diff --git a/nulib/lib_provisioning/ai/mod.nu b/nulib/lib_provisioning/ai/mod.nu
index b8a76e6..28441d9 100644
--- a/nulib/lib_provisioning/ai/mod.nu
+++ b/nulib/lib_provisioning/ai/mod.nu
@@ -1 +1,6 @@
-export use lib.nu *
+# ai/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [
+    get_ai_config is_ai_enabled get_provider_config build_headers build_endpoint
+    ai_request ai_complete ai_generate_template ai_process_query
+    ai_process_webhook validate_ai_config test_ai_connection
+]
diff --git a/nulib/lib_provisioning/config/accessor/mod.nu b/nulib/lib_provisioning/config/accessor/mod.nu
index 34ba9a5..9489d43 100644
--- a/nulib/lib_provisioning/config/accessor/mod.nu
+++ b/nulib/lib_provisioning/config/accessor/mod.nu
@@ -57,5 +57,12 @@ export def get-full-config []: nothing -> record {
     load-deployment-mode
 }
 
-# Import specific functions only
-export use ./functions.nu *
+# Selective re-export (ADR-025 Phase 3 Layer 3).
+export use ./functions.nu [
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]
diff --git a/nulib/lib_provisioning/config/loader.nu b/nulib/lib_provisioning/config/loader.nu
index 3263fd8..34243d8 100644
--- a/nulib/lib_provisioning/config/loader.nu
+++ b/nulib/lib_provisioning/config/loader.nu
@@ -1,4 +1,13 @@
 # Configuration Loader Orchestrator (v2)
 # Re-exports modular loader components using folder structure
 
-export use ./loader/mod.nu *
+# Config Loader orchestrator (ADR-025 Phase 3 Layer 3).
+# Re-exports the selective symbol set that loader/mod.nu declares.
+# loader/mod.nu is already selective (14 symbols across 5 files).
+export use ./loader/mod.nu [
+    load-provisioning-config validate-config validate-config-structure
+    validate-data-types validate-file-existence validate-path-values
+    validate-semantic-rules apply-environment-variable-overrides
+    detect-current-environment get-available-environments validate-environment
+    create-interpolation-test-suite test-interpolation get-dag-config
+]
diff --git a/nulib/lib_provisioning/coredns/api_client.nu b/nulib/lib_provisioning/coredns/api_client.nu
index 5d6e761..bd34666 100644
--- a/nulib/lib_provisioning/coredns/api_client.nu
+++ b/nulib/lib_provisioning/coredns/api_client.nu
@@ -1,8 +1,8 @@
 # CoreDNS API Client
 # Client for orchestrator DNS API endpoints
 
-use ../utils/log.nu *
-use ../config/loader.nu get-config
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/config/loader.nu [get-config]
 
 # Call orchestrator DNS API
 export def call-dns-api [
diff --git a/nulib/lib_provisioning/coredns/corefile.nu b/nulib/lib_provisioning/coredns/corefile.nu
index ceb70fa..a8076ce 100644
--- a/nulib/lib_provisioning/coredns/corefile.nu
+++ b/nulib/lib_provisioning/coredns/corefile.nu
@@ -1,7 +1,7 @@
 # CoreDNS Corefile Generator
 # Generates and manages Corefile configuration for CoreDNS
 
-use ../utils/log.nu *
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
 
 # Generate Corefile from configuration
 export def generate-corefile [
diff --git a/nulib/lib_provisioning/coredns/docker.nu b/nulib/lib_provisioning/coredns/docker.nu
index a1eea45..8198c07 100644
--- a/nulib/lib_provisioning/coredns/docker.nu
+++ b/nulib/lib_provisioning/coredns/docker.nu
@@ -1,8 +1,8 @@
 # CoreDNS Docker Management
 # Manage CoreDNS in Docker containers using docker-compose
 
-use ../utils/log.nu *
-use corefile.nu [generate-corefile write-corefile]
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-corefile write-corefile]
 use zones.nu create-zone-file
 
 # Start CoreDNS Docker container
diff --git a/nulib/lib_provisioning/coredns/service.nu b/nulib/lib_provisioning/coredns/service.nu
index 46aa8b4..1756522 100644
--- a/nulib/lib_provisioning/coredns/service.nu
+++ b/nulib/lib_provisioning/coredns/service.nu
@@ -1,8 +1,8 @@
 # CoreDNS Service Manager
 # Start, stop, and manage CoreDNS service
 
-use ../utils/log.nu *
-use corefile.nu [generate-corefile write-corefile]
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-corefile write-corefile]
 use zones.nu create-zone-file
 
 # Start CoreDNS service
diff --git a/nulib/lib_provisioning/coredns/zones.nu b/nulib/lib_provisioning/coredns/zones.nu
index adedd2c..d53db68 100644
--- a/nulib/lib_provisioning/coredns/zones.nu
+++ b/nulib/lib_provisioning/coredns/zones.nu
@@ -1,8 +1,8 @@
 # CoreDNS Zone File Management
 # Create, update, and manage DNS zone files
 
-use ../utils/log.nu *
-use corefile.nu generate-zone-file
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-zone-file]
 
 # Create zone file with SOA and NS records
 export def create-zone-file [
diff --git a/nulib/lib_provisioning/defs/lists.nu b/nulib/lib_provisioning/defs/lists.nu
index ef30724..ae1f5a8 100644
--- a/nulib/lib_provisioning/defs/lists.nu
+++ b/nulib/lib_provisioning/defs/lists.nu
@@ -1,6 +1,6 @@
 
-use ../config/accessor.nu *
-use ../utils/on_select.nu run_on_selection
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/on_select.nu [run_on_selection]
 export def get_provisioning_info [
     dir_path: string
     target: string
diff --git a/nulib/lib_provisioning/gitea/extension_publish.nu b/nulib/lib_provisioning/gitea/extension_publish.nu
index 64d46df..22fe310 100644
--- a/nulib/lib_provisioning/gitea/extension_publish.nu
+++ b/nulib/lib_provisioning/gitea/extension_publish.nu
@@ -4,8 +4,12 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
-use ../config/loader.nu get-config
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [
+    create-release create-repository get-gitea-config get-gitea-token
+    get-release-by-tag get-repository list-releases upload-release-asset
+]
+use lib_provisioning/config/loader.nu [get-config]
 
 # Validate extension structure
 def validate-extension [
diff --git a/nulib/lib_provisioning/gitea/locking.nu b/nulib/lib_provisioning/gitea/locking.nu
index 1f7ffcd..c2a2e47 100644
--- a/nulib/lib_provisioning/gitea/locking.nu
+++ b/nulib/lib_provisioning/gitea/locking.nu
@@ -4,7 +4,11 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [
+    close-issue create-issue create-repository get-current-user
+    get-gitea-config get-issue get-repository list-issues
+]
 
 # Lock label constants
 const LOCK_LABEL_PREFIX = "workspace-lock"
diff --git a/nulib/lib_provisioning/gitea/workspace_git.nu b/nulib/lib_provisioning/gitea/workspace_git.nu
index 226de26..bf3e4a1 100644
--- a/nulib/lib_provisioning/gitea/workspace_git.nu
+++ b/nulib/lib_provisioning/gitea/workspace_git.nu
@@ -4,7 +4,8 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [create-repository get-gitea-config get-repository]
 
 # Initialize workspace as git repository
 export def init-workspace-git [
diff --git a/nulib/lib_provisioning/infra_validator/agent_interface.nu b/nulib/lib_provisioning/infra_validator/agent_interface.nu
index 4a3a59b..0bc3db7 100644
--- a/nulib/lib_provisioning/infra_validator/agent_interface.nu
+++ b/nulib/lib_provisioning/infra_validator/agent_interface.nu
@@ -2,8 +2,9 @@
 # Provides programmatic interface for automated infrastructure validation and fixing
 # Error handling: Guard patterns (no try-catch for field access)
 
-use validator.nu
-use report_generator.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# report_generator star-import was dead — dropped.
+use lib_provisioning/infra_validator/validator.nu
 
 # Main function for AI agents to validate infrastructure
 export def validate_for_agent [
diff --git a/nulib/lib_provisioning/infra_validator/rules_engine.nu b/nulib/lib_provisioning/infra_validator/rules_engine.nu
index 95eeda9..f946823 100644
--- a/nulib/lib_provisioning/infra_validator/rules_engine.nu
+++ b/nulib/lib_provisioning/infra_validator/rules_engine.nu
@@ -2,7 +2,10 @@
 # Defines and manages validation rules for infrastructure configurations
 # Error handling: Guard patterns (no try-catch for field access)
 
-use config_loader.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/infra_validator/config_loader.nu [
+    create_rule_context load_rules_from_config load_validation_config
+]
 
 # Main function to get all validation rules (now config-driven)
 export def get_all_validation_rules [
diff --git a/nulib/lib_provisioning/kms/lib.nu b/nulib/lib_provisioning/kms/lib.nu
index 7cc8831..5898805 100644
--- a/nulib/lib_provisioning/kms/lib.nu
+++ b/nulib/lib_provisioning/kms/lib.nu
@@ -1,8 +1,8 @@
 use std
-use ../config/accessor.nu *
-use ../utils/error.nu throw-error
-use ../utils/interface.nu _print
-use ../plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-info]
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/error.nu [throw-error]
+use lib_provisioning/utils/interface.nu [_print]
+use lib_provisioning/plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-info]
 
 def find_file [
     start_path: string
diff --git a/nulib/lib_provisioning/plugins/kms.nu b/nulib/lib_provisioning/plugins/kms.nu
index ffbaf13..2d32758 100644
--- a/nulib/lib_provisioning/plugins/kms.nu
+++ b/nulib/lib_provisioning/plugins/kms.nu
@@ -1,7 +1,8 @@
 # KMS Plugin Wrapper with HTTP Fallback
 # Provides graceful degradation to HTTP/CLI when nu_plugin_kms is unavailable
 
-use ../config/accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
 
 # Check if KMS plugin is available (registered with Nushell)
 def is-plugin-available [] {
diff --git a/nulib/lib_provisioning/project/detect.nu b/nulib/lib_provisioning/project/detect.nu
index 1742c17..83739b0 100644
--- a/nulib/lib_provisioning/project/detect.nu
+++ b/nulib/lib_provisioning/project/detect.nu
@@ -1,7 +1,9 @@
 # Provisioning Project Detection Module
 # Provides functions for technology detection and requirement inference
 
-use ../../../lib_provisioning *
+# Former `use ../../../lib_provisioning *` was a broken path (resolves to
+# non-existent core/lib_provisioning) — it was a silent no-op at runtime.
+# Removed per ADR-025 Phase 3 Layer 2.
 
 # Detect technologies in a project
 export def detect-project [
diff --git a/nulib/lib_provisioning/services/manager.nu b/nulib/lib_provisioning/services/manager.nu
index 19768c1..849da1e 100644
--- a/nulib/lib_provisioning/services/manager.nu
+++ b/nulib/lib_provisioning/services/manager.nu
@@ -3,7 +3,7 @@
 # Service Manager Core
 # Manages platform service lifecycle, registry, and health checks
 
-use ../config/loader.nu *
+# config/loader star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 def get-service-state-dir [] {
     $"($env.HOME)/.provisioning/services/state"
diff --git a/nulib/lib_provisioning/sops/mod.nu b/nulib/lib_provisioning/sops/mod.nu
index b8a76e6..29b1f41 100644
--- a/nulib/lib_provisioning/sops/mod.nu
+++ b/nulib/lib_provisioning/sops/mod.nu
@@ -1 +1,6 @@
-export use lib.nu *
+# sops/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [
+    run_cmd_sops on_sops generate_sops_file generate_sops_settings edit_sop
+    is_sops_file decode_sops_file get_def_sops get_def_age find-sops-key
+    get-sops-age-key-file
+]
diff --git a/nulib/lib_provisioning/user/mod.nu b/nulib/lib_provisioning/user/mod.nu
index dd868b3..4f7881a 100644
--- a/nulib/lib_provisioning/user/mod.nu
+++ b/nulib/lib_provisioning/user/mod.nu
@@ -1,2 +1,9 @@
 # User configuration module exports
-export use config.nu *
+# user/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use config.nu [
+    get-user-config-path load-user-config create-default-user-config
+    save-user-config get-active-workspace get-active-workspace-details
+    set-active-workspace list-workspaces remove-workspace register-workspace
+    get-user-preference set-user-preference validate-workspace-exists
+    get-workspace-path get-workspace-default-infra set-workspace-default-infra
+]
diff --git a/nulib/lib_provisioning/utils/init.nu b/nulib/lib_provisioning/utils/init.nu
index 2b0f10e..ef875ac 100644
--- a/nulib/lib_provisioning/utils/init.nu
+++ b/nulib/lib_provisioning/utils/init.nu
@@ -3,7 +3,7 @@
 # Dependencies: error, interface, config/accessor
 
 
-use ../config/accessor.nu *
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Get the complete provisioning command arguments as a string
 export def get-provisioning-args [] : nothing -> string {
diff --git a/nulib/lib_provisioning/utils/ssh.nu b/nulib/lib_provisioning/utils/ssh.nu
index 7d52162..cf659e3 100644
--- a/nulib/lib_provisioning/utils/ssh.nu
+++ b/nulib/lib_provisioning/utils/ssh.nu
@@ -1,4 +1,4 @@
-use ../config/accessor.nu *
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 export def ssh_cmd  [
   settings: record
diff --git a/nulib/lib_provisioning/webhook/ai_webhook.nu b/nulib/lib_provisioning/webhook/ai_webhook.nu
index 7351e96..5b9df1d 100644
--- a/nulib/lib_provisioning/webhook/ai_webhook.nu
+++ b/nulib/lib_provisioning/webhook/ai_webhook.nu
@@ -2,8 +2,9 @@
 # Provides AI-powered webhook endpoints for chat platforms
 
 use std
-use ../ai/lib.nu *
-use ../settings/lib.nu get_settings
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/ai/lib.nu [ai_process_webhook get_ai_config is_ai_enabled test_ai_connection]
+use lib_provisioning/settings/lib.nu [get_settings]
 
 # Main webhook handler for AI-powered chat integration
 export def ai_webhook_handler [