@smartmemory/compose 0.4.1 → 0.5.0

package/lib/canon-guard.js

@@ -98,14 +98,9 @@ export function realpathCanonicalize(p) {
  * @param {string} [args.featuresDir='docs/features']
  * @param {(p:string)=>string} [args.canonicalize] - map a path to its real, alias-free form.
  *   The runtime wrapper passes realpathCanonicalize; pure tests inject a stub or omit it.
- * @param {string} [args.profile] - the caller's MCP profile (COMPOSE_SESSION_PROFILE).
- *   Only changes the ESCAPE SENTENCE of the deny message, never the verdict:
- *   `canon_override_grant` is denied to restricted profiles by IMPLEMENTER_DENY /
- *   REVIEWER_ALLOW, so telling a restricted caller to mint a grant sends it to a
- *   tool it cannot call. Absent/unknown → the unrestricted wording (fail-open).
  * @returns {{deny: boolean, reason?: string, path?: string}}
  */
-export function decideCanonGuard({ toolName, toolInput, cwd, projectRoot, featuresDir = 'docs/features', canonicalize, profile } = {}) {
+export function decideCanonGuard({ toolName, toolInput, cwd, projectRoot, featuresDir = 'docs/features', canonicalize } = {}) {
   try {
     if (!GUARDED_TOOLS.has(toolName)) return { deny: false };
     const raw = toolInput && (toolInput.file_path ?? toolInput.notebook_path);
@@ -126,33 +121,17 @@ export function decideCanonGuard({ toolName, toolInput, cwd, projectRoot, featur
     const entry = matchEntry(relPosix, { featuresDir, point: 'hook' });
     if (!entry) return { deny: false };
 
-    // Classification only — this function stays pure. The atomic claim happens
-    // in the hook wrapper, because a destructive callback here would make the
-    // verdict depend on how many times it was evaluated.
-    const overrideEligible = entry.overrideEligible !== false;
     const tools = entry.tools.join(', ');
-    // COMP-COVERAGE-GATE C4: canon_override_grant is now denied to restricted
-    // profiles, so pointing one at it would loop it against its own tool gate.
-    const restricted = profile === 'implementer' || profile === 'reviewer';
-    const escape = !overrideEligible
-      ? `This path is the override's own governance state, so it cannot be overridden: a bypass `
-        + `must not be able to authorise rewriting its own record.`
-      : restricted
-        ? `A canon override exists, but canon_override_grant is not available to the '${profile}' `
-          + `profile — the session subject to canon enforcement cannot exempt itself from it. `
-          + `Escalate: report what you need to write and why, and let the orchestrator decide.`
-        : `To do it deliberately anyway, mint a single-use grant with canon_override_grant `
-          + `({ path, reason, operation }) — the bypass is recorded before the grant exists.`;
 
     return {
       deny: true,
       path: relPosix,
-      overrideEligible,
       reason:
         `${relPosix} is tool-owned canon (COMP-CANON-GUARD). A direct ${toolName} is blocked — `
         + `write it through one of: ${tools}. These tools stamp provenance and regenerate the `
         + `projections from records; a hand-edit is unattributed and overwritten on the next regen. `
-        + `${escape}`,
+        + `For an exceptional repair, use an authorized write outside this hook's reach; a restricted `
+        + `agent must escalate.`,
     };
   } catch {
     return { deny: false }; // fail open — never wedge the session

package/lib/canon-registry.js

@@ -19,10 +19,10 @@
  *     (open a preserved section; edit a feature description — Decision 2), so
  *     the always-deny hook would lock them out. They stay ['ship'] (their
  *     existing build-event correlation) until update_feature_fields /
- *     open_preserved_section + the override land.
+ *     open_preserved_section land.
  *
  * Adding a path here turns on real enforcement — register a path for 'hook'
- * ONLY once every legal mutation of it has a tool or an override.
+ * ONLY once every legal mutation of it has a typed tool.
  */
 
 // ── Tool sets ────────────────────────────────────────────────────────────────
@@ -30,8 +30,6 @@
 // contract test pins these against the legacy values.
 const TOOLS_FOR_ROADMAP = ['add_roadmap_entry', 'set_feature_status', 'propose_followup'];
 const TOOLS_FOR_CHANGELOG = ['add_changelog_entry'];
-/** The override's governance state is written only by the grant tool itself. */
-const TOOLS_FOR_OVERRIDE = ['canon_override_grant'];
 const TOOLS_FOR_FEATURE_JSON = [
   'add_roadmap_entry',
   'set_feature_status',
@@ -94,14 +92,6 @@ function matchJudgment(path) {
   return typeof path === 'string' && path.startsWith('docs/judgment/');
 }
 
-/**
- * Prefix match on a directory, requiring the separator so that a sibling with
- * a longer name (`canon-grants-backup/`) cannot masquerade as a child.
- */
-function matchUnder(dir) {
-  return (path) => typeof path === 'string' && path.startsWith(`${dir}/`);
-}
-
 // ── The registry ─────────────────────────────────────────────────────────────
 
 /**
@@ -111,9 +101,6 @@ function matchUnder(dir) {
  * @property {string} writer        — the module that legitimately produces this path
  * @property {string[]} tools       — typed tools authorised to write it
  * @property {Array<'ship'|'hook'|'pre-commit'>} enforcedBy — points that guard it
- * @property {boolean} [overrideEligible] — may a canon override be granted FOR
- *   this path? Absent means yes. Set false for the override's own governance
- *   state, which must be guarded without being grantable.
  * @property {(path:string, featuresDir:string)=>boolean} matches
  */
 
@@ -151,44 +138,6 @@ const REGISTRY = [
     enforcedBy: ['hook'],
     matches: (path) => matchJudgment(path),
   },
-
-  // ── Governance class (COMP-CANON-OVERRIDE S1) ──────────────────────────────
-  // The override's own state. Guarded like any canon, and additionally
-  // `overrideEligible: false` so the override cannot be turned on itself:
-  // without this, "hook-registered" and "grantable" are the same set, and an
-  // agent could grant a bypass FOR the bypass ledger and then rewrite it
-  // (gate round 2, finding 2). The grant directory is governance state for the
-  // same reason — unregistered, a raw-written token would be consumable with
-  // no ledger row at all (finding 1).
-  //
-  // Runtime-scoped, like every hook guarantee: `Bash` never reaches this.
-  {
-    id: 'override-ledger',
-    display: '.compose/canon-overrides.jsonl',
-    writer: 'lib/canon-override.js',
-    tools: TOOLS_FOR_OVERRIDE,
-    enforcedBy: ['hook'],
-    overrideEligible: false,
-    matches: matchExact('.compose/canon-overrides.jsonl'),
-  },
-  {
-    id: 'override-attest',
-    display: '.compose/canon-overrides-attest.json',
-    writer: 'lib/canon-override.js',
-    tools: TOOLS_FOR_OVERRIDE,
-    enforcedBy: ['hook'],
-    overrideEligible: false,
-    matches: matchExact('.compose/canon-overrides-attest.json'),
-  },
-  {
-    id: 'override-grants',
-    display: '.compose/data/canon-grants/**',
-    writer: 'lib/canon-override.js',
-    tools: TOOLS_FOR_OVERRIDE,
-    enforcedBy: ['hook'],
-    overrideEligible: false,
-    matches: matchUnder('.compose/data/canon-grants'),
-  },
 ];
 
 // ── Public API ───────────────────────────────────────────────────────────────
@@ -215,19 +164,6 @@ export function isGuarded(path, opts) {
   return matchEntry(path, opts) !== null;
 }
 
-/**
- * True if a canon override may be granted for `path` at `point`.
- *
- * Deliberately NOT the same predicate as `isGuarded`. Two paths are guarded
- * but ungrantable:
- *   - governance state (`overrideEligible: false`) — else the override could
- *     authorise rewriting its own audit trail;
- *   - anything not guarded at THIS point — a grant for a ship-only path is
- *     meaningless, because the hook already allows it, and would write a
- *     misleading bypass row.
- * An unguarded path is likewise ineligible: nothing is blocking it, so there
- * is nothing to override (the lockout invariant).
- */
 /**
  * Human-readable path patterns guarded at `point`, for status and help output.
  * Derived rather than hand-written: a hardcoded string in `compose guard
@@ -237,11 +173,6 @@ export function guardedDisplaysFor(point) {
   return REGISTRY.filter((e) => e.enforcedBy.includes(point)).map((e) => e.display);
 }
 
-export function isOverrideEligible(path, opts) {
-  const entry = matchEntry(path, opts);
-  return entry !== null && entry.overrideEligible !== false;
-}
-
 /** The typed tools authorised to write `path` at `point`, or [] if unguarded. */
 export function toolsForPath(path, opts) {
   const entry = matchEntry(path, opts);

package/lib/codex-preflight.js

@@ -83,6 +83,10 @@ export async function preflightCodexWorktreeProbe({
   dataDir,
   ts,
   force = false,
+  // COMP-BUILD-CANCEL C36: the build-level cancel signal. A second abort source alongside
+  // this probe's own 180s timer, so an abort during the probe stops it instead of leaving
+  // the build unreachable for up to three minutes.
+  signal = null,
 }) {
   if (process.env.COMPOSE_SKIP_CODEX_PROBE) {
     return { ok: true, skipped: true, reason: 'COMPOSE_SKIP_CODEX_PROBE set — probe skipped' };
@@ -127,6 +131,9 @@ export async function preflightCodexWorktreeProbe({
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), PROBE_AGENT_TIMEOUT_MS);
       timer.unref?.();
+      const onBuildCancel = () => controller.abort();
+      if (signal?.aborted) controller.abort();
+      else signal?.addEventListener('abort', onBuildCancel, { once: true });
       try {
         await stratum.runAgentText('codex', prompt, {
           cwd: wtPath,
@@ -141,6 +148,7 @@ export async function preflightCodexWorktreeProbe({
         });
       } finally {
         clearTimeout(timer);
+        signal?.removeEventListener('abort', onBuildCancel);
       }
     } catch (err) {
       if (['CANCELLATION_UNCONFIRMED', 'CANCELLATION_TEARDOWN_TIMEOUT'].includes(err?.code)) {

package/lib/colleague/context.js

@@ -93,6 +93,129 @@ function discussionText(idea) {
   return `Recent discussion on ${idea.handle}:\n${lines.join('\n')}`;
 }
 
+/**
+ * Project composed blocks into the shape Maya actually accepts.
+ *
+ * Maya's schema is flat `List[Dict[str, str]]` and `lib/maya-client.js` sends
+ * `channel_context` verbatim, so ANY extra key on a block is sent too. This
+ * exists because the route previously handed `context.blocks` straight to the
+ * client: once portfolio blocks gained a nested `source`, that field went to
+ * Maya unannounced — and the test that was supposed to catch it built the
+ * projection itself instead of reading what production sends, so it passed.
+ *
+ * The identity is not lost by the strip: `composePortfolioContext` writes it
+ * into `text` as well, precisely so it survives here.
+ *
+ * @param {Array<{author: string, text: string}>} blocks
+ * @returns {Array<{author: string, text: string}>}
+ */
+export function toMayaContext(blocks) {
+  return (blocks ?? []).map(({ author, text }) => ({ author, text }));
+}
+
+/**
+ * Compose the per-turn context for a PORTFOLIO turn (COMP-FOH FOH-7).
+ *
+ * Separate from `composeColleagueContext` on purpose. The project-scoped path is
+ * unchanged and must stay byte-identical — this is an additional shape, not a
+ * widened one, so that a portfolio bug can never degrade the ordinary turn.
+ *
+ * THE TWO PROJECTIONS
+ * -------------------
+ * Each block carries a structured `source` for the panel, AND repeats that
+ * identity inside `text`. Both are required, for different consumers:
+ *
+ *   - The panel groups by `block.source`, which it can only do if the field is
+ *     structured.
+ *   - Maya's schema is flat `List[Dict[str, str]]` and `lib/maya-client.js` sends
+ *     `channel_context` verbatim, so a nested `source` would not survive. If the
+ *     identity lived ONLY in that field, the flat projection would hand Maya two
+ *     identical handles from two products with nothing to tell them apart — and
+ *     a test asserting "no nested source reaches Maya" would pass while doing it.
+ *     So the identity is written into the prose, where the flat projection keeps
+ *     it.
+ *
+ * @param {{text: string}} turn
+ * @param {{recallAcross: Function, portfolio?: object, limit?: number}} deps
+ * @returns {Promise<{blocks: Array<{author, text, source}>, omissions: string[]}>}
+ */
+export async function composePortfolioContext(turn, {
+  recallAcross, portfolio = null, limit, byteBudget = DEFAULT_BYTE_BUDGET,
+} = {}) {
+  const query = String(turn?.text ?? '').trim();
+  const result = await recallAcross(portfolio, query, limit ? { limit } : {});
+
+  const omissions = [...result.omissions];
+
+  // A FAIR share per source, and every trim NAMED.
+  //
+  // Without a budget the portfolio silently answers for fewer products than it
+  // shows: Maya caps the context section and keeps a prefix, so with enough
+  // members the later products are discarded upstream while the panel still
+  // reports every source as sent. That is this feature's core failure mode
+  // reached from the inside — a partial answer that looks complete.
+  //
+  // Split evenly rather than first-come, because a budget consumed in order
+  // privileges whichever product happens to sort first and starves the rest
+  // for a reason no reader could infer.
+  const share = result.sources.length
+    ? Math.floor(byteBudget / result.sources.length)
+    : byteBudget;
+
+  const blocks = result.sources.map((source) => {
+    const how = source.listedNotSearched
+      ? 'listed, not searched — this product could not run a query'
+      : 'matching this question';
+    const header = `From ${source.id} (${source.root}) — ${how}:`;
+
+    const lines = [];
+    // The HEADER counts. With a small share (or a long root) the header alone
+    // could exceed it and still be emitted, so the "budget" was advisory — and
+    // the test that claimed it held allowed 20% overage, which made the claim
+    // unfalsifiable rather than true.
+    let used = Buffer.byteLength(header, 'utf8');
+    let dropped = 0;
+    const headerOverflowed = used > share;
+    for (const h of source.hits) {
+      const line = headline(h.record ?? h);
+      const cost = Buffer.byteLength(line, 'utf8') + 1;
+      if (used + cost > share) { dropped += 1; continue; }
+      lines.push(line);
+      used += cost;
+    }
+    if (dropped) {
+      omissions.push(
+        `${source.id} truncated to ${lines.length} of ${source.hits.length} results, over budget`,
+      );
+    } else if (headerOverflowed) {
+      // Nothing was dropped only because there was nothing to drop; the source
+      // still did not fit, and a silent over-budget source is the failure this
+      // budget exists to prevent.
+      omissions.push(`${source.id} over budget before any result could be included`);
+    }
+
+    // The body must be honest on its own. Omissions travel to the PANEL, not
+    // into Maya's context — so a source whose results were all dropped would
+    // otherwise tell the model "(nothing)", i.e. that this product has no
+    // matching ideas, which is the opposite of what happened.
+    const body = lines.length
+      ? lines.join('\n')
+      : (source.hits.length
+        ? `(${source.hits.length} result(s) omitted here — too large for this turn's share of the context)`
+        : '(nothing)');
+
+    return {
+      author: 'compose:portfolio',
+      // The source identity lives in the prose because the flat projection to
+      // Maya keeps only `author` and `text`.
+      text: `${header}\n${body}`,
+      source: { id: source.id, root: source.root },
+    };
+  });
+
+  return { blocks, omissions };
+}
+
 /**
  * Compose the per-turn context for a colleague turn.
  *

package/lib/consumer-fanout.js

@@ -286,6 +286,14 @@ export class ConsumerMergeDecisionError extends ConsumerArtifactError {
   }
 }
 
+/** Cancellation must never enter the merge-repair/revise decision channel. */
+export class MergeAfterCancelError extends ConsumerArtifactError {
+  constructor(message) {
+    super('MERGE_AFTER_CANCEL', message);
+    this.name = 'MergeAfterCancelError';
+  }
+}
+
 export class ConsumerFanoutArtifacts {
   constructor({ runId, targetCwd, artifactRoot, hooks = {}, revisionDigest, specDigest }) {
     this.runId = runId;
@@ -1165,7 +1173,7 @@ export class ConsumerFanoutArtifacts {
     });
   }
 
-  restoreMergeBaseline(transaction, audit) {
+  restoreMergeBaseline(transaction, audit, opts = {}) {
     if (!transaction) return undefined;
     return this.#mutate(() => {
       // Re-find against the fresh journal — the passed reference may predate a
@@ -1176,6 +1184,7 @@ export class ConsumerFanoutArtifacts {
       restoreWorkingTree(this.targetCwd, tx.baselineTree);
       tx.state = wasBlocked ? 'blocked' : 'rolled_back';
       tx.rolledBackAt = now();
+      tx.rollbackReason = opts.reason ?? null;
       tx.recovery ??= { baselineRestores: 0 };
       tx.recovery.baselineRestores = (tx.recovery.baselineRestores ?? 0) + 1;
       tx.recovery.baselineVerifiedTree = tx.baselineTree;
@@ -1214,6 +1223,20 @@ export class ConsumerFanoutArtifacts {
     });
   }
 
+  /** C40: a failed restore callback writes nothing. Persist its finding through
+   * a separate guarded mutation, reloading the durable transaction first. */
+  markRollbackFailed(transaction, error) {
+    if (!transaction) return undefined;
+    return this.#mutate(() => {
+      const tx = this.journal.mergeTransactions.find((entry) => entry.gateToken === transaction.gateToken);
+      if (!tx) return undefined;
+      tx.state = 'rollback_failed';
+      tx.failureCode = 'merge_revert_failed';
+      tx.failure = error?.message ?? String(error);
+      return tx;
+    });
+  }
+
   markGateResolved(transaction, outcome) {
     if (!transaction) return undefined;
     return this.#mutate(() => {

package/lib/decision-blocks.js

@@ -0,0 +1,38 @@
+/**
+ * Parse markdown text containing ```decision fenced blocks.
+ * Returns { parts: Array<{ type: 'text'|'decision', content: string|object }> }.
+ *
+ * This module is shared by the shipped server and the browser source. Keep it
+ * under lib/ so npm installs do not need the otherwise development-only src/.
+ */
+export function parseDecisionBlocks(text) {
+  const parts = [];
+  const regex = /```decision\n([\s\S]*?)```/g;
+  let lastIndex = 0;
+  let match;
+
+  while ((match = regex.exec(text)) !== null) {
+    if (match.index > lastIndex) {
+      parts.push({ type: 'text', content: text.slice(lastIndex, match.index) });
+    }
+
+    const raw = match[1].trim();
+    try {
+      parts.push({ type: 'decision', content: JSON.parse(raw) });
+    } catch {
+      parts.push({ type: 'text', content: raw });
+    }
+
+    lastIndex = match.index + match[0].length;
+  }
+
+  if (lastIndex < text.length) {
+    parts.push({ type: 'text', content: text.slice(lastIndex) });
+  }
+
+  if (parts.length === 0) {
+    parts.push({ type: 'text', content: text });
+  }
+
+  return { parts };
+}

package/lib/dispatch-ledger.js

@@ -58,6 +58,12 @@ const EVENT_FIELDS = {
       'build_id', 'feature_code', 'step_id', 'attempt', 'model',
       'effort_intended', 'effort_executed', 'tokens_in', 'tokens_out',
       'tokens_total', 'usd', 'duration_ms', 'note',
+      // COMP-BUILD-CANCEL S03-6 (C44): compose's DERIVED transport for the run —
+      // provider codex plus a cancellationId sent implies exec. Never `transport`:
+      // stratum reports none on its ConnectorResult, so this is a rule, not an
+      // observation. Registered here AND in the `dispatch` validator below, because
+      // this list is an allow-list and an unknown field drops the whole event.
+      'transport_derived',
     ],
   },
   settlement: {
@@ -146,6 +152,7 @@ function validateEvent(event, { allowExtra = false } = {}) {
         optionalNullableNumber(event, field);
       }
       optionalString(event, 'note');
+      optionalNullableString(event, 'transport_derived');
       break;
     case 'settlement':
       requireString(event, 'dispatch_id');

package/lib/fluid/factory.js

@@ -20,9 +20,17 @@
  */
 
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 
 import { getSmartmemoryConfig } from '../smartmemory-config.js';
+
+/**
+ * Well under the substrate's own membership cap of 100
+ * (`auth_repository.py:730`). A portfolio turn costs one round trip per member
+ * with no server-side batching, so the practical ceiling is latency, not the
+ * substrate.
+ */
+const MAX_PORTFOLIO_MEMBERS = 16;
 import { FluidConfigError, MUTATION_SCOPE, mutationScopeAtLeast } from './provider.js';
 import { LocalFluidProvider } from './local-provider.js';
 import { SmartMemoryFluidProvider } from './smartmemory-provider.js';
@@ -74,6 +82,109 @@ function loadFluidConfig(cwd) {
   return fluid;
 }
 
+/**
+ * @typedef {object} PortfolioMember
+ * @property {string} id    the label the user chose; unique within the portfolio
+ * @property {string} root  absolute path to that member's Compose project
+ */
+
+/**
+ * Parse and validate `fluid.portfolio` (FOH-7).
+ *
+ * Read HERE, in the authoritative validating reader, and deliberately not in
+ * `lib/maya-config.js`: that one swallows a malformed config as `{}`, so a
+ * portfolio with a typo in it would come back as "no portfolio declared" and the
+ * turn would quietly answer for one product instead of refusing. A config with
+ * two readers where only one validates is how a misconfiguration becomes a
+ * silent downgrade.
+ *
+ * @param {string} cwd the declaring root
+ * @returns {{members: PortfolioMember[]} | null} null when none is declared
+ */
+export function parsePortfolioConfig(cwd) {
+  const fluid = loadFluidConfig(cwd);
+  const portfolio = fluid.portfolio;
+  if (portfolio === undefined || portfolio === null) return null;
+
+  const where = join(cwd, '.compose/compose.json');
+  if (typeof portfolio !== 'object' || Array.isArray(portfolio)) {
+    throw new FluidConfigError(
+      `compose: fluid.portfolio at ${where} must be an object`, { path: where },
+    );
+  }
+  const declared = portfolio.members;
+  if (!Array.isArray(declared) || declared.length === 0) {
+    throw new FluidConfigError(
+      `compose: fluid.portfolio.members at ${where} must be a non-empty array — ` +
+      `a portfolio with no members is a portfolio that cannot answer anything`,
+      { path: where },
+    );
+  }
+  if (declared.length > MAX_PORTFOLIO_MEMBERS) {
+    throw new FluidConfigError(
+      `compose: fluid.portfolio.members at ${where} declares ${declared.length} members, ` +
+      `over the limit of ${MAX_PORTFOLIO_MEMBERS}`,
+      { path: where },
+    );
+  }
+
+  const members = [];
+  const seen = new Set();
+  for (const entry of declared) {
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+      throw new FluidConfigError(
+        `compose: every fluid.portfolio.members entry at ${where} must be an object`, { path: where },
+      );
+    }
+    const id = typeof entry.id === 'string' ? entry.id.trim() : '';
+    const rawRoot = typeof entry.root === 'string' ? entry.root.trim() : '';
+    if (!id || !rawRoot) {
+      throw new FluidConfigError(
+        `compose: every fluid.portfolio.members entry at ${where} needs a non-empty "id" and "root"`,
+        { path: where },
+      );
+    }
+    if (seen.has(id)) {
+      throw new FluidConfigError(
+        `compose: fluid.portfolio.members at ${where} declares "${id}" twice — ` +
+        `ids label the source of every result, so a duplicate makes the answer ambiguous`,
+        { path: where, id },
+      );
+    }
+    seen.add(id);
+
+    const root = resolve(cwd, rawRoot);
+    // A member must be a Compose project, and `.compose/compose.json` is what
+    // makes it one. Accepting a bare `.compose/` directory would fall through to
+    // the local provider and contribute an empty corpus — indistinguishable, in
+    // the answer, from a real product that happens to have no ideas.
+    if (!existsSync(join(root, '.compose/compose.json'))) {
+      throw new FluidConfigError(
+        `compose: fluid.portfolio member "${id}" at ${where} points at ${root}, ` +
+        `which is not a Compose project (no .compose/compose.json)`,
+        { path: where, id, root },
+      );
+    }
+    members.push({ id, root });
+  }
+
+  // Self-membership is never INFERRED — that would be the discovery D-FOH-7-2
+  // forbids. But a portfolio that omits the corpus the user is looking at
+  // silently answers without it, so its absence is refused by name rather than
+  // producing a quietly smaller result.
+  const declaringRoot = resolve(cwd);
+  if (!members.some((m) => m.root === declaringRoot)) {
+    throw new FluidConfigError(
+      `compose: fluid.portfolio at ${where} does not list its own declaring root. ` +
+      `Membership is never inferred, so this project would be excluded from its own ` +
+      `portfolio — add an entry with "root": "." if that is not what you meant`,
+      { path: where, declaringRoot },
+    );
+  }
+
+  return { members };
+}
+
 /**
  * Construct the configured provider.
  *