+1 for the "friend" concept but I don't think there is need to explicitly mark it as such with any scheme/documentation/annotation: the two modules are part of the same code base; if it compiles and passes the tests we know it's good. (while a scheme is not testable). SPI and API imply a stability promise, we don't need to promise anything here, if any we need to keep lean where we can.

OSGi requires non duplicate packages, let's focus on that and not carried away.