Nobody writes the compliance report — operating the agent is writing it. Every governance decision already landed in the append-only audit log. The auditor asks for a framework; you take one run's events, exactly as they stand, and export them. Toggle the events this run produced, pick the framework, and press export. The audit-event → control mapping is the real buildControlEvidence predicates lifted verbatim from kcp-harness/src/export.ts — the same control IDs an auditor would receive.
Toggle the events one run produced, pick the framework the auditor asked for, then press ▶ It's Thursday — export. Which controls light up is decided by the real export.ts mapping — nothing is invented.
Station 11 of 11 — the finale. The evidence bundle is produced by the real buildControlEvidence(id, name, description, events, predicate, detailFn) from kcp-harness/src/export.ts: the control IDs, names, and audit-event → control predicates for exportSOC2, exportISO27001, exportISO42001 and exportEUAIAct are lifted verbatim. Nobody wrote the report — the run wrote it.