Module secrets 

bynk-secrets.json generation per Worker (v0.172, ADR 0195).

The declared secret names a context’s handlers will read from env at runtime — an actor’s auth = Bearer(secret = "…") / Signature(secret = "…"), including the members of a multi-actor sum. deploy reads this file to know which secrets it must see set before it pushes.

The file carries two kinds of knowledge, which are not equally strong (ADR 0196):

• declared — an actor’s auth secret. A literal fixed at parse time, required at compile time, and fail-closed: unset, the Worker answers 401 to every request. deploy refuses to ship without a value.
• read — a literal bynk.Secrets name (Secrets.get("X")). get returns Option, so absence is a legitimate handled outcome — these are advisory, and deploy warns rather than failing.

And read_complete, which is the honesty. Secrets.get takes an ordinary String expression, so a computed name is invisible to any pass: where one is seen, the context warns (bynk.secrets.computed_name) and this flag goes false. declared is a floor, not a census (ADR 0195 D2); read is a census only while read_complete holds, and says so when it does not.

Why a file rather than an API: the driver has two compile paths, and under a bynkc override the compiler is a child process handing back an exit status — there is no in-memory model to consult. A name the compiler knows must reach the driver in the build output, or not at all (ADR 0195 D5).

P5.5 (design/tracks/semantics-in-the-checker.md §6, §9): the checking half — SecretReads, the Secrets.get AST walk, and the bynk.secrets.computed_name diagnostic itself — moved to bynk_check::secrets, a real gap this track’s settling pass had not scoped (see that module’s own doc). What stays here is emission-only: rendering the manifest bynk deploy reads, which is not this crate’s business to ask bynk-check to do.

Constants

SECRETS_MANIFEST

The file the driver reads, beside each Worker’s wrangler.toml.