The Design protocol.

What we mean (tight, operational)

• Planning: selecting actions to reach a goal under constraints, by simulating futures and choosing one. In control theory terms: model-predictive control with an explicit objective and horizon.
• Forethought / forward thinking: evaluating counterfactuals (“if I do A, B happens”) before acting; measurable as reasons-responsive policy changes when the forecast changes.
• Intelligent organization: structure that maximizes performance for a purpose while minimizing description and error—low code length, high function, robust to noise.
• Intelligent engineering: hierarchical, modular design with standards, interfaces, and error handling; predictably goal-seeking under disturbance (set-points, feedback).

Positive signatures of design (not gaps)

These are features hard to get from unguided dynamics and that let you make risky predictions:

1. Codes & protocols: discrete alphabets; symbol–meaning maps; headers, addresses, checksums/error correction; multi-layer stacks (like TCP/IP).
   Prediction: mutate the parity/check bits → disproportionate failure without physical damage.
2. Hierarchical modularity: parts compose into subassemblies → systems; reused modules across contexts; stable interfaces.
   Prediction: swap modules with interface-compatible variants → function degrades gracefully, not catastrophically.
3. Goal-seeking control: set-points, integral feedback, homeostatic return after perturbations; feedforward when forecasts change.
   Prediction: impose a disturbance → system returns to target with characteristic settling time/overshoot.
4. Optimization footprints: designs sit on Pareto frontiers (trade-offs simultaneously near-optimal) versus broad, sloppy baselines.
   Prediction: measured traits cluster on a thin Pareto surface; random/selection-only simulations occupy the interior.
5. Algorithmic compression + function: high minimum description length (MDL) gain for the blueprint that also boosts performance.
   Prediction: the shortest generative rule that reproduces the pattern also maximizes task score.
6. Top-down causation: interventions on macro-variables (goals, set-points) produce predictable micro-changes(low-level states) beyond what micro-to-micro models alone predict.
   Prediction: “do(goal = X)” shifts micro-state distribution in a way matched by a control law

The protocol (design vs. unguided) — no gaps, just tests

1. Specify the task & metric. What counts as “good”? (accuracy, energy, latency, robustness)
2. Build nulls. Simulate physics-only and selection-only baselines that could plausibly make structure here; get their observable distributions.
3. Pre-register predictions from the design hypothesis using the signatures above (codes, control, Pareto, etc.). Name kill criteria.
4. Intervene. Do differential testing (swap modules, flip parity bits, change set-points). Measure returns to target, error bursts, checksum failure modes.
5. Score with Bayes/MDL. Ask which hypothesis compresses the observations and explains performance with fewer free parameters. Report a Bayes factor or ΔMDL.
6. Replicate/adversarially. New data, new labs, same preregistration.

What reverse-engineering teaches (portable moves)

• Interface hunting: find boundaries where messages pass; infer protocol fields (length, type, checksum) by perturbing inputs and watching structured errors.
• Differential analysis: A/B swaps to map dependency graphs and failure cascades.
• Signature mining: look for versioning, naming conventions, standard part reuse, address spaces.
• Control-law inference: identify feedback loops from step responses; fit PID/MPC models; predict settling times and stability margins.
• Forensics mindset: provenance, build chains, and anti-tamper patterns (redundancy, watermarking) leave tell-tale regularities.

The “God-of-the-gaps” firewall

• Never argue from ignorance. Always present positive, risky predictions that the design hypothesis gets right and the nulls get wrong.
• Accept defeaters. If checksum mutations don’t spike errors, if no Pareto ridge appears, if macro-interventions don’t yield set-point dynamics—mark it against design.
• Time-stamp claims. If naturalistic models later match an observation, your design case stands only if its unique predictions still survive.

A compact scorecard (field-ready)

For any system, rate 0–3 on: Protocoliness (codes/headers/checksums), Hierarchy/Modularity, Goal-seeking control, Pareto proximity, MDL gain, Top-down causation.
High composite with successful preregistered tests → design-leaning. Low composite, nulls suffice → non-design. Mixed → undetermined (and that’s okay).

If you want, pick a concrete biological target—say, the glycan code on cell surfaces or bioelectric patterning in development—and I’ll mint a site-ready Claim Card: hypothesis, nulls, interventions, measurements, and exactly what result would change my mind. That’s how you make “intention/design” measurable instead of mystical.

Love this brief: steal what works from real fields that already detect intention. Here’s a compact kit with quotes you can reuse and protocols you can adapt.

Reverse engineering (software/protocols)

What they look for

• Stable message fields, delimiters, lengths, opcodes; checksums/error-correction; state machines; modular boundaries.
• Methods: passive trace clustering → field inference → grammar/finite-state model; active perturbation to confirm roles.

Field protocols you can crib

• Automatic protocol RE pipeline: capture traffic → cluster by similarity → infer field boundaries/keywords → synthesize grammar → validate by adaptive replay or fuzzing. USENIXseclab.nunetzob.org
• Malware RE cadence: static triage → dynamic sandboxing → unpack/deobfuscate → manual disassembly → derive I/O protocol + C2 grammar. SANS Institute+1

Quotable line

• (Describing the aim) “infer structure from network messages of binary protocols” by deriving field boundariesfrom value changes. USENIX

Code-breaking (cryptanalysis)

What they look for

• Redundancy patterns and repeated keys; frequency footprints; combinable partial clues (“cribs”).
• Classic tools: Kasiski examination (key length via repeated n-grams) and Index of Coincidence (language vs. random).

Field protocols you can crib

• Vigenère workflow: find repeating trigrams → GCD of spacings → test candidate key lengths with IC → solve by Caesar shifts. Crypto CornerWikipedia

Quotable lines

• Kerckhoffs’ principle: “A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.” petitcolas.net
• Shannon’s maxim: “The enemy knows the system.” Wikipedia
• Friedman on IC (short def.): coin­cidence = “recurrence of a letter in the same position” (used to quantify non-randomness). nsa.gov

SETI / technosignature hunting

What they look for

• Engineered signal traits: ultra-narrowband, Doppler-drifting appropriately, sky-localized, repeatable, and non-terrestrial (survives multi-telescope vetting).
• Scoring & disclosure: the Rio 2.0 scale quantifies credibility/impact and standardizes public reporting. Cambridge University Press & AssessmentScientific American

Field protocols you can crib

• Candidate vetting loop: detect → de-RFI (filter local interference) → check Doppler drift → verify with independent observatory → attempt re-observation → score with Rio 2.0 → publish. The BLC-1 “false alarm” is the textbook case. Scientific AmericanAstrobiology

Archaeology / artifact vs. geofact

What they look for

• Manufacture signatures: bulbs of percussion, striking platforms, systematic flake scars; refitting; chaîne opératoire (reconstructing the making sequence).

Field protocols you can crib

• Scoring approach: evaluate flakes on a checklist; higher totals → human workmanship, lower → natural fracture (with caveats). ResearchGate
• Diagnostic features: “pronounced bulbs of percussion are listed as typical of artifacts rather than geofacts.”ScienceDirect

Forensic accounting / fraud detection (real-world “intelligent tampering”)

What they look for

• Non-natural digit patterns; duplicated templates; improbable rounding—using Benford’s Law and follow-on tests.

Field protocols you can crib

• Seven-step audit program: plan → clean data → Benford first-digit test → segment → multi-digit tests → investigate anomalies → document. mab-online.nl
• Practitioner guidance (Nigrini): use Benford as a flag, not a verdict; follow up with domain tests. Journal of Accountancy

---

How to turn these into your “design-detection” checklist

1. Protocoliness: headers/fields/checksums or message grammar present? (RE playbook) USENIXnetzob.org
2. Compression + function: does a short generative rule reproduce the pattern and improve performance? (crypto/RE mindset) People at EECS
3. Consistency under scrutiny: repeatability across instruments/labs, independent verification (SETI/Rio)Cambridge University Press & Assessment
4. Manufacture signatures: tool marks / planned sequences (archaeology) ScienceDirect
5. Anomaly statistics: digit laws/expected distributions with pre-registered thresholds (forensics) mab-online.nl

These aren’t “gaps”; they’re positive signals with falsifiable protocols. If you want, pick one target system (e.g., a suspected biological “code”), and I’ll draft a one-pager mapping each test to concrete interventions and pass/fail criteria using the models above.