There are a number of issues that need attention:

1. The provides and mainClass methods do not check that the package is in the module, this is mostly because the set of packages in the module may not be known until after the Module class file attribute has been parsed. One possibility is that the build() method check this and throw ISE. Once that is done then the post resolution checks in Configuration can be re-visited as there should be no need to check that the provider class is in the module.

2. Creating an automatic module with the builder can be used to create a ModuleDescriptor where not all packages are exported and open.