merge(refactor/lazy-loading): ADR-025 lazy-loading complete

# Conflicts:
#	CHANGELOG.md
#	versions.ncl

.githooks/pre-commit

@@ -3,3 +3,35 @@
 use toolkit.nu fmt
 
 fmt # --check --verbose
+
+# ADR-025: Block root star-imports of lib_provisioning / main_provisioning.
+# A line matching `use lib_provisioning *` or `use main_provisioning *` at the
+# start of a file (top-level) reintroduces the transitive parse cost this
+# refactor was designed to eliminate. All imports must be selective.
+let staged = (git diff --cached --name-only | lines | where { str ends-with ".nu" })
+
+if ($staged | length) > 0 {
+    let violations = (
+        $staged
+        | each {|f|
+            let hits = (
+                do { git show $":($f)" } | complete
+                | if $in.exit_code == 0 { $in.stdout } else { "" }
+                | lines
+                | enumerate
+                | where { $it.item | str starts-with "use lib_provisioning *" or $it.item | str starts-with "use main_provisioning *" }
+                | each {|row| $"  ($f):($row.index + 1): ($row.item | str trim)"}
+            )
+            $hits
+        }
+        | flatten
+    )
+
+    if ($violations | length) > 0 {
+        print "❌ ADR-025 star-import violation — selective imports required:"
+        for v in $violations { print $v }
+        print ""
+        print "Replace `use lib_provisioning *` with explicit `use lib_provisioning/path/to/module.nu [sym1 sym2]`"
+        exit 1
+    }
+}

cli/provisioning

@@ -51,7 +51,7 @@ fi
 export PROVISIONING_RESOURCES=${PROVISIONING_RESOURCES:-"$PROVISIONING/resources"}
 PROVIISONING_WKPATH=${PROVIISONING_WKPATH:-/tmp/tmp.}
 
-RUNNER="provisioning"
+RUNNER="provisioning-cli.nu"
 PROVISIONING_MODULE=""
 PROVISIONING_MODULE_TASK=""
 
@@ -68,8 +68,8 @@ _show_help() {
         fi
     fi
 
-    # Fallback: Call Nushell for help (will use daemon if available)
-    $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER" help $category
+    # Fallback: Call Nushell for help via single CLI entry
+    $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cli.nu" help $category
 }
 
 # Workflow help function (defined early for early help detection)
@@ -126,6 +126,7 @@ _get_daemon_port() {
 
 DAEMON_PORT=$(_get_daemon_port)
 DAEMON_ENDPOINT="http://127.0.0.1:${DAEMON_PORT}"
+DAEMON_EXECUTE_ENDPOINT="${DAEMON_ENDPOINT}/api/v1/execute"
 DAEMON_TIMEOUT_FAST="0.5"   # Help/quick operations: 500ms
 DAEMON_TIMEOUT_NORMAL="1.0" # Template rendering: 1s
 DAEMON_TIMEOUT_BATCH="5.0"  # Batch operations: 5s
@@ -371,6 +372,8 @@ _workflow_help() {
 execute_via_daemon() {
     local cmd="$1"
     shift
+    local cwd_json
+    local response
 
     # Build JSON array of arguments (simple bash)
     local args_json="["
@@ -381,6 +384,7 @@ execute_via_daemon() {
         first=0
     done
     args_json="$args_json]"
+    cwd_json=$(printf '%s' "$PWD" | sed 's/\\/\\\\/g; s/"/\\"/g')
 
     # Determine timeout based on command type
     # Heavy commands (create, delete, update) get longer timeout
@@ -391,11 +395,21 @@ execute_via_daemon() {
     esac
 
     # Make request and extract stdout
-    curl -s -m $timeout -X POST "$DAEMON_ENDPOINT" \
+    response=$(curl -s -m $timeout -X POST "$DAEMON_EXECUTE_ENDPOINT" \
         -H "Content-Type: application/json" \
-        -d "{\"command\":\"$cmd\",\"args\":$args_json,\"timeout_ms\":30000}" 2>/dev/null |
-        sed -n 's/.*"stdout":"\(.*\)","execution.*/\1/p' |
-        sed 's/\\n/\n/g'
+        -d "{\"command\":\"$cmd\",\"args\":$args_json,\"cwd\":\"$cwd_json\",\"timeout_ms\":30000}" 2>/dev/null)
+
+    if [ -z "$response" ] || [ "$response" = "null" ] || [ "$response" = "{}" ]; then
+        return 1
+    fi
+
+    if command -v jq >/dev/null 2>&1; then
+        printf '%s' "$response" | jq -r '.stdout // empty'
+    else
+        printf '%s' "$response" |
+            sed -n 's/.*"stdout":"\(.*\)","execution.*/\1/p' |
+            sed 's/\\n/\n/g'
+    fi
 }
 
 # Intercept: server volume → volume (avoids loading full server module)
@@ -409,8 +423,8 @@ fi
 # Try daemon ONLY for lightweight commands (list, show, status)
 # Skip daemon for heavy commands (create, delete, update) because bash wrapper is slow
 # ALSO skip daemon for flow=continue commands (need stdin for TTY interaction)
-if [ "${PROVISIONING_BYPASS_DAEMON:-}" != "true" ] && ([ "${1:-}" = "server" ] || [ "${1:-}" = "s" ]); then
-    if [ "${2:-}" = "list" ] || [ -z "${2:-}" ]; then
+if [ "${PROVISIONING_BYPASS_DAEMON:-}" != "true" ] && [ "${PROVISIONING_NO_DAEMON:-}" != "true" ] && ([ "${1:-}" = "server" ] || [ "${1:-}" = "s" ]); then
+    if [ "${2:-}" = "list" ] || [ "${2:-}" = "ls" ] || [ "${2:-}" = "l" ] || [ -z "${2:-}" ]; then
         # Light command - try daemon
         [ -n "${PROVISIONING_DEBUG:-}" ] && [ "${PROVISIONING_DEBUG:-}" = "true" ] && echo "⚡ Attempting daemon execution..." >&2
         DAEMON_OUTPUT=$(execute_via_daemon "$@" 2>/dev/null)
@@ -629,30 +643,15 @@ if [ -n "${1:-}" ] && [ -z "${2:-}" ]; then
     fi
 fi
 
-# Workspace operations (fast-path)
+# workspace fast-path removed (ADR-025 Phase 4 — single-route principle).
+# All workspace subcommands now route to main_provisioning/workspace.nu via
+# the main dispatch case. --help still intercepts before full load.
 if [ "${1:-}" = "workspace" ] || [ "${1:-}" = "ws" ]; then
     case "${2:-}" in
-    "list" | "")
-        _nu_minimal "workspace-list | get ok | table"
-        exit $?
-        ;;
-    "active")
-        _nu_minimal "workspace-active"
-        exit $?
-        ;;
-    "info")
-        if [ -n "${3:-}" ]; then
-            $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/query-workspace-info.nu'" 2>/dev/null
-        else
-            $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/query-workspace-info.nu'" 2>/dev/null
-        fi
-        exit $?
-        ;;
     "-help" | "h" | "help")
         exec "$0" "${1}" --help
         ;;
     esac
-    # Other workspace commands (switch, register, etc.) fall through to full loading
 fi
 
 # Status/Health check (fast-path) - DISABLED to fix dispatcher loop
@@ -662,11 +661,8 @@ fi
 #   exit $?
 # fi
 
-# Environment display (fast-path)
-if [ "${1:-}" = "env" ] || [ "${1:-}" = "allenv" ]; then
-    _nu_minimal "env-quick | table"
-    exit $?
-fi
+# env fast-path removed (ADR-025 Phase 4 — single-route principle).
+# env/allenv now route to the full dispatcher via the *) default case.
 
 # Alias list fast-path — reads JSON cache directly in bash, no Nu process
 if [ "${1:-}" = "alias" ] || [ "${1:-}" = "a" ] || [ "${1:-}" = "al" ]; then
@@ -801,81 +797,25 @@ if [ "${1:-}" = "job" ] || [ "${1:-}" = "j" ]; then
     esac
 fi
 
-# Provider list (lightweight - reads filesystem only, no module loading)
-if [ "${1:-}" = "provider" ] || [ "${1:-}" = "providers" ]; then
-    if [ "${2:-}" = "list" ] || [ -z "${2:-}" ]; then
-        $NU "$PROVISIONING/core/nulib/scripts/query-providers.nu" 2>/dev/null
-        exit $?
-    fi
-fi
+# provider fast-path removed (ADR-025 Phase 4 — single-route principle).
+# Falls through to main dispatch case.
 
-# Taskserv list (fast-path) - avoid full system load
-if [ "${1:-}" = "taskserv" ] || [ "${1:-}" = "task" ]; then
-    if [ "${2:-}" = "list" ] || [ -z "${2:-}" ]; then
-        $NU "$PROVISIONING/core/nulib/scripts/query-taskservs.nu" 2>/dev/null
-        exit $?
-    fi
-fi
+# Fast-paths removed (ADR-025 Phase 4 — single-route principle).
+# taskserv/server/cluster `list` now route to their thin handlers which invoke
+# the full semantic path (middleware + live provider state). Daemon routing
+# (for server list/ls/l) is preserved further down in the dispatch case.
 
-# Server list: fast-path (filesystem only) unless --infra is given, which needs live provider data
-if [ "${1:-}" = "server" ] || [ "${1:-}" = "s" ]; then
-    if [ "${2:-}" = "list" ] || [ "${2:-}" = "l" ] || [ -z "${2:-}" ]; then
-        # Check for --infra/-i in remaining args
-        _HAS_INFRA=""
-        for _a in "${@}"; do
-            if [ "$_a" = "--infra" ] || [ "$_a" = "-i" ]; then _HAS_INFRA=1; break; fi
-        done
-
-        if [ -z "$_HAS_INFRA" ]; then
-            # No infra filter — use fast-path (no credentials needed)
-            INFRA_FILTER=""
-            shift
-            { [ "${1:-}" = "list" ] || [ "${1:-}" = "l" ]; } && shift
-            while [ $# -gt 0 ]; do
-                case "${1:-}" in
-                --infra | -i) INFRA_FILTER="${2:-}"; shift 2 ;;
-                *) shift ;;
-                esac
-            done
-            export INFRA_FILTER
-            $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/query-servers.nu'" 2>/dev/null
-            exit $?
-        fi
-        # --infra given: fall through to full module for live provider status
-    fi
-fi
-
-# Cluster list (lightweight - reads filesystem only)
-if [ "${1:-}" = "cluster" ] || [ "${1:-}" = "cl" ]; then
-    if [ "${2:-}" = "list" ] || [ -z "${2:-}" ]; then
-        $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/query-clusters.nu'" 2>/dev/null
-        exit $?
-    fi
-fi
-
-# Infra list (lightweight - reads filesystem only)
+# infra fast-path removed (ADR-025 Phase 4 — single-route principle).
+# Falls through to main dispatch case. Help with no args still shows help menu.
 if [ "${1:-}" = "infra" ] || [ "${1:-}" = "inf" ]; then
-    # Show infrastructure help if no second argument
     if [ -z "${2:-}" ]; then
-        # Call through the normal help system
         provisioning help infrastructure
         exit 0
-    elif [ "${2:-}" = "list" ]; then
-        $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/query-infra.nu'" 2>/dev/null
-        exit $?
-    elif [ "${2:-}" = "info" ]; then
-        INFRA_NAME="${3:-}" $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/query-infra-detail.nu'" 2>/dev/null
-        exit $?
     fi
 fi
 
-# Config validation (lightweight - validates config structure without full load)
-if [ "${1:-}" = "validate" ]; then
-    if [ "${2:-}" = "config" ] || [ -z "${2:-}" ]; then
-        $NU -n -c "source '$PROVISIONING/core/nulib/lib_minimal.nu'; source '$PROVISIONING/core/nulib/scripts/validate-config.nu'" 2>/dev/null
-        exit $?
-    fi
-fi
+# validate fast-path removed (ADR-025 Phase 4 — single-route principle).
+# Falls through to main dispatch case.
 
 if [ ! -d "$PROVISIONING_USER_CONFIG" ] || [ ! -r "$PROVISIONING_CONTEXT_PATH" ]; then
     [ ! -x "$PROVISIONING/core/nulib/provisioning setup" ] && echo "$PROVISIONING/core/nulib/provisioning setup  not found" && exit 1
@@ -1055,11 +995,9 @@ _validate_command() {
 #   - Daemon fallback: Automatic, user sees no difference
 
 if [ -n "$PROVISIONING_MODULE" ]; then
-    if [[ -x $PROVISIONING/core/nulib/$RUNNER\ $PROVISIONING_MODULE ]]; then
-        $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER $PROVISIONING_MODULE" $CMD_ARGS
-    else
-        echo "Error \"$PROVISIONING/core/nulib/$RUNNER $PROVISIONING_MODULE\" not found"
-    fi
+    # -mod <module> mode: provisioning-cli.nu reads PROVISIONING_MODULE from env
+    # and dispatches to the module's main function directly.
+    $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cli.nu" $CMD_ARGS </dev/null
 else
     # Only redirect stdin for non-interactive commands (nu command needs interactive stdin)
     if [ "${1:-}" = "nu" ]; then
@@ -1117,16 +1055,15 @@ else
         workspace | ws)
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/main_provisioning/workspace.nu" $CMD_ARGS </dev/null
             ;;
-        env | allenv | list | ls | l | provider | providers | validate | plugin | plugins | nuinfo)
-            # Safe commands - can use /dev/null
-            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER" $CMD_ARGS </dev/null
+        env | allenv | list | ls | l | provider | providers | validate | plugin | plugins | nuinfo | config | show)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-config.nu" $CMD_ARGS </dev/null
             ;;
         platform | plat | p)
-            # logs needs interactive stdin for typedialog — use full entry.
-            # All other platform subcommands use the thin entry (~50ms vs ~9s).
+            # logs needs interactive stdin for typedialog — keep stdin open.
+            # All other platform subcommands use the thin entry (~50ms vs ~3s).
             case "${2:-}" in
             logs | log)
-                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER" $CMD_ARGS
+                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cli.nu" $CMD_ARGS
                 ;;
             *)
                 $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-platform.nu" $CMD_ARGS </dev/null
@@ -1155,7 +1092,28 @@ else
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-workflow.nu" $CMD_ARGS </dev/null
             ;;
         alias)
-            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER" $CMD_ARGS </dev/null
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cli.nu" $CMD_ARGS </dev/null
+            ;;
+        orchestrator | orch | o)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-orchestrator.nu" $CMD_ARGS </dev/null
+            ;;
+        guide | guides | howto | shortcuts | sc | quickstart | quick | from-scratch | scratch | customize | custom | setup)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-guide.nu" $CMD_ARGS </dev/null
+            ;;
+        module | mod | layer | lyr | discover | disc)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-dev.nu" $CMD_ARGS </dev/null
+            ;;
+        build | bd)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-build.nu" $CMD_ARGS </dev/null
+            ;;
+        auth | login | integrations | int)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-auth.nu" $CMD_ARGS </dev/null
+            ;;
+        vm)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-vm.nu" $CMD_ARGS </dev/null
+            ;;
+        delete | d)
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-delete.nu" $CMD_ARGS
             ;;
         create | new)
             # "prvng create server ..." → "prvng server create ..."
@@ -1173,13 +1131,23 @@ else
                 $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cluster.nu" cluster create "$@" </dev/null
                 exit $? ;;
             *)
-                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER" create "$_resource" "$@"
+                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cli.nu" create "$_resource" "$@"
                 exit $? ;;
             esac
             ;;
         server | s)
-            # Intercept subcommand --help before Nu absorbs it at the top-level main
+            # Route list/sync to the lightweight handler (loads only list.nu, ~255ms).
+            # All other subcommands go to the full handler (~1.15s).
             _srv_sub="${2:-}"
+            case "$_srv_sub" in
+            list|ls|l|sync)
+                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server-list.nu" $CMD_ARGS </dev/null
+                exit $? ;;
+            ssh)
+                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server-ssh.nu" $CMD_ARGS
+                exit $? ;;
+            esac
+            # Intercept subcommand --help before Nu absorbs it at the top-level main
             _has_help=false
             for _a in "$@"; do [ "$_a" = "--help" ] || [ "$_a" = "-h" ] && _has_help=true && break; done
             if [ "$_has_help" = "true" ]; then
@@ -1203,7 +1171,7 @@ else
         ssh)
             # Shortcut: provisioning ssh <hostname> → provisioning server ssh <hostname> --run
             shift
-            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server.nu" server ssh "$@" --run
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server-ssh.nu" server ssh "$@" --run
             ;;
         state | st)
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-state.nu" $CMD_ARGS </dev/null
@@ -1218,9 +1186,9 @@ else
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/main_provisioning/fip.nu" "${@:2}"
             ;;
         *)
-            # All other commands (create, delete, server, taskserv, etc.) - keep stdin open
-            # NOTE: PROVISIONING_MODULE is automatically inherited by Nushell from bash environment
-            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/$RUNNER" $CMD_ARGS
+            # All other commands — provisioning-cli.nu is the single fallback entry.
+            # stdin kept open for interactive commands (delete, update, etc.).
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-cli.nu" $CMD_ARGS
             ;;
         esac
     fi

nulib/clusters/create.nu

@@ -1,5 +1,8 @@
-use lib_provisioning *
-#use ../lib_provisioning/utils/generate.nu *
+# Selective imports replacing `use lib_provisioning *` (ADR-025 Phase 4).
+use lib_provisioning/utils/help.nu [parse_help_command]
+use lib_provisioning/utils/init.nu [provisioning_init]
+use lib_provisioning/utils/interface.nu [_ansi _print desktop_run_notify end_run]
+use lib_provisioning/utils/settings.nu [find_get_settings]
 use utils.nu *
 # Provider middleware now available through lib_provisioning
 
@@ -54,10 +57,10 @@ export def "main create" [
     let other = if ($args | length) > 0 { ($args| skip 1) } else { "" }
     let ops = $"($env.PROVISIONING_ARGS? | default "") " | str replace $"($task) " "" | str trim
     let run_create = {
-        let curr_settings = (find_get_settings --infra $infra --settings $settings)
-        $env.WK_CNPROV = $curr_settings.wk_path
-        let match_name = if $name == null or $name == "" { "" } else { $name}
-        on_clusters $curr_settings $check $wait $outfile $match_name $cluster_pos
+        # on_clusters is not defined anywhere in the codebase; cluster-create via
+        # this entrypoint was dead at runtime. The workflow now lives in
+        # main_provisioning/cluster-deploy.nu (prvng cluster deploy).
+        _print $"(_ansi yellow)cluster create via this command is not wired(_ansi reset) — use 'prvng cluster deploy <layer> <cluster>' instead."
     }
     match $task {
         "" if $name == "h" => {

nulib/clusters/generate.nu

@@ -1,5 +1,8 @@
-use lib_provisioning *
-#use ../lib_provisioning/utils/generate.nu *
+# Selective imports replacing `use lib_provisioning *` (ADR-025 Phase 4).
+use lib_provisioning/utils/help.nu [parse_help_command]
+use lib_provisioning/utils/init.nu [provisioning_init]
+use lib_provisioning/utils/interface.nu [_ansi _print desktop_run_notify end_run]
+use lib_provisioning/utils/settings.nu [find_get_settings]
 use utils.nu *
 # Provider middleware now available through lib_provisioning
 

nulib/clusters/handlers.nu

@@ -1,8 +1,12 @@
+# Selective imports replacing `use lib_provisioning *` (ADR-025 Phase 4).
+use lib_provisioning/config/accessor/functions.nu [get-run-taskservs-path get-taskservs-path]
+use lib_provisioning/utils/hints.nu [show-next-step]
+use lib_provisioning/utils/interface.nu [_ansi _print]
+use lib_provisioning/utils/logging.nu [is-debug-check-enabled is-debug-enabled]
+use lib_provisioning/utils/settings.nu [load]
 use utils.nu *
-use lib_provisioning *
 use run.nu *
 use check_mode.nu *
-use ../lib_provisioning/config/accessor.nu *
 use ../lib_provisioning/utils/hints.nu *
 
 #use ../extensions/taskservs/run.nu run_taskserv

nulib/infras/utils.nu

@@ -1,5 +1,6 @@
-use lib_provisioning *
-use ../lib_provisioning/user/config.nu [get-active-workspace get-workspace-path]
+# Star-import removed (ADR-025 Phase 4). File still invoked by legacy
+# `provisioning infra` runner; proper thin handler refactor pending.
+use lib_provisioning/user/config.nu [get-active-workspace get-workspace-path]
 # Removed broken imports - these modules don't exist
 # use create.nu *
 # use servers/delete.nu *

nulib/lib_provisioning/ai/mod.nu

@@ -1 +1,6 @@
-export use lib.nu *
+# ai/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [
+    get_ai_config is_ai_enabled get_provider_config build_headers build_endpoint
+    ai_request ai_complete ai_generate_template ai_process_query
+    ai_process_webhook validate_ai_config test_ai_connection
+]

nulib/lib_provisioning/cache/agent.nu

@@ -3,10 +3,12 @@
 # Token-optimized agent for progressive version caching with infra-aware hierarchy
 # Usage: nu agent.nu <command> [args]
 
-use cache_manager.nu *
-use version_loader.nu *
-use grace_checker.nu *
-use batch_updater.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# version_loader and grace_checker star-imports were dead — dropped.
+use lib_provisioning/cache/cache_manager.nu [
+    clear-cache-system get-cached-version init-cache-system show-cache-status
+]
+use lib_provisioning/cache/batch_updater.nu [batch-update-cache sync-cache-from-sources]
 
 # Main agent entry point
 def main [

nulib/lib_provisioning/cmd/env.nu

@@ -1,12 +1,9 @@
 
-export-env {
-  use ../config/accessor.nu *
-  use ../utils/logging.nu [is-debug-enabled]
-  use ./lib.nu check_env
-  check_env
-  $env.PROVISIONING_DEBUG = if (is-debug-enabled) {
-    true
-  } else {
-    false
-  }
-}
+# export-env block removed by ADR-025 Phase 3 blocker 4.
+# The former block called check_env (a pre-flight gate) and set $env.PROVISIONING_DEBUG.
+# Nobody imports cmd/env.nu directly; it was only reached via the star-import chain
+# from lib_provisioning/mod.nu. With that chain being emptied, this block would
+# never fire at CLI start anyway. Thin handlers that need the debug flag already
+# set it explicitly via `if $debug { $env.PROVISIONING_DEBUG = true }` — and
+# remaining reads like `if not $env.PROVISIONING_DEBUG { ... }` are gated upstream
+# by the same flag.

nulib/lib_provisioning/cmd/lib.nu

@@ -1,9 +1,9 @@
 
 # Made for prepare and postrun
-use ../config/accessor.nu *
-use ../utils/ui.nu *
-use ../utils/init.nu [get-workspace-path get-provisioning-infra-path]
-use ../sops *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor and utils/ui star-imports were dead — dropped.
+use lib_provisioning/utils/init.nu [get-workspace-path get-provisioning-infra-path]
+use lib_provisioning/sops/lib.nu [find-sops-key on_sops]
 
 export def log_debug [
    msg: string

nulib/lib_provisioning/config/accessor.nu

@@ -1,4 +1,14 @@
 # Configuration Accessor Orchestrator (v2)
 # Re-exports modular accessor components using folder structure
 
-export use ./accessor/mod.nu *
+# Config Accessor orchestrator (ADR-025 Phase 3 Layer 3).
+# Re-exports the selective set declared by accessor/mod.nu (already selective).
+export use ./accessor/mod.nu [
+    config-get get-config get-full-config
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]

nulib/lib_provisioning/config/accessor/functions.nu

@@ -75,3 +75,58 @@ export def get-provisioning-vars [] : nothing -> string {
 export def get-provisioning-wk-env-path [] : nothing -> string {
     $env.PROVISIONING_WK_ENV_PATH? | default ""
 }
+
+# Path to the extensions/providers/ tree. Resolution order:
+# PROVISIONING_PROVIDERS_PATH env → paths.providers config → PROVISIONING/extensions/providers → "".
+# Empty result means "no providers available"; callers must guard with `| is-empty` or `| path exists`.
+export def get-providers-path [] : nothing -> string {
+    let from_env = ($env.PROVISIONING_PROVIDERS_PATH? | default "")
+    if ($from_env | is-not-empty) and ($from_env | path exists) { return $from_env }
+    let configured = (config-get "paths.providers" "")
+    if ($configured | is-not-empty) and ($configured | path exists) { return $configured }
+    let prov = ($env.PROVISIONING? | default "")
+    if ($prov | is-not-empty) {
+        let derived = ($prov | path join "extensions" | path join "providers")
+        if ($derived | path exists) { return $derived }
+    }
+    ""
+}
+
+# Path to the shared provider library (extensions/providers/prov_lib/).
+export def get-prov-lib-path [] : nothing -> string {
+    let providers = (get-providers-path)
+    if ($providers | is-empty) { return "" }
+    $providers | path join "prov_lib"
+}
+
+# Path to provisioning/core/nulib/ from the PROVISIONING root.
+export def get-core-nulib-path [] : nothing -> string {
+    let prov = ($env.PROVISIONING? | default "")
+    if ($prov | is-empty) { return "" }
+    $prov | path join "core" | path join "nulib"
+}
+
+# Directory name where per-provider generated defs live (relative to a provider dir).
+export def get-provisioning-generate-dirpath [] : nothing -> string {
+    $env.PROVISIONING_GENERATE_DIRPATH? | default "generate"
+}
+
+# Filename for per-provider generated defs inside get-provisioning-generate-dirpath.
+export def get-provisioning-generate-defsfile [] : nothing -> string {
+    $env.PROVISIONING_GENERATE_DEFSFILE? | default "defs.ncl"
+}
+
+# Path to the tools required-versions file (nickel/yaml declaring required tool versions).
+# Resolution: PROVISIONING_REQ_VERSIONS env → paths.req_versions config → PROVISIONING/resources/tools.yaml → "".
+export def get-provisioning-req-versions [] : nothing -> string {
+    let from_env = ($env.PROVISIONING_REQ_VERSIONS? | default "")
+    if ($from_env | is-not-empty) and ($from_env | path exists) { return $from_env }
+    let configured = (config-get "paths.req_versions" "")
+    if ($configured | is-not-empty) and ($configured | path exists) { return $configured }
+    let prov = ($env.PROVISIONING? | default "")
+    if ($prov | is-not-empty) {
+        let derived = ($prov | path join "resources" | path join "tools.yaml")
+        if ($derived | path exists) { return $derived }
+    }
+    ""
+}

nulib/lib_provisioning/config/accessor/mod.nu

@@ -57,5 +57,12 @@ export def get-full-config []: nothing -> record {
     load-deployment-mode
 }
 
-# Import specific functions only
-export use ./functions.nu *
+# Selective re-export (ADR-025 Phase 3 Layer 3).
+export use ./functions.nu [
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]

nulib/lib_provisioning/config/accessor_generated.nu

@@ -25,7 +25,16 @@
 # - Design by contract via schema validation
 # - JSON output validation for schema types
 
-use ./accessor.nu *
+# Selective imports — mirror the accessor orchestrator's re-exports (ADR-025 L2).
+use lib_provisioning/config/accessor.nu [
+    config-get get-config get-full-config
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]
 
 export def get-DefaultAIProvider-enable_query_ai [
     --cfg_input: any = null

nulib/lib_provisioning/config/cache/commands.nu

@@ -2,8 +2,9 @@
 # Provides user-facing commands for cache operations and configuration
 # Follows Nushell 0.109.0+ guidelines
 
-use ./core.nu *
-use ./metadata.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# cache/metadata star-import was dead — dropped.
+use lib_provisioning/config/cache/core.nu [cache-clear-type get-cache-stats]
 # Avoid importing all modules - use only what's needed
 # use ./config_manager.nu *
 # use ./nickel.nu *

nulib/lib_provisioning/config/cache/core.nu

@@ -2,7 +2,7 @@
 # Written by ncl-sync daemon; read by this module and nu_plugin_nickel.
 # Single writer principle: Nu NEVER writes to the cache dir directly.
 
-use ./metadata.nu *
+# cache/metadata star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Check if a directory has workspace markers.
 def is-ws-dir [path: string]: nothing -> bool {

nulib/lib_provisioning/config/cache/final.nu

@@ -4,8 +4,9 @@
 # TTL: 5 minutes (short for safety - workspace configs can change)
 # Follows Nushell 0.109.0+ guidelines
 
-use ./core.nu *
-use ./metadata.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# cache/metadata star-import was dead — dropped.
+use lib_provisioning/config/cache/core.nu [cache-clear-type cache-lookup cache-write]
 
 # Helper: Generate cache key for workspace + environment combination
 def compute-final-config-key [

nulib/lib_provisioning/config/cache/mod.nu

@@ -2,8 +2,9 @@
 # Avoids complex re-export patterns that cause Nushell 0.110.0 parser issues
 
 # Import core only - other modules import their dependencies directly
-use ./core.nu *
-use ./metadata.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# cache/metadata star-import was dead — dropped.
+use lib_provisioning/config/cache/core.nu [get-cache-stats]
 
 # Helper: Initialize cache system
 export def init-cache-system [] {

nulib/lib_provisioning/config/cache/sops.nu

@@ -4,8 +4,9 @@
 # TTL: 15 minutes (configurable, balances security and performance)
 # Follows Nushell 0.109.0+ guidelines
 
-use ./core.nu *
-use ./metadata.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# cache/metadata star-import was dead — dropped.
+use lib_provisioning/config/cache/core.nu [cache-clear-type cache-lookup cache-write]
 
 # Helper: Compute hash of SOPS file path
 def compute-sops-hash [file_path: string] {

nulib/lib_provisioning/config/commands.nu

@@ -1,8 +1,13 @@
 # Configuration Encryption CLI Commands
 # Provides user-friendly commands for config encryption operations
 
-use encryption.nu *
-use accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor star-import was dead — dropped.
+use lib_provisioning/config/encryption.nu [
+    contains-sensitive-data decrypt-config edit-encrypted-config
+    encrypt-config encrypt-sensitive-configs is-encrypted-config
+    rotate-encryption-keys scan-unencrypted-configs validate-encryption-config
+]
 
 # Encrypt a configuration file
 export def "config encrypt" [

nulib/lib_provisioning/config/encryption.nu

@@ -3,10 +3,11 @@
 # Optimized with nu_plugin_kms for 10x performance improvement
 
 use std log
-use ../sops/lib.nu *
-use ../kms/lib.nu *
-use ../plugins/kms.nu [plugin-kms-decrypt plugin-kms-encrypt plugin-kms-info]
-use accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor star-import was dead — dropped.
+use lib_provisioning/sops/lib.nu [get-sops-age-key-file is_sops_file on_sops]
+use lib_provisioning/kms/lib.nu [on_kms]
+use lib_provisioning/plugins/kms.nu [plugin-kms-decrypt plugin-kms-encrypt plugin-kms-info]
 
 # Detect if a config file is encrypted
 export def is-encrypted-config [

nulib/lib_provisioning/config/encryption_tests.nu

@@ -2,8 +2,12 @@
 # Comprehensive test suite for encryption functionality
 # Error handling: Guard patterns (no try-catch for field access)
 
-use encryption.nu *
-use ../kms/client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/encryption.nu [
+    contains-sensitive-data decrypt-config decrypt-config-memory encrypt-config
+    is-encrypted-config load-encrypted-config validate-encryption-config
+]
+use lib_provisioning/kms/client.nu [kms-status]
 
 # Test suite runner
 export def run-encryption-tests [

nulib/lib_provisioning/config/interpolation/core.nu

@@ -1,7 +1,7 @@
 # Configuration interpolation - Substitutes variables and patterns in config
 # NUSHELL 0.109 COMPLIANT - Using reduce --fold (Rule 3), do-complete (Rule 5), each (Rule 8)
 
-use ../helpers/environment.nu *
+# helpers/environment star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Main interpolation entry point - interpolates all patterns in configuration
 export def interpolate-config [config: record]: nothing -> record {

nulib/lib_provisioning/config/loader.nu

@@ -1,4 +1,13 @@
 # Configuration Loader Orchestrator (v2)
 # Re-exports modular loader components using folder structure
 
-export use ./loader/mod.nu *
+# Config Loader orchestrator (ADR-025 Phase 3 Layer 3).
+# Re-exports the selective symbol set that loader/mod.nu declares.
+# loader/mod.nu is already selective (14 symbols across 5 files).
+export use ./loader/mod.nu [
+    load-provisioning-config validate-config validate-config-structure
+    validate-data-types validate-file-existence validate-path-values
+    validate-semantic-rules apply-environment-variable-overrides
+    detect-current-environment get-available-environments validate-environment
+    create-interpolation-test-suite test-interpolation get-dag-config
+]

nulib/lib_provisioning/config/loader/core.nu

@@ -3,9 +3,9 @@
 # Dependencies: interpolators, validators, context_manager, sops_handler, cache modules
 
 use std log
-use ../interpolators.nu *
-use ../context_manager.nu *
-use ../sops_handler.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# All 3 star-imports (interpolators, context_manager, sops_handler) were dead
+# in this file (no exported symbols used). Dropped.
 
 # Cache integration - temporarily disabled due to Nushell parser issues
 # use ../cache/core.nu *

nulib/lib_provisioning/config/loader/mod.nu

@@ -2,17 +2,25 @@
 # Purpose: Centralized configuration loading with hierarchical sources, validation, and environment management.
 # Dependencies: interpolators, validators, context_manager, sops_handler, cache modules
 
+# config/loader/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+
 # Core loading functionality
-export use ./core.nu *
+export use ./core.nu [load-provisioning-config]
 
 # Configuration validation
-export use ./validator.nu *
+export use ./validator.nu [
+    validate-config validate-config-structure validate-data-types
+    validate-file-existence validate-path-values validate-semantic-rules
+]
 
 # Environment detection and management
-export use ./environment.nu *
+export use ./environment.nu [
+    apply-environment-variable-overrides detect-current-environment
+    get-available-environments validate-environment
+]
 
 # Testing and interpolation utilities
-export use ./test.nu *
+export use ./test.nu [create-interpolation-test-suite test-interpolation]
 
 # DAG config accessor (execution, resolution, events defaults merged with workspace dag.ncl)
-export use ./dag.nu *
+export use ./dag.nu [get-dag-config]

nulib/lib_provisioning/config/loader/test.nu

@@ -5,8 +5,9 @@
 # Configuration Loader - Testing and Interpolation Functions
 # Provides testing utilities for configuration loading and interpolation
 
-use ../interpolators.nu *
-use ../validators.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/interpolators star-import was dead — dropped.
+use lib_provisioning/config/validators.nu [validate-interpolation]
 
 # Test interpolation with sample data
 export def test-interpolation [

nulib/lib_provisioning/config/mod.nu

@@ -5,15 +5,75 @@
 # Configuration System Module Index
 # Central import point for the new configuration system
 
-# Core configuration functionality
-export use loader.nu *
-export use accessor.nu *
-export use accessor_generated.nu *  # Schema-driven generated accessors
-export use migration.nu *
+# config/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+
+# loader.nu and accessor.nu are 1-line orchestrators that star-re-export their
+# own accessor/mod.nu and loader/mod.nu subtrees. They remain as star re-exports
+# here because flattening them requires refactoring the loader/ and accessor/
+# subsystems first (Phase 3 next pass). Transitivity will be restored at that
+# point; for now, document the exception.
+export use loader.nu *    # orchestrator → loader/mod.nu (pending flatten)
+export use accessor.nu *  # orchestrator → accessor/mod.nu (pending flatten)
+
+# Schema-driven generated accessors (80 get-* auto-generated functions)
+export use accessor_generated.nu [
+    get-DefaultAIProvider-enable_query_ai get-DefaultAIProvider-enable_template_ai
+    get-DefaultAIProvider-enable_webhook_ai get-DefaultAIProvider-enabled
+    get-DefaultAIProvider-max_tokens get-DefaultAIProvider-provider
+    get-DefaultAIProvider-temperature get-DefaultAIProvider-timeout
+    get-DefaultKmsConfig-auth_method get-DefaultKmsConfig-server_url
+    get-DefaultKmsConfig-timeout get-DefaultKmsConfig-verify_ssl
+    get-DefaultRunSet-inventory_file get-DefaultRunSet-output_format
+    get-DefaultRunSet-output_path get-DefaultRunSet-use_time get-DefaultRunSet-wait
+    get-defaults-ai_provider-enable_query_ai get-defaults-ai_provider-enable_template_ai
+    get-defaults-ai_provider-enable_webhook_ai get-defaults-ai_provider-enabled
+    get-defaults-ai_provider-max_tokens get-defaults-ai_provider-provider
+    get-defaults-ai_provider-temperature get-defaults-ai_provider-timeout
+    get-defaults-kms_config-auth_method get-defaults-kms_config-server_url
+    get-defaults-kms_config-timeout get-defaults-kms_config-verify_ssl
+    get-defaults-run_set-inventory_file get-defaults-run_set-output_format
+    get-defaults-run_set-output_path get-defaults-run_set-use_time
+    get-defaults-run_set-wait get-defaults-secret_provider-provider
+    get-defaults-settings-cluster_admin_host get-defaults-settings-cluster_admin_port
+    get-defaults-settings-cluster_admin_user get-defaults-settings-clusters_paths
+    get-defaults-settings-clusters_save_path get-defaults-settings-created_clusters_dirpath
+    get-defaults-settings-created_taskservs_dirpath get-defaults-settings-defaults_provs_dirpath
+    get-defaults-settings-defaults_provs_suffix get-defaults-settings-main_name
+    get-defaults-settings-main_title get-defaults-settings-prov_clusters_path
+    get-defaults-settings-prov_data_dirpath get-defaults-settings-prov_data_suffix
+    get-defaults-settings-prov_local_bin_path get-defaults-settings-prov_resources_path
+    get-defaults-settings-servers_paths get-defaults-settings-servers_wait_started
+    get-defaults-settings-settings_path get-defaults-sops_config-use_age
+    get-DefaultSecretProvider-provider get-DefaultSettings-cluster_admin_host
+    get-DefaultSettings-cluster_admin_port get-DefaultSettings-cluster_admin_user
+    get-DefaultSettings-clusters_paths get-DefaultSettings-clusters_save_path
+    get-DefaultSettings-created_clusters_dirpath get-DefaultSettings-created_taskservs_dirpath
+    get-DefaultSettings-defaults_provs_dirpath get-DefaultSettings-defaults_provs_suffix
+    get-DefaultSettings-main_name get-DefaultSettings-main_title
+    get-DefaultSettings-prov_clusters_path get-DefaultSettings-prov_data_dirpath
+    get-DefaultSettings-prov_data_suffix get-DefaultSettings-prov_local_bin_path
+    get-DefaultSettings-prov_resources_path get-DefaultSettings-servers_paths
+    get-DefaultSettings-servers_wait_started get-DefaultSettings-settings_path
+    get-DefaultSopsConfig-use_age
+]
+export use migration.nu [
+    analyze-current-env backup-current-env check-migration-issues
+    generate-user-config get-env-mapping show-migration-status
+]
 
 # Encryption functionality
-export use encryption.nu *
-export use commands.nu *
+export use encryption.nu [
+    contains-sensitive-data decrypt-config decrypt-config-memory
+    edit-encrypted-config encrypt-config encrypt-sensitive-configs
+    is-encrypted-config load-encrypted-config main rotate-encryption-keys
+    scan-unencrypted-configs validate-encryption-config
+]
+export use commands.nu [
+    "config decrypt" "config edit-secure" "config encrypt" "config encrypt-all"
+    "config encryption-info" "config init-encryption" "config is-encrypted"
+    "config rotate-keys" "config scan-sensitive" "config validate-encryption"
+    main
+]
 
 # Convenience function to get the complete configuration
 # Use as: `use config; config` or `config main`

nulib/lib_provisioning/coredns/api_client.nu

@@ -1,8 +1,8 @@
 # CoreDNS API Client
 # Client for orchestrator DNS API endpoints
 
-use ../utils/log.nu *
-use ../config/loader.nu get-config
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/config/loader.nu [get-config]
 
 # Call orchestrator DNS API
 export def call-dns-api [

nulib/lib_provisioning/coredns/commands.nu

@@ -1,11 +1,19 @@
 # CoreDNS CLI Commands
 # User-facing commands for DNS management
 
-use ../utils/log.nu *
-use ../config/loader.nu get-config
-use service.nu *
-use zones.nu *
-use corefile.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# ../utils/log.nu was a broken import (file does not exist) — removed.
+# ../utils/logging.nu star-import was dead — dropped.
+use lib_provisioning/config/loader.nu [get-config]
+use lib_provisioning/coredns/service.nu [
+    check-coredns-health get-coredns-status install-coredns reload-coredns
+    restart-coredns show-coredns-logs start-coredns stop-coredns
+]
+use lib_provisioning/coredns/zones.nu [
+    add-a-record add-aaaa-record add-cname-record add-mx-record add-txt-record
+    create-zone-file list-zone-records remove-record validate-zone-file
+]
+use lib_provisioning/coredns/corefile.nu [update-corefile validate-corefile]
 
 # DNS service status
 export def "dns status" [] {

nulib/lib_provisioning/coredns/corefile.nu

@@ -1,7 +1,7 @@
 # CoreDNS Corefile Generator
 # Generates and manages Corefile configuration for CoreDNS
 
-use ../utils/log.nu *
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
 
 # Generate Corefile from configuration
 export def generate-corefile [

nulib/lib_provisioning/coredns/docker.nu

@@ -1,8 +1,8 @@
 # CoreDNS Docker Management
 # Manage CoreDNS in Docker containers using docker-compose
 
-use ../utils/log.nu *
-use corefile.nu [generate-corefile write-corefile]
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-corefile write-corefile]
 use zones.nu create-zone-file
 
 # Start CoreDNS Docker container

nulib/lib_provisioning/coredns/service.nu

@@ -1,8 +1,8 @@
 # CoreDNS Service Manager
 # Start, stop, and manage CoreDNS service
 
-use ../utils/log.nu *
-use corefile.nu [generate-corefile write-corefile]
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-corefile write-corefile]
 use zones.nu create-zone-file
 
 # Start CoreDNS service

nulib/lib_provisioning/coredns/zones.nu

@@ -1,8 +1,8 @@
 # CoreDNS Zone File Management
 # Create, update, and manage DNS zone files
 
-use ../utils/log.nu *
-use corefile.nu generate-zone-file
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-zone-file]
 
 # Create zone file with SOA and NS records
 export def create-zone-file [

nulib/lib_provisioning/defs/lists.nu

@@ -1,6 +1,6 @@
 
-use ../config/accessor.nu *
-use ../utils/on_select.nu run_on_selection
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/on_select.nu [run_on_selection]
 export def get_provisioning_info [
     dir_path: string
     target: string

nulib/lib_provisioning/defs/mod.nu

@@ -1,3 +1,7 @@
-export use about.nu *
-export use lists.nu *
+# defs/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use about.nu [about_info]
+export use lists.nu [
+    cluster_list get_provisioning_info infras_list on_list
+    providers_list taskservs_list
+]
 # export use settings.nu *

nulib/lib_provisioning/dependencies/mod.nu

@@ -2,4 +2,8 @@
 # Unified exports for dependency resolution functionality
 # Version: 1.0.0
 
-export use resolver.nu *
+# dependencies/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use resolver.nu [
+    check-dependency-updates init-cache install-dependency load-repositories
+    resolve-dependency resolve-extension-deps validate-dependency-graph
+]

nulib/lib_provisioning/dependencies/resolver.nu

@@ -2,8 +2,8 @@
 # Handles dependency resolution across multiple repositories with OCI support
 # Version: 1.0.0
 
-use ../config/loader.nu get-config
-use ../oci/client.nu *
+# oci/client star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/loader.nu [get-config]
 use std log
 
 # Dependency resolution cache

nulib/lib_provisioning/deploy.nu

@@ -5,8 +5,9 @@
 # Features: Regional health checks, VPN tunnels, global DNS, failover configuration
 # Error handling: Result pattern (hybrid, no inline try-catch)
 
-use lib_provisioning/result.nu *
-use ./utils/nickel_processor.nu [ncl-eval-soft]
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/result.nu [bash-wrap err is-err is-ok match-result ok try-wrap]
+use lib_provisioning/utils/nickel_processor.nu [ncl-eval-soft]
 
 def main [--debug: bool = false, --region: string = "all"] {
   print "🌍 Multi-Region High Availability Deployment"

nulib/lib_provisioning/diagnostics/health_check.nu

@@ -2,8 +2,9 @@
 # Deep health validation for provisioning platform configuration and state
 
 use std log
-use ../config/accessor.nu *
-use ../user/config.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
+use lib_provisioning/user/config.nu [get-user-config-path load-user-config]
 
 # Check health of configuration files
 def check-config-files [] {

nulib/lib_provisioning/diagnostics/mod.nu

@@ -1,6 +1,9 @@
 # Diagnostics Module
 # Comprehensive system diagnostics and health monitoring
 
-export use system_status.nu *
-export use health_check.nu *
-export use next_steps.nu *
+# diagnostics/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+# All 3 files export multi-word Nu subcommands ("provisioning status", etc.).
+
+export use system_status.nu ["provisioning status" "provisioning status-json"]
+export use health_check.nu ["provisioning health" "provisioning health-json"]
+export use next_steps.nu ["provisioning next" "provisioning phase"]

nulib/lib_provisioning/diagnostics/next_steps.nu

@@ -2,8 +2,9 @@
 # Provides intelligent next-step suggestions based on current system state
 
 use std log
-use ../config/accessor.nu *
-use ../user/config.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor star-import was dead — dropped.
+use lib_provisioning/user/config.nu [load-user-config]
 
 # Determine current deployment phase
 def get-deployment-phase [] {

nulib/lib_provisioning/diagnostics/system_status.nu

@@ -2,9 +2,10 @@
 # Provides comprehensive system status checks for provisioning platform
 
 use std log
-use ../config/accessor.nu *
-use ../user/config.nu *
-use ../plugins/mod.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# plugins/mod.nu star-import was dead — dropped.
+use lib_provisioning/config/accessor/core.nu [config-get]
+use lib_provisioning/user/config.nu [load-user-config]
 
 # Check Nushell version meets requirements
 def check-nushell-version [] {

nulib/lib_provisioning/extensions/commands.nu

@@ -1,10 +1,11 @@
 # Extension Management CLI Commands
 
-use loader_oci.nu load-extension
-use cache.nu *
-use discovery.nu *
-use versions.nu *
-use ../utils/logging.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# cache.nu, versions.nu and utils/logging.nu star-imports were dead — dropped.
+use lib_provisioning/extensions/loader_oci.nu [load-extension]
+use lib_provisioning/extensions/discovery.nu [
+    discover-all-extensions get-extension-versions list-extensions search-extensions
+]
 
 # Load extension from any source
 export def "ext load" [

nulib/lib_provisioning/extensions/discovery.nu

@@ -5,9 +5,13 @@
 # Extension Discovery and Search
 # Discovers extensions across OCI registries, Gitea, and local sources
 
-use ../utils/logging.nu *
-use ../oci/client.nu *
-use versions.nu [is-semver, sort-by-semver, get-latest-version]
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/logging.nu [log-debug log-error log-info]
+use lib_provisioning/oci/client.nu [
+    get-oci-config is-oci-available load-oci-token oci-get-artifact-manifest
+    oci-get-artifact-tags oci-list-artifacts
+]
+use lib_provisioning/extensions/versions.nu [is-semver sort-by-semver get-latest-version]
 
 # Discover extensions in OCI registry
 export def discover-oci-extensions [

nulib/lib_provisioning/extensions/loader.nu

@@ -4,7 +4,7 @@
 
 # Extension Loader
 # Discovers and loads extensions from multiple sources
-use ../config/accessor.nu *
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Extension discovery paths in priority order
 export def get-extension-paths [] {

nulib/lib_provisioning/extensions/loader_oci.nu

@@ -1,11 +1,14 @@
 # OCI-Aware Extension Loader
 # Loads extensions from multiple sources: OCI, Gitea, Local
 
-use ../config/accessor.nu *
-use ../utils/logging.nu *
-use ../oci/client.nu *
-use cache.nu *
-use loader.nu [load-manifest, is-extension-allowed, check-requirements, load-hooks]
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor and extensions/cache star-imports were dead — dropped.
+use lib_provisioning/utils/logging.nu [log-debug log-error log-info]
+use lib_provisioning/oci/client.nu [
+    get-oci-config is-oci-available load-oci-token oci-artifact-exists
+    oci-get-artifact-manifest oci-get-artifact-tags oci-pull-artifact
+]
+use lib_provisioning/extensions/loader.nu [load-manifest is-extension-allowed check-requirements load-hooks]
 
 # Check if extension is already loaded (in memory)
 def is-loaded [extension_type: string, extension_name: string] {

nulib/lib_provisioning/extensions/mod.nu

@@ -1,11 +1,38 @@
 # Extensions Module
 # Provides extension system functionality
 
-export use loader.nu *
-export use registry.nu *
-export use profiles.nu *
-export use loader_oci.nu *
-export use cache.nu *
-export use versions.nu *
-export use discovery.nu *
-export use commands.nu *
+# extensions/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+
+export use loader.nu [
+    check-requirements discover-providers discover-taskservs
+    get-extension-paths is-extension-allowed load-hooks load-manifest
+]
+export use registry.nu [
+    execute-hooks get-default-registry get-provider get-taskserv
+    get-taskserv-path init-registry list-providers list-taskservs
+    load-registry provider-exists save-registry taskserv-exists
+]
+export use profiles.nu [
+    create-example-profiles enforce-profile is-command-allowed
+    is-provider-allowed is-taskserv-allowed load-profile show-profile
+]
+export use loader_oci.nu [load-extension]
+export use cache.nu [
+    hetzner_cache_age hetzner_cache_valid hetzner_clean_all_cache
+    hetzner_clean_cache hetzner_create_cache hetzner_ip_from_cache
+    hetzner_read_cache hetzner_start_cache_info hetzner_update_cache
+]
+export use versions.nu [
+    compare-semver get-latest-version is-semver resolve-gitea-version
+    resolve-oci-version resolve-version satisfies-constraint sort-by-semver
+]
+export use discovery.nu [
+    discover-all-extensions discover-local-extensions discover-oci-extensions
+    get-extension-versions get-oci-extension-metadata list-extensions
+    search-extensions search-oci-extensions
+]
+export use commands.nu [
+    "ext cache clear" "ext cache list" "ext cache prune" "ext cache stats"
+    "ext discover" "ext info" "ext list" "ext load" "ext publish"
+    "ext pull" "ext search" "ext test-oci" "ext versions"
+]

nulib/lib_provisioning/extensions/profiles.nu

@@ -1,6 +1,6 @@
 # Profile-based Access Control
 # Implements permission system for restricted environments like CI/CD
-use ../config/accessor.nu *
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Load profile configuration
 export def load-profile [profile_name?: string] {

nulib/lib_provisioning/extensions/registry.nu

@@ -1,8 +1,9 @@
 # Extension Registry
 # Manages registration and lookup of providers, taskservs, and hooks
 
-use ../config/accessor.nu *
-use loader.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor star-import was dead — dropped.
+use lib_provisioning/extensions/loader.nu [discover-providers discover-taskservs]
 
 # Get default extension registry
 export def get-default-registry [] {

nulib/lib_provisioning/extensions/tests/test_cache.nu

@@ -1,8 +1,9 @@
 #!/usr/bin/env nu
 # Tests for Extension Cache Module
 
-use ../cache.nu *
-use ../../utils/logger.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# extensions/cache star-import was dead (no used symbols in this test).
+# utils/logger.nu does not exist — dangling import removed.
 
 # Test cache directory creation
 export def test_cache_dir [] {

nulib/lib_provisioning/extensions/tests/test_discovery.nu

@@ -1,8 +1,12 @@
 #!/usr/bin/env nu
 # Tests for Extension Discovery Module
 
-use ../discovery.nu *
-use ../../utils/logger.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# utils/logger.nu does not exist — dangling import removed.
+use lib_provisioning/extensions/discovery.nu [
+    discover-local-extensions discover-oci-extensions get-extension-versions
+    list-extensions search-extensions
+]
 
 # Test local extension discovery
 export def test_discover_local [] {

nulib/lib_provisioning/extensions/tests/test_oci_client.nu

@@ -1,8 +1,11 @@
 #!/usr/bin/env nu
 # Tests for OCI Client Module
 
-use ../../oci/client.nu *
-use ../../utils/logger.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# utils/logger.nu does not exist — dangling import removed.
+use lib_provisioning/oci/client.nu [
+    build-artifact-ref get-oci-config is-oci-available test-oci-connection
+]
 
 # Test OCI configuration loading
 export def test_oci_config [] {

nulib/lib_provisioning/extensions/tests/test_versions.nu

@@ -1,7 +1,10 @@
 #!/usr/bin/env nu
 # Tests for Version Resolution Module
 
-use ../versions.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/extensions/versions.nu [
+    compare-semver get-latest-version is-semver satisfies-constraint sort-by-semver
+]
 
 # Test semver validation
 export def test_is_semver [] {

nulib/lib_provisioning/extensions/versions.nu

@@ -1,8 +1,11 @@
 # Extension Version Resolution
 # Resolves versions from OCI tags, Gitea releases, and local sources
 
-use ../utils/logging.nu *
-use ../oci/client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/logging.nu [log-debug log-error]
+use lib_provisioning/oci/client.nu [
+    get-oci-config is-oci-available load-oci-token oci-get-artifact-tags
+]
 
 # Resolve version from version specification
 export def resolve-version [

nulib/lib_provisioning/gitea/commands.nu

@@ -4,11 +4,25 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
-use service.nu *
-use workspace_git.nu *
-use locking.nu *
-use extension_publish.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# workspace_git.nu star-import was dead (no symbols used here) — dropped.
+use lib_provisioning/gitea/api_client.nu [
+    create-organization create-repository delete-repository get-current-user
+    get-gitea-config list-organizations list-repositories
+    list-user-repositories validate-token
+]
+use lib_provisioning/gitea/service.nu [
+    check-gitea-health get-gitea-logs get-gitea-status install-gitea
+    restart-gitea start-gitea stop-gitea stop-gitea-docker
+]
+use lib_provisioning/gitea/locking.nu [
+    acquire-workspace-lock cleanup-expired-locks force-release-lock
+    get-lock-info list-all-locks list-workspace-locks release-workspace-lock
+]
+use lib_provisioning/gitea/extension_publish.nu [
+    download-gitea-extension get-gitea-extension-metadata
+    list-gitea-extensions publish-extension-to-gitea
+]
 
 # Gitea service status
 export def "gitea status" [] -> nothing {

nulib/lib_provisioning/gitea/extension_publish.nu

@@ -4,8 +4,12 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
-use ../config/loader.nu get-config
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [
+    create-release create-repository get-gitea-config get-gitea-token
+    get-release-by-tag get-repository list-releases upload-release-asset
+]
+use lib_provisioning/config/loader.nu [get-config]
 
 # Validate extension structure
 def validate-extension [

nulib/lib_provisioning/gitea/locking.nu

@@ -4,7 +4,11 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [
+    close-issue create-issue create-repository get-current-user
+    get-gitea-config get-issue get-repository list-issues
+]
 
 # Lock label constants
 const LOCK_LABEL_PREFIX = "workspace-lock"

nulib/lib_provisioning/gitea/mod.nu

@@ -4,10 +4,45 @@
 #
 # Version: 1.0.0
 
-# Export all submodules
-export use api_client.nu *
-export use service.nu *
-export use workspace_git.nu *
-export use locking.nu *
-export use extension_publish.nu *
-export use commands.nu *
+# gitea/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+
+export use api_client.nu [
+    close-issue create-branch create-issue create-organization create-release
+    create-repository create-tag delete-release delete-repository get-api-url
+    get-branch get-current-user get-gitea-config get-gitea-token get-issue
+    get-organization get-release-by-tag get-repository gitea-api-call
+    list-branches list-issues list-organizations list-releases list-repositories
+    list-tags list-user-repositories upload-release-asset validate-token
+]
+export use service.nu [
+    check-gitea-health get-gitea-logs get-gitea-status install-gitea
+    restart-gitea start-gitea start-gitea-binary start-gitea-docker
+    stop-gitea stop-gitea-docker
+]
+export use workspace_git.nu [
+    clone-workspace create-workspace-branch create-workspace-repo
+    delete-workspace-branch get-workspace-diff get-workspace-git-status
+    get-workspace-remote-info has-uncommitted-changes init-workspace-git
+    list-workspace-branches list-workspace-stashes pop-workspace-stash
+    pull-workspace push-workspace stash-workspace-changes
+    switch-workspace-branch sync-workspace
+]
+export use locking.nu [
+    acquire-workspace-lock cleanup-expired-locks force-release-lock
+    get-lock-info is-workspace-locked list-all-locks list-workspace-locks
+    release-workspace-lock with-workspace-lock
+]
+export use extension_publish.nu [
+    download-gitea-extension get-gitea-extension-metadata
+    get-latest-extension-version list-gitea-extensions
+    publish-extension-to-gitea publish-extensions-batch
+]
+export use commands.nu [
+    "gitea auth validate" "gitea extension download" "gitea extension info"
+    "gitea extension list" "gitea extension publish" "gitea help"
+    "gitea install" "gitea lock acquire" "gitea lock cleanup"
+    "gitea lock force-release" "gitea lock info" "gitea lock list"
+    "gitea lock release" "gitea logs" "gitea org create" "gitea org list"
+    "gitea repo create" "gitea repo delete" "gitea repo list"
+    "gitea restart" "gitea start" "gitea status" "gitea stop" "gitea user"
+]

nulib/lib_provisioning/gitea/workspace_git.nu

@@ -4,7 +4,8 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [create-repository get-gitea-config get-repository]
 
 # Initialize workspace as git repository
 export def init-workspace-git [

nulib/lib_provisioning/infra_validator/agent_interface.nu

@@ -2,8 +2,9 @@
 # Provides programmatic interface for automated infrastructure validation and fixing
 # Error handling: Guard patterns (no try-catch for field access)
 
-use validator.nu
-use report_generator.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# report_generator star-import was dead — dropped.
+use lib_provisioning/infra_validator/validator.nu
 
 # Main function for AI agents to validate infrastructure
 export def validate_for_agent [

nulib/lib_provisioning/infra_validator/rules_engine.nu

@@ -2,7 +2,10 @@
 # Defines and manages validation rules for infrastructure configurations
 # Error handling: Guard patterns (no try-catch for field access)
 
-use config_loader.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/infra_validator/config_loader.nu [
+    create_rule_context load_rules_from_config load_validation_config
+]
 
 # Main function to get all validation rules (now config-driven)
 export def get_all_validation_rules [

nulib/lib_provisioning/integrations/ecosystem/mod.nu

@@ -1,8 +1,27 @@
 # Ecosystem Integrations Module
 # Re-exports all ecosystem integration providers: backup, runtime, SSH, GitOps, service management
 
-use ./runtime.nu *
-use ./backup.nu *
-use ./ssh_advanced.nu *
-use ./gitops.nu *
-use ./service.nu *
+# ecosystem/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+# Former `use ./X *` was a no-op (not `export use`), so no symbols were actually
+# propagated to integrations/mod.nu. Converted to `export use` + selective so the
+# facade behaves as its comment claims.
+
+export use ./runtime.nu [
+    runtime-compose runtime-detect runtime-exec runtime-info runtime-list
+]
+export use ./backup.nu [
+    backup-create backup-list backup-restore backup-retention
+    backup-schedule backup-status
+]
+export use ./ssh_advanced.nu [
+    ssh-circuit-breaker-status ssh-deployment-strategies ssh-pool-connect
+    ssh-pool-exec ssh-pool-status ssh-retry-config
+]
+export use ./gitops.nu [
+    gitops-deployments gitops-event-types gitops-rule-config gitops-rules
+    gitops-status gitops-trigger gitops-watch
+]
+export use ./service.nu [
+    service-detect-init service-install service-list service-restart
+    service-restart-policy service-start service-status service-stop
+]

nulib/lib_provisioning/integrations/iac/mod.nu

@@ -1,4 +1,10 @@
 # IaC Orchestrator Integration Module
 # Provides Infrastructure-from-Code to orchestrator conversion utilities
 
-use iac_orchestrator *
+# iac/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+# Former `use iac_orchestrator *` was broken (missing `./` prefix and plain use
+# instead of export use — facade wasn't actually re-exporting).
+export use ./iac_orchestrator.nu [
+    iac-to-workflow export-workflow-nickel submit-to-orchestrator
+    monitor-workflow orchestrate-from-iac
+]

nulib/lib_provisioning/integrations/mod.nu

@@ -3,8 +3,8 @@
 # - Ecosystem: External integrations (backup, runtime, SSH, GitOps, service)
 # - IaC: Infrastructure-from-Code to orchestrator conversion
 
-# Re-export ecosystem integrations
-use ./ecosystem *
-
-# Re-export IaC orchestrator integration
-use ./iac *
+# integrations/ facade — selective re-exports via child facades (ADR-025 L3).
+# Both children (ecosystem/mod.nu, iac/mod.nu) are already selective, so this
+# facade can re-export their full API without multiplying stars.
+export use ./ecosystem *
+export use ./iac *

nulib/lib_provisioning/kms/client.nu

@@ -3,10 +3,10 @@
 # Prioritizes plugin-based implementations for 10x performance improvement
 
 use std log
-use ../config/accessor.nu *
-use ../utils/error.nu throw-error
-use ../utils/interface.nu _print
-use ../plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-status plugin-kms-info]
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/error.nu [throw-error]
+use lib_provisioning/utils/interface.nu [_print]
+use lib_provisioning/plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-status plugin-kms-info]
 
 # KMS Client for encryption/decryption operations
 export def kms-encrypt [

nulib/lib_provisioning/kms/lib.nu

@@ -1,8 +1,8 @@
 use std
-use ../config/accessor.nu *
-use ../utils/error.nu throw-error
-use ../utils/interface.nu _print
-use ../plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-info]
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/error.nu [throw-error]
+use lib_provisioning/utils/interface.nu [_print]
+use lib_provisioning/plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-info]
 
 def find_file [
     start_path: string

nulib/lib_provisioning/kms/mod.nu

@@ -1,2 +1,3 @@
-export use lib.nu *
-export use client.nu *
+# kms/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [decode_kms_file get_def_kms_config is_kms_file on_kms run_cmd_kms]
+export use client.nu [kms-decrypt kms-encrypt kms-list-backends kms-status kms-test main]

nulib/lib_provisioning/layers/resolver.nu

@@ -3,9 +3,12 @@
 # Layered Module Resolver
 # Provides unified resolution across 3 layers: System → Workspace → Infrastructure
 
-use ../../taskservs/discover.nu *
-use ../../providers/discover.nu *
-use ../../clusters/discover.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# discover.nu files live at core/nulib/{taskservs,providers,clusters}/ — outside
+# lib_provisioning/. Absolute paths from nulib/ root used.
+use taskservs/discover.nu [discover-taskservs get-taskserv-info]
+use providers/discover.nu [discover-providers get-provider-info]
+use clusters/discover.nu [discover-clusters get-cluster-info]
 
 # Resolve module path with layer information
 # Returns: {path: string, layer: string, name: string, type: string, found: bool}

nulib/lib_provisioning/mod.nu

@@ -1,19 +0,0 @@
-
-export use plugins_defs.nu *
-export use utils *
-#export use cmd *
-export use defs *
-export use sops *
-export use kms *
-export use secrets *
-export use ai *
-export use context.nu *
-export use setup *
-#export use deploy.nu *
-export use extensions *
-export use providers.nu *
-export use workspace *
-export use config *
-export use diagnostics *
-#export use tera_daemon *
-#export use fluent_daemon *

nulib/lib_provisioning/mode/commands.nu

@@ -7,7 +7,7 @@
 #   - cicd: CI/CD pipeline execution
 #   - enterprise: Production enterprise deployment
 
-use ../utils/logging.nu *
+# utils/logging star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Get current active mode
 export def "mode current" [] -> record {

nulib/lib_provisioning/mode/mod.nu

@@ -1,5 +1,9 @@
 # Mode System Module
 # Execution mode management for provisioning system
 
-export use commands.nu *
-export use validator.nu *
+# mode/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use commands.nu [
+    "mode compare" "mode current" "mode init" "mode list"
+    "mode oci-registry" "mode show" "mode switch" "mode validate"
+]
+export use validator.nu [check-runtime-requirements validate-mode-config]

nulib/lib_provisioning/mode/validator.nu

@@ -1,7 +1,7 @@
 # Mode Configuration Validator
 # Validates mode configurations against Nickel schemas and runtime requirements
 
-use ../utils/logging.nu *
+# utils/logging star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Validate complete mode configuration
 export def validate-mode-config [

nulib/lib_provisioning/module_loader.nu

@@ -4,9 +4,9 @@
 # Author: JesusPerezLorenzo
 # Date: 2025-09-29
 
-use config/accessor.nu *
-use config/cache/simple-cache.nu *
-use utils *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/cache/simple-cache.nu and utils/ star-imports were dead — dropped.
+use lib_provisioning/config/accessor/core.nu [config-get get-config]
 
 # Discover Nickel modules from extensions (providers, taskservs, clusters)
 export def "discover-nickel-modules" [

nulib/lib_provisioning/oci/client.nu

@@ -1,8 +1,9 @@
 # OCI Registry Client
 # Handles OCI artifact operations (pull, push, list, search)
 
-use ../config/accessor.nu *
-use ../utils/logging.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# config/accessor star-import was dead — dropped.
+use lib_provisioning/utils/logging.nu [log-debug log-error log-info]
 
 # OCI client configuration
 export def get-oci-config [] {

nulib/lib_provisioning/oci/commands.nu

@@ -2,9 +2,16 @@
 # User-facing commands for OCI artifact management
 # Version: 1.0.0
 
-use ../config/loader.nu get-config
-use ./client.nu *
+use lib_provisioning/config/loader.nu [get-config]
+# Selective oci client imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/oci/client.nu [
+    build-artifact-ref get-oci-config is-oci-available load-oci-token
+    oci-artifact-exists oci-delete-artifact oci-get-artifact-manifest
+    oci-get-artifact-tags oci-list-artifacts oci-pull-artifact
+    oci-push-artifact test-oci-connection
+]
 use std log
+# Former duplicate `use ./client.nu *` removed — replaced by selective above.
 
 # Pull OCI artifact to local cache
 export def "oci pull" [

nulib/lib_provisioning/oci/mod.nu

@@ -2,5 +2,14 @@
 # Unified exports for OCI functionality
 # Version: 1.0.0
 
-export use client.nu *
-export use commands.nu *
+# oci/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use client.nu [
+    build-artifact-ref get-oci-config is-oci-available load-oci-token
+    oci-artifact-exists oci-delete-artifact oci-get-artifact-manifest
+    oci-get-artifact-tags oci-list-artifacts oci-pull-artifact
+    oci-push-artifact test-oci-connection
+]
+export use commands.nu [
+    "oci config" "oci copy" "oci delete" "oci inspect" "oci list"
+    "oci login" "oci logout" "oci pull" "oci push" "oci search" "oci tags"
+]

nulib/lib_provisioning/oci_registry/mod.nu

@@ -4,7 +4,13 @@ export module commands.nu
 export module service.nu
 
 # Re-export main commands
-export use commands.nu *
+export use commands.nu [
+    "oci-registry configure" "oci-registry health" "oci-registry init"
+    "oci-registry logs" "oci-registry namespace create"
+    "oci-registry namespace delete" "oci-registry namespaces"
+    "oci-registry start" "oci-registry status" "oci-registry stop"
+    "oci-registry test-pull" "oci-registry test-push"
+]
 export use service.nu [
     start-oci-registry
     stop-oci-registry

nulib/lib_provisioning/packaging.nu

@@ -3,8 +3,9 @@
 # Author: JesusPerezLorenzo
 # Date: 2025-09-29
 
-use config/accessor.nu *
-use utils *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# utils/ star-import was dead — dropped.
+use lib_provisioning/config/accessor/core.nu [get-config]
 
 # Package core provisioning Nickel schemas
 export def "pack-core" [

nulib/lib_provisioning/platform/activation.nu

@@ -1,7 +1,7 @@
 # Platform Services Activation
 # Integration point for validating and connecting to platform services during workspace activation
 
-use target.nu *
+# platform/target star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Activate platform services for workspace
 export def activate-workspace-platform [

nulib/lib_provisioning/platform/autostart.nu

@@ -1,7 +1,8 @@
 # Platform Service Auto-Start
 
-use target.nu *
-use health.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/platform/target.nu [get-deployment-service-config get-enabled-services]
+use lib_provisioning/platform/health.nu [check-service-health]
 
 # Get binary name from service name
 def get-binary-name [service: string] {

nulib/lib_provisioning/platform/bootstrap.nu

@@ -2,14 +2,15 @@
 # Ensures critical platform services are running before executing provisioning tasks
 # Infrastructure-agnostic: supports Docker, Kubernetes, remote servers, etc.
 
-use ../config/accessor.nu *
-use ../config/context_manager.nu [get-active-workspace]
-use ../setup/mod.nu [get-config-base-path]
-use ../utils/logging.nu *
-use ../utils/nickel_processor.nu [ncl-eval-soft]
-use ../services/health.nu *
-use ../services/lifecycle.nu *
-use ../services/dependencies.nu *
+# Selective imports — absolute paths (ADR-025 Phase 3 Layer 2).
+# 5 former star-imports reduced to 2 selective imports. The other 3
+# (utils/logging.nu, services/lifecycle.nu, services/dependencies.nu) had
+# zero used symbols in this file — they were dead imports.
+use lib_provisioning/config/accessor/core.nu [config-get]
+use lib_provisioning/config/context_manager.nu [get-active-workspace]
+use lib_provisioning/setup/mod.nu [get-config-base-path]
+use lib_provisioning/utils/nickel_processor.nu [ncl-eval-soft]
+use lib_provisioning/services/health.nu [wait-for-service]
 
 # Load service deployment configuration
 def get-service-config [service_name: string] {

nulib/lib_provisioning/platform/cli.nu

@@ -1,11 +1,11 @@
 # Platform Services CLI Commands
 # User-facing commands for managing platform services
 
-use target.nu *
-use discovery.nu *
-use health.nu *
-use autostart.nu *
-use connection.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/platform/health.nu [check-all-services check-required-services]
+use lib_provisioning/platform/discovery.nu [list-services]
+use lib_provisioning/platform/autostart.nu [start-required-services]
+use lib_provisioning/platform/connection.nu [init-connection-metadata show-connection-status]
 
 # Show platform status
 export def platform-status [] {
@@ -29,34 +29,15 @@ export def platform-status [] {
 }
 
 # Show platform configuration
+# load-platform-target is not defined anywhere in the codebase; this function
+# was dead at runtime. Falls back to a clear "not configured" message.
 export def platform-config [] {
     print ""
     print "Platform Configuration"
     print "====================="
     print ""
-
-    let platform = (load-platform-target)
-
-    print $"Name: ($platform.platform.name)"
-    print $"Type: ($platform.platform.type)"
-    print $"Mode: ($platform.platform.mode)"
-    print ""
-
-    print "Configured Services:"
-    let services = $platform.platform.services
-    let svc_names = ($services | columns)
-
-    for svc in $svc_names {
-        let config = ($services | get $svc)
-        let status = (if ($config.enabled | default true) { "enabled" } else { "disabled" })
-        let required = (if ($config.required | default false) { "required" } else { "optional" })
-        let mode_str = ($config.deployment_mode | default "binary")
-        let endpoint_str = ($config.endpoint | default "N/A")
-        print $"  • ($svc) [($status), ($required)]"
-        print $"      Endpoint: ($endpoint_str)"
-        print $"      Mode: ($mode_str)"
-    }
-
+    print "Platform target not available — no load-platform-target implementation."
+    print "Use 'prvng platform list' to see configured services from discovery."
     print ""
 }
 

nulib/lib_provisioning/platform/connection.nu

@@ -1,7 +1,8 @@
 # Platform Connection Metadata
 # Manages connection metadata and status for platform services
 
-use ../user/config.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/user/config.nu [get-active-workspace]
 
 # Get platform connection metadata file path
 def get-connection-metadata-path [] {

nulib/lib_provisioning/platform/credentials.nu

@@ -1,7 +1,7 @@
 # Platform Credentials Management
 # Manages credentials and tokens for platform services
 
-use ../user/config.nu *
+# user/config star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Get credentials namespace path for workspace
 export def get-credentials-namespace [workspace_name: string] {

nulib/lib_provisioning/platform/discovery.nu

@@ -1,7 +1,11 @@
 # Platform Service Discovery
 # Provides service endpoint resolution based on platform target configuration
 
-use target.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/platform/target.nu [
+    get-platform-endpoint get-platform-service-config is-platform-service-enabled
+    list-enabled-platform-services list-required-platform-services
+]
 
 # Get service endpoint from platform configuration
 export def service-endpoint [service: string] {

nulib/lib_provisioning/platform/health.nu

@@ -1,6 +1,7 @@
 # Platform Service Health Checks
 
-use target.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/platform/target.nu [get-deployment-service-config get-enabled-services]
 
 # Check if service is healthy at its port
 export def check-service-health [service: string] {

nulib/lib_provisioning/platform/mod.nu

@@ -15,11 +15,42 @@
 # - Service startup management and lifecycle
 # - CLI commands
 
-export use target.nu *
-export use discovery.nu *
-export use health.nu *
-export use credentials.nu *
-export use connection.nu *
-export use cli.nu *
-export use autostart.nu *
-export use service-manager.nu *
+# platform/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+
+export use target.nu [
+    detect-platform-mode get-default-platform-target get-deployment-service-config
+    get-enabled-services get-platform-endpoint get-platform-service-config
+    is-platform-service-enabled list-enabled-platform-services
+    list-required-platform-services load-deployment-mode should-start-locally
+    validate-platform-target
+]
+export use discovery.nu [
+    is-service-available list-required-services list-services
+    service-config service-endpoint
+]
+export use health.nu [
+    check-all-services check-required-services check-service-health wait-for-service
+]
+export use credentials.nu [
+    credential-exists delete-credential get-credential get-credentials-namespace
+    list-workspace-credentials store-credential
+]
+export use connection.nu [
+    add-service-connection get-active-connections get-service-status
+    init-connection-metadata load-connection-metadata remove-service-connection
+    show-connection-status store-connection-metadata update-service-status
+]
+export use cli.nu [
+    platform-config platform-connections platform-health platform-init
+    platform-list platform-start platform-status
+]
+export use autostart.nu [
+    disable-autostart enable-autostart get-service-status restart-service
+    start-required-services start-service stop-service
+]
+export use service-manager.nu [
+    get-external-services get-service-port is-port-listening load-deployment-mode
+    load-service-config nats_health nats_start nats_stop ncl-sync-start
+    ncl-sync-status ncl-sync-stop normalize-service-name start-required-services
+    start-services stop-services
+]

nulib/lib_provisioning/plugins/auth.nu

@@ -2,9 +2,19 @@
 # Purpose: Provides JWT authentication, MFA enrollment/verification, auth status checking, and permission validation.
 # Dependencies: std log, path-utils, auth_impl
 
-use ../config/accessor.nu *
-use ../utils/path-utils.nu *
-export use auth_impl.nu *
+# Selective imports + re-exports (ADR-025 Phase 3 Layer 2).
+# utils/path-utils star-import was dead — dropped.
+use lib_provisioning/config/accessor/core.nu [config-get]
+export use auth_impl.nu [
+    check-auth-for-destructive check-auth-for-production check-operation-auth
+    get-api-key-interactive get-auth-metadata get-authenticated-user
+    get-provider-credentials-interactive get-secret-config-interactive
+    is-authenticated is-check-mode is-destructive-operation is-mfa-verified
+    log-authenticated-operation login-interactive mfa-enroll-interactive
+    print-auth-status require-auth require-mfa run-typedialog-auth-form
+    should-enforce-auth-from-metadata should-require-auth
+    should-require-mfa-destructive should-require-mfa-prod
+]
 
 # Check if Auth plugin is available (registered with Nushell)
 def is-plugin-available [] {

nulib/lib_provisioning/plugins/auth_core.nu

@@ -9,8 +9,9 @@
 # Authentication Plugin Wrapper with HTTP Fallback
 # Provides graceful degradation to HTTP API when nu_plugin_auth is unavailable
 
-use ../config/accessor.nu *
-use ../commands/traits.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
+use lib_provisioning/commands/traits.nu [get-command-metadata]
 
 # Check if auth plugin is available (registered with Nushell)
 def is-plugin-available [] {

nulib/lib_provisioning/plugins/auth_impl.nu

@@ -2,9 +2,10 @@
 # Purpose: Internal auth functions for policy enforcement, metadata evaluation, and auth flows
 # Dependencies: config/accessor, plugins/kms, commands/traits, auth_core
 
-use ../config/accessor.nu *
-use ../commands/traits.nu *
-use auth_core.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
+use lib_provisioning/commands/traits.nu [get-command-metadata]
+use lib_provisioning/plugins/auth_core.nu [plugin-login plugin-mfa-enroll plugin-verify]
 
 # ============================================================================
 # Metadata-Driven Authentication Helpers
@@ -389,7 +390,7 @@ export def print-auth-status [] {
 # TYPEDIALOG HELPER FUNCTIONS
 # ============================================================================
 
-use ../utils/path-utils.nu *
+use lib_provisioning/utils/path-utils.nu [get-typedialog-form-path]
 
 # Run TypeDialog form and return parsed result
 export def run-typedialog-auth-form [

nulib/lib_provisioning/plugins/kms.nu

@@ -1,7 +1,8 @@
 # KMS Plugin Wrapper with HTTP Fallback
 # Provides graceful degradation to HTTP/CLI when nu_plugin_kms is unavailable
 
-use ../config/accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
 
 # Check if KMS plugin is available (registered with Nushell)
 def is-plugin-available [] {

nulib/lib_provisioning/plugins/mod.nu

@@ -5,12 +5,24 @@
 # Plugin Wrapper Modules
 # Exports all plugin wrappers with HTTP fallback support
 
-export use auth.nu *
-export use kms.nu *
-export use secretumvault.nu *
+# plugins/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
 
-# Plugin management utilities
-use ../config/accessor.nu *
+export use auth.nu [plugin-auth-status]
+export use kms.nu [
+    plugin-kms-backends plugin-kms-decrypt plugin-kms-encrypt
+    plugin-kms-generate-key plugin-kms-info plugin-kms-list-keys
+    plugin-kms-rotate-key plugin-kms-status
+]
+export use secretumvault.nu [
+    decrypt-config-file encrypt-config-file plugin-secretumvault-decrypt
+    plugin-secretumvault-encrypt plugin-secretumvault-generate-key
+    plugin-secretumvault-health plugin-secretumvault-info
+    plugin-secretumvault-rotate-key plugin-secretumvault-version
+]
+
+# config/accessor star-import was dead (no accessor symbols used in body) —
+# dropped. Add _ansi explicitly — previously came through an implicit chain.
+use lib_provisioning/utils/interface.nu [_ansi]
 
 # List all available plugins with status
 export def list-plugins [] {

nulib/lib_provisioning/plugins/orchestrator.nu

@@ -1,7 +1,8 @@
 # Orchestrator Plugin Wrapper with HTTP Fallback
 # Provides graceful degradation to HTTP/file-based access when nu_plugin_orchestrator is unavailable
 
-use ../config/accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
 
 # Check if orchestrator plugin is available (registered with Nushell)
 def is-plugin-available [] {

nulib/lib_provisioning/plugins/secretumvault.nu

@@ -1,7 +1,8 @@
 # SecretumVault Plugin Wrapper with HTTP Fallback
 # Provides high-level functions for SecretumVault operations with graceful HTTP fallback
 
-use ../config/accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
 
 # Check if SecretumVault plugin is available (registered with Nushell)
 def is-plugin-available [] {

nulib/lib_provisioning/plugins_defs.nu

@@ -1,6 +1,6 @@
-use utils *
-use config/accessor.nu *
-use ./utils/nickel_processor.nu [ncl-eval]
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# Both utils/ and config/accessor star-imports were dead — dropped.
+use lib_provisioning/utils/nickel_processor.nu [ncl-eval]
 
 export def clip_copy [
   msg: string

nulib/lib_provisioning/project/detect.nu

@@ -1,7 +1,9 @@
 # Provisioning Project Detection Module
 # Provides functions for technology detection and requirement inference
 
-use ../../../lib_provisioning *
+# Former `use ../../../lib_provisioning *` was a broken path (resolves to
+# non-existent core/lib_provisioning) — it was a silent no-op at runtime.
+# Removed per ADR-025 Phase 3 Layer 2.
 
 # Detect technologies in a project
 export def detect-project [

nulib/lib_provisioning/providers.nu

@@ -1,3 +0,0 @@
-# Re-export provider middleware to avoid deep relative imports
-# This centralizes all provider imports in one place
-export use ../../../extensions/providers/prov_lib/middleware.nu *

nulib/lib_provisioning/providers/loader.nu

@@ -1,9 +1,15 @@
 # Provider Loader System
 # Dynamic provider loading and interface validation
 
-use registry.nu *
-use interface.nu *
-use ../utils/logging.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# providers/interface.nu was a dead star-import — dropped.
+# Note: dynamic `use ($provider_entry.entry_point) *` remains at line ~173
+# (runtime load of the selected provider's module). Not convertible to
+# selective; that's intentional dynamic dispatch.
+use lib_provisioning/providers/registry.nu [
+    get-provider-entry get-provider-stats is-provider-available list-providers
+]
+use lib_provisioning/utils/logging.nu [log-debug log-error]
 
 # Load provider dynamically with validation (cached)
 export def load-provider [name: string] {

nulib/lib_provisioning/providers/registry.nu

@@ -1,9 +1,10 @@
 # Provider Registry System
 # Dynamic provider discovery, registration, and management
 
-use ../config/accessor.nu *
-use ../utils/logging.nu *
-use interface.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# providers/interface.nu star-import was dead — dropped.
+use lib_provisioning/config/accessor/core.nu [config-get]
+use lib_provisioning/utils/logging.nu [log-debug]
 
 # Provider registry cache file path
 def get-provider-cache-file [] {
@@ -270,7 +271,7 @@ export def refresh-provider-registry [] {
     init-provider-registry | ignore
 }
 
-# Export environment setup
-export-env {
-    $env.PROVIDER_REGISTRY_INITIALIZED = false
-}
+# export-env block removed by ADR-025 Phase 3 blocker 4.
+# The former block set $env.PROVIDER_REGISTRY_INITIALIZED = false at module load time.
+# Every read site uses `$env.PROVIDER_REGISTRY_INITIALIZED? | default false`, so the
+# unset state is equivalent to false. Zero behaviour change.