diff --git a/nulib/lib_provisioning/defs/mod.nu b/nulib/lib_provisioning/defs/mod.nu
index 8b1d82b..f6a59a5 100644
--- a/nulib/lib_provisioning/defs/mod.nu
+++ b/nulib/lib_provisioning/defs/mod.nu
@@ -1,3 +1,7 @@
-export use about.nu *
-export use lists.nu *
+# defs/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use about.nu [about_info]
+export use lists.nu [
+    cluster_list get_provisioning_info infras_list on_list
+    providers_list taskservs_list
+]
 # export use settings.nu *
diff --git a/nulib/lib_provisioning/integrations/iac/mod.nu b/nulib/lib_provisioning/integrations/iac/mod.nu
index 7555c1d..6c2c8ee 100644
--- a/nulib/lib_provisioning/integrations/iac/mod.nu
+++ b/nulib/lib_provisioning/integrations/iac/mod.nu
@@ -1,4 +1,10 @@
 # IaC Orchestrator Integration Module
 # Provides Infrastructure-from-Code to orchestrator conversion utilities
 
-use iac_orchestrator *
+# iac/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+# Former `use iac_orchestrator *` was broken (missing `./` prefix and plain use
+# instead of export use — facade wasn't actually re-exporting).
+export use ./iac_orchestrator.nu [
+    iac-to-workflow export-workflow-nickel submit-to-orchestrator
+    monitor-workflow orchestrate-from-iac
+]
diff --git a/nulib/lib_provisioning/integrations/mod.nu b/nulib/lib_provisioning/integrations/mod.nu
index a957880..56b7210 100644
--- a/nulib/lib_provisioning/integrations/mod.nu
+++ b/nulib/lib_provisioning/integrations/mod.nu
@@ -3,8 +3,8 @@
 # - Ecosystem: External integrations (backup, runtime, SSH, GitOps, service)
 # - IaC: Infrastructure-from-Code to orchestrator conversion
 
-# Re-export ecosystem integrations
-use ./ecosystem *
-
-# Re-export IaC orchestrator integration
-use ./iac *
+# integrations/ facade — selective re-exports via child facades (ADR-025 L3).
+# Both children (ecosystem/mod.nu, iac/mod.nu) are already selective, so this
+# facade can re-export their full API without multiplying stars.
+export use ./ecosystem *
+export use ./iac *
diff --git a/nulib/lib_provisioning/kms/mod.nu b/nulib/lib_provisioning/kms/mod.nu
index c0ccfad..b9708c0 100644
--- a/nulib/lib_provisioning/kms/mod.nu
+++ b/nulib/lib_provisioning/kms/mod.nu
@@ -1,2 +1,3 @@
-export use lib.nu *
-export use client.nu *
+# kms/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [decode_kms_file get_def_kms_config is_kms_file on_kms run_cmd_kms]
+export use client.nu [kms-decrypt kms-encrypt kms-list-backends kms-status kms-test main]
diff --git a/nulib/lib_provisioning/mode/mod.nu b/nulib/lib_provisioning/mode/mod.nu
index b9656a2..0be8c6c 100644
--- a/nulib/lib_provisioning/mode/mod.nu
+++ b/nulib/lib_provisioning/mode/mod.nu
@@ -1,5 +1,9 @@
 # Mode System Module
 # Execution mode management for provisioning system
 
-export use commands.nu *
-export use validator.nu *
+# mode/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use commands.nu [
+    "mode compare" "mode current" "mode init" "mode list"
+    "mode oci-registry" "mode show" "mode switch" "mode validate"
+]
+export use validator.nu [check-runtime-requirements validate-mode-config]
diff --git a/nulib/lib_provisioning/oci/mod.nu b/nulib/lib_provisioning/oci/mod.nu
index 71053c6..ff05ee5 100644
--- a/nulib/lib_provisioning/oci/mod.nu
+++ b/nulib/lib_provisioning/oci/mod.nu
@@ -2,5 +2,14 @@
 # Unified exports for OCI functionality
 # Version: 1.0.0
 
-export use client.nu *
-export use commands.nu *
+# oci/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use client.nu [
+    build-artifact-ref get-oci-config is-oci-available load-oci-token
+    oci-artifact-exists oci-delete-artifact oci-get-artifact-manifest
+    oci-get-artifact-tags oci-list-artifacts oci-pull-artifact
+    oci-push-artifact test-oci-connection
+]
+export use commands.nu [
+    "oci config" "oci copy" "oci delete" "oci inspect" "oci list"
+    "oci login" "oci logout" "oci pull" "oci push" "oci search" "oci tags"
+]