- Full runbook execution loop: parse YAML, validate required variables, merge defaults - Variable substitution via --var key=value CLI args - Safety-gated execution: read-only auto-approved, modifying/destructive prompt on stdin - Failure handling: abort, continue, retry with max_attempts - Removed Verify subcommand (Ed25519 deferred to post-V1)