Why: app, server, and tools now call the layered Python environment. The dependency ratchet rejects those edges until they are recorded. Evidence: CI job 5179 failed test-boundaries on exactly these three edges. scripts/lint-architecture.sh passes locally after the update. Impact: The allowlist grows by three edges. No other package may import execenv until it is added the same way. Refs: Agent-System-Dev pull 570 Co-authored-by: Cursor <cursoragent@cursor.com>