Replication package: Do We Still Need a CMS? Platform Leverage in AI-Assisted Development

Abstract

Version 1.1 accompanies the camera-ready paper. It adds a method-level replication of the request-token audit on the public Joomla 3.10.12 core (scripts/controller_replication.py, results/replication_j310core.json), a script for the camera-ready figures, and reference metadata for the 25 works cited in the final paper. Per-file measurements, the corpus manifest and all 53 verified values are unchanged. Replication package for the paper Do We Still Need a CMS? Platform Leverage in AI-Assisted Development (Adam Balcerzak, University of Warsaw), submitted to ACDSA 2027. The paper measures how much host platform behaviour is inherited, rather than written, by eight web platform extensions deployed at the Laboratory of Media Studies, University of Warsaw, most of whose code was drafted by a large language model and then reviewed by the author. It introduces platform leverage: the number of host platform service invocations per thousand executable lines of bespoke code. Across 13,433 executable lines in 102 source files the corpus records 1,487 invocations, that is 110.7 per KSLOC. This package contains per-file measurement records, a capability realisation matrix, verified Crossref metadata for all 24 cited works, and scripts that recompute every number, table and figure in the paper. Running scripts/recompute.py followed by scripts/verify.py checks all 53 values asserted in the paper and exits non-zero if any of them differs. Scope of reproducibility. The source code of the measured extensions is deliberately not redistributed, because its deployment seed data embeds names and institutional e-mail addresses of laboratory staff who are not parties to this research. The measurement pipeline is a counting pipeline, so the per-file counts fully determine every published aggregate and no source line needs to be disclosed. The package therefore supports exact computational reproducibility of the reported results, but not independent re-measurement from the original sources. A SHA-256 manifest of all 170 analysed files is included so that anyone holding the sources can authenticate the corpus. Data and documentation are licensed CC BY 4.0; scripts are licensed MIT.