diff --git a/nulib/lib_provisioning/extensions/loader_oci.nu b/nulib/lib_provisioning/extensions/loader_oci.nu
index 093f5a6..57dda73 100644
--- a/nulib/lib_provisioning/extensions/loader_oci.nu
+++ b/nulib/lib_provisioning/extensions/loader_oci.nu
@@ -1,11 +1,14 @@
 # OCI-Aware Extension Loader
 # Loads extensions from multiple sources: OCI, Gitea, Local
 
-use ../config/accessor.nu *
-use ../utils/logging.nu *
-use ../oci/client.nu *
-use cache.nu *
-use loader.nu [load-manifest, is-extension-allowed, check-requirements, load-hooks]
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor and extensions/cache star-imports were dead — dropped.
+use lib_provisioning/utils/logging.nu [log-debug log-error log-info]
+use lib_provisioning/oci/client.nu [
+    get-oci-config is-oci-available load-oci-token oci-artifact-exists
+    oci-get-artifact-manifest oci-get-artifact-tags oci-pull-artifact
+]
+use lib_provisioning/extensions/loader.nu [load-manifest is-extension-allowed check-requirements load-hooks]
 
 # Check if extension is already loaded (in memory)
 def is-loaded [extension_type: string, extension_name: string] {
diff --git a/nulib/lib_provisioning/plugins/mod.nu b/nulib/lib_provisioning/plugins/mod.nu
index d6e87ee..9e4be86 100644
--- a/nulib/lib_provisioning/plugins/mod.nu
+++ b/nulib/lib_provisioning/plugins/mod.nu
@@ -5,12 +5,24 @@
 # Plugin Wrapper Modules
 # Exports all plugin wrappers with HTTP fallback support
 
-export use auth.nu *
-export use kms.nu *
-export use secretumvault.nu *
+# plugins/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
 
-# Plugin management utilities
-use ../config/accessor.nu *
+export use auth.nu [plugin-auth-status]
+export use kms.nu [
+    plugin-kms-backends plugin-kms-decrypt plugin-kms-encrypt
+    plugin-kms-generate-key plugin-kms-info plugin-kms-list-keys
+    plugin-kms-rotate-key plugin-kms-status
+]
+export use secretumvault.nu [
+    decrypt-config-file encrypt-config-file plugin-secretumvault-decrypt
+    plugin-secretumvault-encrypt plugin-secretumvault-generate-key
+    plugin-secretumvault-health plugin-secretumvault-info
+    plugin-secretumvault-rotate-key plugin-secretumvault-version
+]
+
+# config/accessor star-import was dead (no accessor symbols used in body) —
+# dropped. Add _ansi explicitly — previously came through an implicit chain.
+use lib_provisioning/utils/interface.nu [_ansi]
 
 # List all available plugins with status
 export def list-plugins [] {
diff --git a/nulib/lib_provisioning/providers/loader.nu b/nulib/lib_provisioning/providers/loader.nu
index 8508791..8d28cc8 100644
--- a/nulib/lib_provisioning/providers/loader.nu
+++ b/nulib/lib_provisioning/providers/loader.nu
@@ -1,9 +1,15 @@
 # Provider Loader System
 # Dynamic provider loading and interface validation
 
-use registry.nu *
-use interface.nu *
-use ../utils/logging.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# providers/interface.nu was a dead star-import — dropped.
+# Note: dynamic `use ($provider_entry.entry_point) *` remains at line ~173
+# (runtime load of the selected provider's module). Not convertible to
+# selective; that's intentional dynamic dispatch.
+use lib_provisioning/providers/registry.nu [
+    get-provider-entry get-provider-stats is-provider-available list-providers
+]
+use lib_provisioning/utils/logging.nu [log-debug log-error]
 
 # Load provider dynamically with validation (cached)
 export def load-provider [name: string] {