1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#!/usr/bin/env python3
"""The isolated test bench stopped at 02:17. Your colleague needs the evidence.

AIR-GAP INCIDENT REPORT: turn local logs into a brief you can carry through QR.
A useful example for OT engineers, lab teams and developers on restricted PCs.
No USB, network connection, package installation or equipment access required.

Try the SYNTHETIC acceptance-bench incident (no real plant or customer data):
    python airgap_incident_report.py --demo --output bench-brief
    # Open bench-brief/report.html locally. No web server is needed.
    # A crash, repeated PLC reconnects and rising temperature become a timeline.

For approved exports:
    python airgap_incident_report.py --input controller.csv \
        --input service.jsonl --output incident-brief

Required fields: timestamp, asset, event. Use --schema for supported values.
Timestamps require Z or an explicit UTC offset. Input: UTF-8 CSV or JSONL.
Output: escaped HTML, JSON summary, source and handoff SHA-256 manifests.
Identifiers are pseudonymised by default. Review free text before sharing;
redaction cannot recognise every secret. --keep-identifiers is local-use only.
Correlation is not causation. This is triage, not safety approval or control.
Python 3.10+; standard library only. The web demo transfers, never runs, this file.
"""
from __future__ import annotations

import argparse
import csv
import hashlib
import io
import ipaddress
import json
import math
import re
import statistics
import sys
from collections import Counter, defaultdict
from dataclasses import dataclass, field
from datetime import datetime, timedelta, timezone
from html import escape