Kinda related to the changes made as part of phab:T192623.
While the modules themselves are JavaScript/CSS/LESS and therefore unambiguously out of scope, the names of the modules themselves are often referenced in PHP code (e.g. $out->addModules( 'mediawiki.api' )
) and in extension.json.
A strict reading of the "Scope" section would keep them out, but I'm leaning to thinking that we should consider them part of the PHP API, and explicitly document them as in scope of the policy.