Ok, well we can add extra rules to this module:
* no non-optional dependencies on other jars (must be self contained)
* bean validation must have no deps outside BV api
I think it would be sensible to add a short contract.txt to each module to include these requirements. Shane, could you add these?