Struct HarnessOnly 

pub struct HarnessOnly(/* private fields */);

Proof the caller is the harness itself and not a module. Only the harness can construct one, so Secrets::global is unreachable from module code however public it looks: a module has no way to make the argument.

This is the compile-time half of the two-tier rule. The runtime half is that a ModuleContext never carries a Secrets.

The type is nameable outside the crate — a signature that mentions it has to be writable — but not constructible. Its field is private and it has no public constructor:

use cratefield_secrets::HarnessOnly;
// The tuple field is private: module code cannot build the proof.
let _proof = HarnessOnly(());

use cratefield_secrets::Secrets;
// Nor mint one through the harness's own constructor, which is
// `pub(crate)` precisely so this does not compile.
let _proof = Secrets::harness_only();

Naming the type is fine, which is what keeps the signature writable:

use cratefield_secrets::HarnessOnly;
fn takes_proof(_proof: HarnessOnly) {}