fix(contract): 字段引用统一 lowerCamelCase——清理 proto 风格 snake_case 泄漏

按 CLAUDE.md 契约字段命名规则修正此前引入的泄漏：
- schemadiff Finding.Source：input_schema/output_schema →
  inputSchema/outputSchema（流入 Diagnostics field + 告警消息，
  为 UI/API 可见的契约暴露面；isInput 判定同步）
- 文件下发错误消息：transfer_id/content_sha256 → transferId/contentSha256
  （Go/JS/Python 三语言 + 测试断言）
- registrationguard 位置串：input_schema.x-menu → inputSchema.x-menu
  （错误消息文本，非机器码；同步既有测试断言）
- 机器标识码（schema_breaking_change 等）按契约豁免保留

测试：schemadiff/server/service 全绿 + SDK file push 全绿 +
web 13 例 + guard PASSED

Author: cuihairu

internal/function/schemadiff/diff.go

@@ -14,7 +14,7 @@ import (
 type Finding struct {
 	// Severity: "breaking" | "compatible"
 	Severity string `json:"severity"`
-	// Source: "input_schema" | "output_schema"
+	// Source: "inputSchema" | "outputSchema"
 	Source string `json:"source"`
 	// Path JSON Pointer（如 "/playerId"）
 	Path string `json:"path"`
@@ -188,17 +188,17 @@ func diffRequired(source, path string, oldMap, newMap map[string]interface{}, fi
 }
 
 // diffEnum 枚举方向性判定（审查修正）：破坏方向取决于数据流向——
-//   - input_schema：收窄 = breaking（旧调用方发被删的值会被服务端拒绝），
+//   - inputSchema：收窄 = breaking（旧调用方发被删的值会被服务端拒绝），
 //     扩张 = compatible（旧调用方不受影响）；
-//   - output_schema：扩张 = breaking（消费方会见到新值），
+//   - outputSchema：扩张 = breaking（消费方会见到新值），
 //     收窄 = compatible（消费方只会见到更少的值）。
 func diffEnum(source, path string, oldMap, newMap map[string]interface{}, findings *[]Finding) {
 	oldEnum, okOld := oldMap["enum"].([]interface{})
 	newEnum, okNew := newMap["enum"].([]interface{})
 	if !okOld || !okNew {
 		return
 	}
-	isInput := source == "input_schema"
+	isInput := source == "inputSchema"
 	oldValues := make(map[string]bool, len(oldEnum))
 	for _, item := range oldEnum {
 		oldValues[fmt.Sprint(item)] = true

internal/function/schemadiff/diff_test.go

@@ -23,7 +23,7 @@ func findByPath(findings []Finding, path string) (Finding, bool) {
 func TestDiffRequiredAdded(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string"}}}`)
 	newRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string"}},"required":["a"]}`)
-	findings := DiffSchemas("input_schema", oldRaw, newRaw)
+	findings := DiffSchemas("inputSchema", oldRaw, newRaw)
 	if !HasBreaking(findings) {
 		t.Fatalf("expected breaking finding, got %+v", findings)
 	}
@@ -36,7 +36,7 @@ func TestDiffRequiredAdded(t *testing.T) {
 func TestDiffPropertyRemoved(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string"},"b":{"type":"integer"}}}`)
 	newRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string"}}}`)
-	findings := DiffSchemas("input_schema", oldRaw, newRaw)
+	findings := DiffSchemas("inputSchema", oldRaw, newRaw)
 	if !HasBreaking(findings) {
 		t.Fatalf("expected breaking finding, got %+v", findings)
 	}
@@ -49,7 +49,7 @@ func TestDiffPropertyRemoved(t *testing.T) {
 func TestDiffTypeChanged(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string"}}}`)
 	newRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"integer"}}}`)
-	findings := DiffSchemas("input_schema", oldRaw, newRaw)
+	findings := DiffSchemas("inputSchema", oldRaw, newRaw)
 	if !HasBreaking(findings) {
 		t.Fatalf("expected breaking finding, got %+v", findings)
 	}
@@ -65,20 +65,20 @@ func TestDiffEnumDirectional(t *testing.T) {
 	narrowed := mustRaw(t, `{"type":"object","properties":{"level":{"type":"string","enum":["low"]}}}`)
 	expanded := mustRaw(t, `{"type":"object","properties":{"level":{"type":"string","enum":["low","high","critical"]}}}`)
 
-	// input_schema：收窄 = breaking（旧调用发被删值会被拒）
-	if findings := DiffSchemas("input_schema", oldRaw, narrowed); !HasBreaking(findings) {
+	// inputSchema：收窄 = breaking（旧调用发被删值会被拒）
+	if findings := DiffSchemas("inputSchema", oldRaw, narrowed); !HasBreaking(findings) {
 		t.Fatalf("input enum narrowing should be breaking, got %+v", findings)
 	}
-	// input_schema：扩张 = compatible（旧调用方不受影响）
-	if findings := DiffSchemas("input_schema", oldRaw, expanded); HasBreaking(findings) {
+	// inputSchema：扩张 = compatible（旧调用方不受影响）
+	if findings := DiffSchemas("inputSchema", oldRaw, expanded); HasBreaking(findings) {
 		t.Fatalf("input enum expansion should be compatible, got %+v", findings)
 	}
-	// output_schema：扩张 = breaking（消费方会见到新值）
-	if findings := DiffSchemas("output_schema", oldRaw, expanded); !HasBreaking(findings) {
+	// outputSchema：扩张 = breaking（消费方会见到新值）
+	if findings := DiffSchemas("outputSchema", oldRaw, expanded); !HasBreaking(findings) {
 		t.Fatalf("output enum expansion should be breaking, got %+v", findings)
 	}
-	// output_schema：收窄 = compatible
-	if findings := DiffSchemas("output_schema", oldRaw, narrowed); HasBreaking(findings) {
+	// outputSchema：收窄 = compatible
+	if findings := DiffSchemas("outputSchema", oldRaw, narrowed); HasBreaking(findings) {
 		t.Fatalf("output enum narrowing should be compatible, got %+v", findings)
 	}
 }
@@ -87,7 +87,7 @@ func TestDiffEnumDirectional(t *testing.T) {
 func TestDiffCompatibleChanges(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string","title":"A"}},"required":["a"]}`)
 	newRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string","title":"A","description":"field a"},"b":{"type":"integer"}},"required":["a"]}`)
-	findings := DiffSchemas("input_schema", oldRaw, newRaw)
+	findings := DiffSchemas("inputSchema", oldRaw, newRaw)
 	if HasBreaking(findings) {
 		t.Fatalf("expected only compatible findings, got %+v", findings)
 	}
@@ -100,18 +100,18 @@ func TestDiffCompatibleChanges(t *testing.T) {
 func TestDiffStructureTypeChanged(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"profile":{"type":"object"}}}`)
 	newRaw := mustRaw(t, `{"type":"object","properties":{"profile":{"type":"string"}}}`)
-	findings := DiffSchemas("input_schema", oldRaw, newRaw)
+	findings := DiffSchemas("inputSchema", oldRaw, newRaw)
 	if !HasBreaking(findings) {
 		t.Fatalf("expected breaking finding, got %+v", findings)
 	}
 }
 
 // 首次注册（旧 schema 为空）与非法 JSON 不产生差异
 func TestDiffEmptyAndInvalid(t *testing.T) {
-	if findings := DiffSchemas("input_schema", nil, mustRaw(t, `{"type":"object"}`)); len(findings) != 0 {
+	if findings := DiffSchemas("inputSchema", nil, mustRaw(t, `{"type":"object"}`)); len(findings) != 0 {
 		t.Fatalf("expected no findings for initial registration, got %+v", findings)
 	}
-	if findings := DiffSchemas("input_schema", mustRaw(t, `not-json`), mustRaw(t, `{"type":"object"}`)); len(findings) != 0 {
+	if findings := DiffSchemas("inputSchema", mustRaw(t, `not-json`), mustRaw(t, `{"type":"object"}`)); len(findings) != 0 {
 		t.Fatalf("expected no findings for invalid old schema, got %+v", findings)
 	}
 }
@@ -120,7 +120,7 @@ func TestDiffEmptyAndInvalid(t *testing.T) {
 func TestDiffNestedBreaking(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"profile":{"type":"object","properties":{"city":{"type":"string"}}}}}`)
 	newRaw := mustRaw(t, `{"type":"object","properties":{"profile":{"type":"object","properties":{}}}}`)
-	findings := DiffSchemas("input_schema", oldRaw, newRaw)
+	findings := DiffSchemas("inputSchema", oldRaw, newRaw)
 	if !HasBreaking(findings) {
 		t.Fatalf("expected nested breaking finding, got %+v", findings)
 	}
@@ -132,8 +132,8 @@ func TestDiffNestedBreaking(t *testing.T) {
 // source 区分 input/output
 func TestDiffSourceLabels(t *testing.T) {
 	oldRaw := mustRaw(t, `{"type":"object","properties":{"a":{"type":"string"}}}`)
-	findings := DiffSchemas("output_schema", oldRaw, mustRaw(t, `{"type":"object","properties":{}}`))
-	if len(findings) != 1 || findings[0].Source != "output_schema" {
-		t.Fatalf("expected single output_schema finding, got %+v", findings)
+	findings := DiffSchemas("outputSchema", oldRaw, mustRaw(t, `{"type":"object","properties":{}}`))
+	if len(findings) != 1 || findings[0].Source != "outputSchema" {
+		t.Fatalf("expected single outputSchema finding, got %+v", findings)
 	}
 }

internal/server/control_handler.go

@@ -540,9 +540,9 @@ func (s *ControlService) handleRegisterRequest(ctx context.Context, req *agentv1
 			if !ok {
 				continue
 			}
-			findings := schemadiff.DiffSchemas("input_schema", json.RawMessage(oldInput), json.RawMessage(f.GetInputSchema()))
+			findings := schemadiff.DiffSchemas("inputSchema", json.RawMessage(oldInput), json.RawMessage(f.GetInputSchema()))
 			findings = append(findings,
-				schemadiff.DiffSchemas("output_schema", json.RawMessage(oldOutput), json.RawMessage(f.GetOutputSchema()))...)
+				schemadiff.DiffSchemas("outputSchema", json.RawMessage(oldOutput), json.RawMessage(f.GetOutputSchema()))...)
 			for _, finding := range findings {
 				if finding.Severity != schemadiff.SeverityBreaking {
 					continue
@@ -916,10 +916,10 @@ func descriptorPresentationField(f *agentv1.FunctionDescriptor) (string, bool) {
 	// formily, ...). Reject the whole descriptor instead of silently
 	// persisting a smuggled UI hint.
 	if field, _, ok := registrationguard.ScanJSON(f.GetInputSchema()); ok {
-		return "input_schema." + field, true
+		return "inputSchema." + field, true
 	}
 	if field, _, ok := registrationguard.ScanJSON(f.GetOutputSchema()); ok {
-		return "output_schema." + field, true
+		return "outputSchema." + field, true
 	}
 	return "", false
 }

internal/server/control_handler_test.go

@@ -1340,7 +1340,7 @@ func TestValidateAndNormalizeFunctions(t *testing.T) {
 		assert.Len(t, warnings, 1)
 		assert.Equal(t, "function_presentation_field_not_allowed", warnings[0].Code)
 		assert.Equal(t, "game.player.get", warnings[0].FunctionID)
-		assert.Contains(t, warnings[0].Message, "input_schema.x-table-columns")
+		assert.Contains(t, warnings[0].Message, "inputSchema.x-table-columns")
 	})
 
 	t.Run("presentation extension in output schema is rejected", func(t *testing.T) {
@@ -1356,7 +1356,7 @@ func TestValidateAndNormalizeFunctions(t *testing.T) {
 		assert.Empty(t, functions)
 		assert.Len(t, warnings, 1)
 		assert.Equal(t, "function_presentation_field_not_allowed", warnings[0].Code)
-		assert.Contains(t, warnings[0].Message, "output_schema.x-menu")
+		assert.Contains(t, warnings[0].Message, "outputSchema.x-menu")
 	})
 
 	t.Run("full capability contract fields pass", func(t *testing.T) {

internal/service/contract_projection_test.go

@@ -16,8 +16,8 @@ func TestFunctionSpecFromContract_Diagnostics(t *testing.T) {
 		{
 			"code":     "schema_breaking_change",
 			"severity": "warning",
-			"message":  "input_schema$/reason: 已声明的字段被删除",
-			"field":    "input_schema",
+			"message":  "inputSchema$/reason: 已声明的字段被删除",
+			"field":    "inputSchema",
 		},
 	}
 	raw, err := json.Marshal(diagnostics)

internal/service/contract_service.go

@@ -775,9 +775,9 @@ func mergeSchemaDiffDiagnostics(
 		return base, nil, false
 	}
 
-	findings := schemadiff.DiffSchemas("input_schema", json.RawMessage(existing.InputSchema), json.RawMessage(contract.InputSchema))
+	findings := schemadiff.DiffSchemas("inputSchema", json.RawMessage(existing.InputSchema), json.RawMessage(contract.InputSchema))
 	findings = append(findings,
-		schemadiff.DiffSchemas("output_schema", json.RawMessage(existing.OutputSchema), json.RawMessage(contract.OutputSchema))...)
+		schemadiff.DiffSchemas("outputSchema", json.RawMessage(existing.OutputSchema), json.RawMessage(contract.OutputSchema))...)
 	if !schemadiff.HasBreaking(findings) {
 		return base, findings, true
 	}

internal/service/contract_service_test.go

@@ -121,7 +121,7 @@ func TestContractService_RebuildContractRejectsPresentationSchema(t *testing.T)
 	})
 
 	require.Error(t, err)
-	assert.ErrorContains(t, err, `forbidden presentation field "x-menu" at input_schema.x-menu`)
+	assert.ErrorContains(t, err, `forbidden presentation field "x-menu" at inputSchema.x-menu`)
 	contracts, listErr := service.ListContracts(ctx, "demo-game", "development")
 	require.NoError(t, listErr)
 	assert.Empty(t, contracts)
@@ -1566,7 +1566,7 @@ func TestContractService_SchemaBreakingChangeWritesDiagnostics(t *testing.T) {
 	contract, err = service.GetContract(ctx, "demo-game", "development", "player.ban")
 	require.NoError(t, err)
 	assert.Contains(t, string(contract.Diagnostics), "schema_breaking_change")
-	assert.Contains(t, string(contract.Diagnostics), "input_schema$/reason")
+	assert.Contains(t, string(contract.Diagnostics), "inputSchema$/reason")
 
 	// 兼容性变更（新增可选字段）：不产生告警
 	compatible := base

sdks/go/pkg/croupier/file_push.go

@@ -11,8 +11,8 @@ package croupier
 //     hotpatch runner（备份→替换→自检→回滚）单独编排。
 //
 // wire（protobuf 兼容，手写编解码避免全 SDK 再生成）：
-//   FilePushRequest  { 1: transfer_id, 2: file_name, 3: content_sha256(hex), 4: data }
-//   FilePushResponse { 1: transfer_id, 2: ok, 3: stored_path, 4: error }
+//   FilePushRequest  { 1: transferId, 2: fileName, 3: contentSha256(hex), 4: data }
+//   FilePushResponse { 1: transferId, 2: ok, 3: storedPath, 4: error }
 
 import (
 	"crypto/sha256"
@@ -150,7 +150,7 @@ func (m *TCPManager) validateFilePush(req *filePushRequest) error {
 		return errors.New("file transfer is disabled on this provider")
 	}
 	if strings.TrimSpace(req.transferID) == "" {
-		return errors.New("transfer_id is required")
+		return errors.New("transferId is required")
 	}
 	if _, err := safeStagingPath(m.fileStagingDir(), req.fileName); err != nil {
 		return err
@@ -166,7 +166,7 @@ func (m *TCPManager) validateFilePush(req *filePushRequest) error {
 		return fmt.Errorf("file size %d exceeds max %d", len(req.data), maxSize)
 	}
 	if strings.TrimSpace(req.contentSha256) == "" {
-		return errors.New("content_sha256 is required")
+		return errors.New("contentSha256 is required")
 	}
 	sum := sha256.Sum256(req.data)
 	if !strings.EqualFold(hex.EncodeToString(sum[:]), strings.TrimSpace(req.contentSha256)) {
@@ -227,7 +227,7 @@ type filePushResponse struct {
 }
 
 // encodeFilePushResponse 手写 protobuf 兼容编码：
-// { 1: transfer_id(string), 2: ok(bool), 3: stored_path(string), 4: error(string) }。
+// { 1: transferId(string), 2: ok(bool), 3: storedPath(string), 4: error(string) }。
 func encodeFilePushResponse(resp filePushResponse) []byte {
 	var out []byte
 	if resp.transferID != "" {

sdks/go/pkg/croupier/file_push_test.go

@@ -84,14 +84,14 @@ func TestFilePushValidation(t *testing.T) {
 		errSubstr  string
 	}{
 		{"disabled flag", false, "t-1", "patch.lua", validSha, validFile, "file transfer is disabled"},
-		{"empty transfer_id", true, "", "patch.lua", validSha, validFile, "transfer_id is required"},
+		{"empty transfer_id", true, "", "patch.lua", validSha, validFile, "transferId is required"},
 		{"path traversal ../", true, "t-1", "../evil.lua", validSha, validFile, "bare basename"},
 		{"absolute path", true, "t-1", "/etc/evil.lua", validSha, validFile, "bare basename"},
 		{"subdir escape", true, "t-1", "sub/dir/evil.lua", validSha, validFile, "bare basename"},
 		{"dotdot name rejected", true, "t-1", "..evil", validSha, validFile, "bare basename"},
 		{"empty payload", true, "t-1", "patch.lua", validSha, nil, "file payload is empty"},
 		{"oversize", true, "t-1", "patch.lua", validSha, make([]byte, 2048), "exceeds max"},
-		{"missing sha", true, "t-1", "patch.lua", "", validFile, "content_sha256 is required"},
+		{"missing sha", true, "t-1", "patch.lua", "", validFile, "contentSha256 is required"},
 		{"checksum mismatch", true, "t-1", "patch.lua", strings.Repeat("ab", 32), validFile, "checksum mismatch"},
 	}
 

sdks/js/src/index.ts

@@ -1466,7 +1466,7 @@ export class BasicClient implements CroupierClient {
     const contentSha256 = (decoded.contentSha256 ?? "").trim();
     const data = Buffer.from(decoded.data ?? new Uint8Array());
 
-    if (!transferId) return fail("transfer_id is required");
+    if (!transferId) return fail("transferId is required");
     if (!fileName || fileName.includes("/") || fileName.includes("\\") || fileName.includes("..")) {
       return fail(`file name must be a bare basename: "${fileName}"`);
     }
@@ -1475,7 +1475,7 @@ export class BasicClient implements CroupierClient {
     if (data.length > maxSize) {
       return fail(`file size ${data.length} exceeds max ${maxSize}`);
     }
-    if (!contentSha256) return fail("content_sha256 is required");
+    if (!contentSha256) return fail("contentSha256 is required");
     const actualSha = createHash("sha256").update(data).digest("hex");
     if (actualSha.toLowerCase() !== contentSha256.toLowerCase()) {
       return fail("checksum mismatch");