Capability check data and code for "Towards a cybernetic theory of control-architecture failure against agentic cyber threats"

Data, code and outputs for the Section 4.3 capability check: a locally hosted large language model (Qwen3 8B, Q4_K_M, via Ollama, CPU only) labelling security log events as benign, suspicious or malicious, unaided and with retrieval-augmented generation (k=5, FAISS over nomic-embed-text vectors), against a SigmaHQ rule baseline. No hosted or cloud model was used. Derivation. The test sample (1,000 log lines: 350 malicious, 650 benign), the 100-event development slice and the 3,073-event retrieval corpus are a stratified, labelled sample of the AIT Log Data Set V2.0 (Landauer et al.; doi:10.5281/zenodo.5789064, CC BY-NC-SA 4.0). Splits are by scenario, so no host appears in both the test sample and the retrieval corpus. The mapping from AIT attack steps to MITRE ATT&CK techniques is the authors' own. Because this deposit redistributes AIT-LDS content, it is released under the same licence, CC BY-NC-SA 4.0. Contents. results.json (all metrics with Wilson 95% intervals and deadline ratios), table2.csv, environment.txt (model digest, runtime, hardware, dataset, retrieval and rule-set details), the prompt, context block and JSON output schema, errors_sample.jsonl (30 misclassified events per model condition), and capcheck_s43_public.zip containing these plus per-event raw model outputs for every pass, run and memory logs, the derived data files and FAISS index, and all scripts (Python, software sub-component). capcheck_s43_ait_raw.zip holds the AIT-LDS v2.0 log and label files the sample was drawn from (all eight scenarios, labelled logs only, unmodified), redistributed under the dataset's licence. Python packages and the SigmaHQ rule release are not redistributed because they carry their own licences; README.md gives pinned versions and checksums for re-creating them and re-running.