I think for a core profile even complete Servlet or CDI specs are an overkill. What is ths profile for? Should it contain really what 80% of developers use or it should rather cover 80% of their use cases? I think the
first, we already have Web Profile to do the second.
IMHO, if there should be a core profile, it should only contain relevant parts of Servlets and CDI.
For Servlets:
- ServletContext is valid and generous enough
- Security definitions are valid
- Session tracking is probably also valid
- On the other hand, Servlet, Filter and HTTP APIs are very cumbersome, and even a blocker for some technologies and approaches like reactive processing and NIO
For CDI:
- dependency injection and contexts are valid
- but things like events, stereotypes, decorators, portable extensions are not necessary and even very seldom used (even if crucial in certain usecases)
- new API for portable extensions introduced in CDI 2.0 could be in core but the old API is too much
To conclude, I would pick only necessary parts of some specs into a core profile otherwise there's no point in having it at all as it would already be too big to have a reasonable advantage over Web Profile.