The module graph should not be changed by jlink plugins. The Plugin API allows to transform module-info.class as regular resource in the image. A plugin can add a new package an remove an existing package in a module and the ConcealedPackage attribute of module-info.class needs to be modified, if present.

Another issue is that Pool.Module::getDescriptor returns ModuleDescriptor. It needs to define if the returned ModuleDescriptor is the transformed module-info.class. (I don't expect it to be the original one in the input module artifact since a plugin should always get the resource data transformed in the pipeline).

Perhaps one option is that jlink should be responsible for transforming the module descriptor per the content through the plugin pipeline and write the resulting legitimate module-info.class in the image. jlink plugins do not need to deal with module-info.class.