An empirical study protocol: sampling, matched control and prevalence estimation

The argument

The pilots support existence and surface diversity. They do not support prevalence, and they do not support the claim that AI assistance means more disclosure. The protocol defines an AI-assisted repository operationally, with strong and weak signals and a deliberately narrow primary group; a matched control group; unique-repository sampling with fork, template and duplicate control; personal and organization strata; current public state only; and researcher-blind measurement throughout.

It asks five questions: the prevalence of at least one disclosure class among AI-assisted public repositories (RQ1); the same prevalence among matched non-AI repositories (RQ2); whether the difference is above zero (RQ3); whether it concentrates in particular classes such as workstation paths, auth or session context, private networks, runtime topology or secret-like material (RQ4); and whether personal and organization repositories differ (RQ5).

It does not presuppose the answer. The null is no difference, and the study must be able to accept it. Analysis requires prevalence intervals, effect sizes, sensitivity analysis, preserved UNKNOWN and NOT MEASURED states, and a clean split between exploratory and confirmatory results. The full 200 + 200 run waits until the sampling frame, matching variables, blinding and unknown-handling rules are frozen.