refactor(difc): eliminate SecrecyLabel/IntegrityLabel structural duplication via Go generics

[Copilot]

✨ Enhancement

SecrecyLabel and IntegrityLabel in internal/difc/labels.go were structurally identical types with 6 mirrored method pairs (~34 duplicated lines), diverging only in the checkSubset boolean passed to checkFlowHelper. Any new method added to one type had to be manually mirrored.

What does this improve?

Replaces both concrete structs with a single FlowLabel[T labelKind] generic type. The four duplicate method bodies (getLabel, CanFlowTo, CheckFlow, Clone) are now defined once.

Implementation approach:

• labelKind interface constraint — phantom kind types encode their flow semantics directly via interface methods, avoiding runtime type assertions in the hot path:

  type secrecyKind struct{}
  func (secrecyKind) isSubset() bool   { return true }
  func (secrecyKind) typeName() string { return "Secrecy" }
  
  type integrityKind struct{}
  func (integrityKind) isSubset() bool   { return false }
  func (integrityKind) typeName() string { return "Integrity" }

• FlowLabel[T labelKind] — single generic struct with shared methods; var kind T in each method body dispatches statically to the kind's implementation:

  func (l *FlowLabel[T]) CanFlowTo(target *FlowLabel[T]) bool {
      var kind T
      ok, _ := checkFlowHelper(l.getLabel(), target.getLabel(), kind.isSubset(), kind.typeName())
      return ok
  }

• Type aliases preserve the public API unchanged — no call sites require modification:

  type SecrecyLabel  = FlowLabel[secrecyKind]
  type IntegrityLabel = FlowLabel[integrityKind]

  Direct struct literals like &SecrecyLabel{Label: nil} continue to compile correctly since FlowLabel carries no extra fields.

[Copilot]

Pull request overview

Refactors DIFC label types to remove duplicated logic between SecrecyLabel and IntegrityLabel by introducing a single generic FlowLabel[T] parameterized by a phantom “kind” type that encodes flow semantics.

Changes:

• Introduces labelKind plus secrecyKind / integrityKind phantom types to encode subset/superset flow rules.
• Replaces the two concrete label structs with type aliases to FlowLabel[...], preserving existing call sites.
• Consolidates duplicated methods (getLabel, CanFlowTo, CheckFlow, Clone) into the generic FlowLabel[T] implementation.

Show a summary per file

File	Description
internal/difc/labels.go	Replaces duplicated Secrecy/Integrity label implementations with a generic FlowLabel[T] plus kind-specific semantics.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[lpcox]

@copilot fix the failing ci check

[Copilot]

@copilot fix the failing ci check

The CI failure was caused by an incomplete rename in commit 7562d6c — FlowLabel was renamed to flowLabel in the struct declaration and type aliases, but the four method receivers and return types still referenced FlowLabel, which the compiler rejected. Fixed in the latest commit by updating all remaining *FlowLabel[T] references to *flowLabel[T].