Потокове формування реєстру концептів, узгодженого зі стандартом SKOS, на основі звітів про інциденти у сфері кібербезпеки: Хмарні стеки та стеки на основі LLM з відкритими вагами

Security analysts consume incident reports as a stream and need an always-current normalized concept inventory with hierarchy. We present SKEIN-R, a streaming operator pair that replaces the batch normalization operator of a published formal model with an identity ballot and a source-free registry review, maintaining a SKOS/ISO-25964-typed concept registry that is final after every prefix of the stream, at two LLM judge passes per document. On a frozen mention stream from 204 CERT-UA incident reports, under a frozen expert gold standard and a pre-registered protocol, we run a replicated 2×2 factorial of a cloud frontier stack against an open-weight stack. For the stacks tested, the open-weight stack matches the cloud stack on reachable hierarchy recall and exceeds it on element-level identity (B-cubed +0.011 on the primary universe, which excludes web domains; Holm-adjusted p = 0.0002), with tighter replicate bands, at roughly double the token consumption. Decoupling hierarchy from the document call is the largest measured design effect, raising reachable hierarchy recall by +0.24 over the best single-call variant (95% BCa [0.18, 0.30]), replicating on both judges. Arrival order adds no identity instability beyond replicate variance on the cloud judge; a small residual effect appears only on the stabler open-weight judge. In the alias-rich HackerGroup category, identity reaches pairwise F1 0.857 at merge precision 1.000 in all three replicates, with NIL detection near 0.98 in every factorial cell. Error analysis traces the remaining gap to chain merges in identifier-like categories; a deterministic guard eliminates the domain chain-merge class at no detectable hierarchy cost, and a pseudonymization ablation attributes hard-stratum merges to in-context evidence rather than memorized knowledge.