Message Title

Ah, yes. This should be changed by specifying the bundle name in the build of the core module, setting it to "org.hibernate.validator". Also the name of the CDI module should be set to "org.hibernate.validator.cdi", i.e. the same names we use for Java 9 modules.

Weird, that's the full META-INF/MANIFEST.MF of that JAR as deployed to Maven Central:

Manifest-Version: 1.0
Implementation-Title: hibernate-validator-cdi
Bundle-Description: Hibernate Validator CDI Portable Extension
Automatic-Module-Name: org.hibernate.validator.cdi
Bundle-License: http://www.apache.org/licenses/LICENSE-2.0.txt
Bundle-SymbolicName: org.hibernate.validator.hibernate-validator-cdi
Implementation-Version: 6.0.1.Final
Built-By: jenkins
Bnd-LastModified: 1501837716556
Bundle-ManifestVersion: 2
Implementation-Vendor-Id: org.hibernate.validator
Specification-Title: Bean Validation
Import-Package: org.hibernate.validator;version="[6.0.1.Final,6.0.1.Fi
 nal]",org.hibernate.validator.cdi;version="[6.0.1.Final,6.0.1.Final]"
 ,org.hibernate.validator.internal.engine;version="[6.0.1.Final,6.0.1.
 Final]",org.hibernate.validator.internal.engine.valueextraction;versi
 on="[6.0.1.Final,6.0.1.Final]",org.hibernate.validator.internal.util;
 version="[6.0.1.Final,6.0.1.Final]",org.hibernate.validator.internal.
 util.classhierarchy;version="[6.0.1.Final,6.0.1.Final]",org.hibernate
 .validator.internal.util.logging;version="[6.0.1.Final,6.0.1.Final]",
 org.hibernate.validator.internal.util.privilegedactions;version="[6.0
 .1.Final,6.0.1.Final]",javax.annotation;version="[1.2,2.0)",javax.int
 erceptor;version="[1.2,2.0)",javax.enterprise.context;version="[1.2,2
 .0)",javax.enterprise.context.spi;version="[1.2,2.0)",javax.enterpris
 e.event;version="[1.2,2.0)",javax.enterprise.inject;version="[1.2,2.0
 )",javax.enterprise.inject.spi;version="[1.2,2.0)",javax.enterprise.u
 til;version="[1.2,2.0)"
Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
Fragment-Host: org.hibernate.validator
Tool: Bnd-3.2.0.201605172007
Implementation-Vendor: org.hibernate.validator
Export-Package: org.hibernate.validator.cdi;version="6.0.1.Final"
Bundle-Name: Hibernate Validator Portable Extension
Bundle-Version: 6.0.1.Final
Created-By: Apache Maven Bundle Plugin
Build-Jdk: 1.8.0_121
Implementation-URL: http://hibernate.org/validator/
Specification-Version: 2.0

If eventually the fragment is resolved, it can't attach to the host anymore since Felix doesn't support dynamic attachments.

Does this mean that Felix doesn't really support fragments at all? Or is there a way to mandate the order of resolution?

What does work though is simply removing the Fragment-Host header from hibernate-validation-cdi-6.0.0-Final.jar.

That's confusing, as it really shouldn't resolve in unsatisfied imports (of the internal packages from the core module). Maybe it's related to your statement above that you don't see any OSGi headers in the CDI module at all? Something seems odd here.