plc-logic-integrity-checklisted

## When to Use - Verifying that no unauthorized program change hit a controller. - Capturing a known-good baseline before a firmware or logic change. - Investigating process behavior that does not match the operator control narrative. - Closing out a change record that claims a program download. ## Prerequisites - python-snap7 1.3 or newer. Verify with `python -c "import snap7; print(snap7.__version__)"`. - Network route to the controller and the correct rack and slot numbers. - Known-good baseline from a previous approved capture. - Connection type: S7-300/400 use 1. S7-1200/1500 use 3 via `client.set_connection_type(3)`. - Vendor tools where applicable: TIA Portal online compare, Studio 5000 Compare Tool. Optional cross-check. - plcscan for legacy S7 devices. Optional. Check `python3 plcscan.py --help` for the installed flag set. - pymodbus 3.x for register-level checks on Modbus controllers. - Credentials: engineering access where the controller enforces it. - Authorization: change control approval. Every step that touches the controller is active. - Upstream skills: `passive-ot-network-discovery` for the reachable controller list. ### Safety This skill is active. Every step that touches the controller is gated in the Workflow section. - Active. Sends requests to live PLCs. Requires change control approval and a tested rollback plan. Run inside an approved maintenance window. ## Workflow 1. Verify the baseline hash files before any online step: `cd baseline && s