diff --git a/nulib/lib_provisioning/config/mod.nu b/nulib/lib_provisioning/config/mod.nu
index 2b2830c..b1b2039 100644
--- a/nulib/lib_provisioning/config/mod.nu
+++ b/nulib/lib_provisioning/config/mod.nu
@@ -5,15 +5,75 @@
 # Configuration System Module Index
 # Central import point for the new configuration system
 
-# Core configuration functionality
-export use loader.nu *
-export use accessor.nu *
-export use accessor_generated.nu *  # Schema-driven generated accessors
-export use migration.nu *
+# config/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+
+# loader.nu and accessor.nu are 1-line orchestrators that star-re-export their
+# own accessor/mod.nu and loader/mod.nu subtrees. They remain as star re-exports
+# here because flattening them requires refactoring the loader/ and accessor/
+# subsystems first (Phase 3 next pass). Transitivity will be restored at that
+# point; for now, document the exception.
+export use loader.nu *    # orchestrator → loader/mod.nu (pending flatten)
+export use accessor.nu *  # orchestrator → accessor/mod.nu (pending flatten)
+
+# Schema-driven generated accessors (80 get-* auto-generated functions)
+export use accessor_generated.nu [
+    get-DefaultAIProvider-enable_query_ai get-DefaultAIProvider-enable_template_ai
+    get-DefaultAIProvider-enable_webhook_ai get-DefaultAIProvider-enabled
+    get-DefaultAIProvider-max_tokens get-DefaultAIProvider-provider
+    get-DefaultAIProvider-temperature get-DefaultAIProvider-timeout
+    get-DefaultKmsConfig-auth_method get-DefaultKmsConfig-server_url
+    get-DefaultKmsConfig-timeout get-DefaultKmsConfig-verify_ssl
+    get-DefaultRunSet-inventory_file get-DefaultRunSet-output_format
+    get-DefaultRunSet-output_path get-DefaultRunSet-use_time get-DefaultRunSet-wait
+    get-defaults-ai_provider-enable_query_ai get-defaults-ai_provider-enable_template_ai
+    get-defaults-ai_provider-enable_webhook_ai get-defaults-ai_provider-enabled
+    get-defaults-ai_provider-max_tokens get-defaults-ai_provider-provider
+    get-defaults-ai_provider-temperature get-defaults-ai_provider-timeout
+    get-defaults-kms_config-auth_method get-defaults-kms_config-server_url
+    get-defaults-kms_config-timeout get-defaults-kms_config-verify_ssl
+    get-defaults-run_set-inventory_file get-defaults-run_set-output_format
+    get-defaults-run_set-output_path get-defaults-run_set-use_time
+    get-defaults-run_set-wait get-defaults-secret_provider-provider
+    get-defaults-settings-cluster_admin_host get-defaults-settings-cluster_admin_port
+    get-defaults-settings-cluster_admin_user get-defaults-settings-clusters_paths
+    get-defaults-settings-clusters_save_path get-defaults-settings-created_clusters_dirpath
+    get-defaults-settings-created_taskservs_dirpath get-defaults-settings-defaults_provs_dirpath
+    get-defaults-settings-defaults_provs_suffix get-defaults-settings-main_name
+    get-defaults-settings-main_title get-defaults-settings-prov_clusters_path
+    get-defaults-settings-prov_data_dirpath get-defaults-settings-prov_data_suffix
+    get-defaults-settings-prov_local_bin_path get-defaults-settings-prov_resources_path
+    get-defaults-settings-servers_paths get-defaults-settings-servers_wait_started
+    get-defaults-settings-settings_path get-defaults-sops_config-use_age
+    get-DefaultSecretProvider-provider get-DefaultSettings-cluster_admin_host
+    get-DefaultSettings-cluster_admin_port get-DefaultSettings-cluster_admin_user
+    get-DefaultSettings-clusters_paths get-DefaultSettings-clusters_save_path
+    get-DefaultSettings-created_clusters_dirpath get-DefaultSettings-created_taskservs_dirpath
+    get-DefaultSettings-defaults_provs_dirpath get-DefaultSettings-defaults_provs_suffix
+    get-DefaultSettings-main_name get-DefaultSettings-main_title
+    get-DefaultSettings-prov_clusters_path get-DefaultSettings-prov_data_dirpath
+    get-DefaultSettings-prov_data_suffix get-DefaultSettings-prov_local_bin_path
+    get-DefaultSettings-prov_resources_path get-DefaultSettings-servers_paths
+    get-DefaultSettings-servers_wait_started get-DefaultSettings-settings_path
+    get-DefaultSopsConfig-use_age
+]
+export use migration.nu [
+    analyze-current-env backup-current-env check-migration-issues
+    generate-user-config get-env-mapping show-migration-status
+]
 
 # Encryption functionality
-export use encryption.nu *
-export use commands.nu *
+export use encryption.nu [
+    contains-sensitive-data decrypt-config decrypt-config-memory
+    edit-encrypted-config encrypt-config encrypt-sensitive-configs
+    is-encrypted-config load-encrypted-config main rotate-encryption-keys
+    scan-unencrypted-configs validate-encryption-config
+]
+export use commands.nu [
+    "config decrypt" "config edit-secure" "config encrypt" "config encrypt-all"
+    "config encryption-info" "config init-encryption" "config is-encrypted"
+    "config rotate-keys" "config scan-sensitive" "config validate-encryption"
+    main
+]
 
 # Convenience function to get the complete configuration
 # Use as: `use config; config` or `config main`