The commit here: https://github.com/jboss/jboss-jaxrs-api_spec/commit/b578e70dd99a427758df7991c6456e40298d1dd0

...contains a wrong strategy for locating an API's implementation module. The strategy used is to use reflection to try and find a fixed module name from a module repository, but this is brittle and unnecessary.

The correct strategy is to use your own class loader, like this:

// allowed with secmgr check because caller is the class in question
ClassLoader myClassLoader = MyClass.class.getClassLoader();
try (InputStream is = myClassLoader.getResourceAsStream(serviceId)) {
    // ...
} catch (IOException ex) {
    // ...
}

In the WildFly code, the JAX-RS API module should depend on the implementation module (probably with services="import").