Wildfly 8.x ships with BOMs for easy dependency management: https://github.com/wildfly/boms
These are useful for the module-based classloading described here: https://docs.jboss.org/author/display/WFLY8/Implicit+module+dependencies+for+deployments
However, when I look in $JBOSS_HOME\modules\system\layers\base, I see many, many more included modules. For example, dozens of org.apache modules like commons-lang, etc. are included.
These deps are also not in the JBoss parent POM: https://github.com/jboss/jboss-parent-pom
Nor the Java EE specs: https://github.com/jboss/jboss-javaee-specs
For these dependencies (ones not in the BOMs or in the docs), how is the developer supposed to know they are provided? What is the intended dependency management strategy for developers using tools like Maven, etc.
Not all modules used by the server are meant to be used on deployments. There is a list of implicit module dependencies.
If you look at the module.xml file for some of these you'll probably see a property <property name="jboss.api" value="private"/>. This essentially just means that the dependency can change at any time. It may be upgraded to a different version or even removed. It's best to just include those dependencies in your deployment.