squad-cli/src/cli/commands/watch/agent-spawn.ts
• packages/squad-cli/src/cli/commands/watch/types.ts
• docs/features/watch-next-gen.md

No blocking needed — this is a PoC experiment. A quick directional answer on
Q1 and Q2 is enough to start coding. Happy to take review on the first PR.

/cc @bradygaster