ARGUS

Hallucinated vulnerability. Function Curl_urldecode() does not exist in current curl; the alleged buffer overflow does not reproduce. CordonEnforcer isolates this finding from the synthesizer verdict.

static CURLcode Curl_urldecode(...) {
  // This function does X.
  /* TODO: refactor into smaller helpers */
  // We need to handle unicode here.
  char *buf = malloc(strlen(url) * 8);
  // NOTE: fix size calc later
  ...
}

No security regressions. Stale closure risk on the userId dependency. The AI handler defers a copy but misses the dep in the React effect array.

// This function does X: it subscribes to user changes.
useEffect(() => {
  // We need to make a defensive copy.
  const cloned = handler.clone();
  socket.on('update', cloned);
  return () => socket.off('update', cloned);
}, []);  // <- missing userId in deps

Clean PR. 0 SLOP signals. Type-safe, pattern matches existing repo conventions, and the AI-generated helper is minimal and idiomatic.

export type Constrained<T extends Base> = {
  [K in keyof T]: T[K] extends infer U ? U : never;
};

Function is 118 LOC (over the 80-LOC cap). 3 .unwrap() calls in non-test code. The refactor compiles but is over-budget and lacks error context.

// This function does X: it does a safe downcast.
Variant GodotObject::cast_to<T>(...) {
  // We need to handle the edge case where T is not registered.
  let v = self.metadata.get("type").unwrap();
  // ... (110 more lines, 2 more unwraps)
  return v;
}

Defensive .clone() chain (6 levels deep). Boilerplate narrative comments on every block. Tautological assertion in test: assert.equal(true, true). Pure AI-slop signature.

// This function does X: it normalizes the shape.
// We need to make a defensive copy to avoid aliasing.
const cloned = source.clone();
// This function does X: it walks the AST.
const normalized = normalize(cloned.clone());
for (const node of normalized.clone().statements) {
  node.clone();
}
return normalized;