[abewheel]

Provider account populations were incorrectly required to equal Access Grant counts, which rejects valid reviews containing owned service identities, provider-managed roles, multiple accounts per grant, and inherited identity stores. Add explicit per-source reconciliation so actual retained account rows, permission grants, accountable identities, exclusions, and removals have separate meanings.

The optional model v13 structure retains one rolled-up review and its existing approval. Unknown accounts, missing rows, invalid or expired identities, ineffective owners, unmapped current grants, unrelated proof, and unresolved removals prevent readiness. Inherited identity boundaries require fixed configuration proof and must resolve to a reconciled direct source; sources without an account store cannot conceal grants. A current review renewal records existing human access authorization without inventing historical provisioning dates. Existing records retain their previous checks until explicit reconciliation is adopted.

Fix component Evidence provenance so an authoritative source can retain attachments or external references without pretending to be a rendered page. Nested CLI guides expose object definitions, scaffolds keep actual population decisions blank, and the browser uses the same readiness calculation. No new independent approval or model migration is added. Coordinated patch release: 0.18.9.

Validation:

• Nine independent combined correctness/security passes, ending clean.
• 24 focused provider reconciliation and baseline tests.
• Complete Node 24 local validation, package contents, npm audit and private-source/secret checks.
• Fresh generated consumer with the local package: 224 resources, zero errors or warnings.
• Browser saved an actual three-account/one-grant fixture review and attached fixed population proof while retaining component provenance; no JavaScript, console, or failed-request errors. Screenshots inspected.

Released as v0.18.9 at ce898664ae20c92b921538ef2273f2394ad06b00; merged tree matches final PR head 399c67b27cb6d386b13708edcfb3835c07347922. All five required PR checks and main validation passed. Trusted npm publication and installed README smoke passed; both packages report latest0.18.9 with provenance attestations.