I’m looking at the example at https://jsonapi.org/format/#document-compound-documents
The included comment.id=5 is authored by people.id=2. There is no people.id=2 in the included though, and there is no links.self in the relationships.author either.
Hence, is this a valid json:api object?
Probably, at least by my reading of the specification, but it’s not as useful as it should be.
Given the specification’s assertion that the shape of the URL space is not covered by the specification, there’s no way to convert {"type": "...", "id": "..."} to a URL, so therefore no way to know how to retrieve people.id=2 without having already retrieved that resource.
A careful implementation would include the URLs for resources not included in the response.