Fusion - the Fusion 360 Bridge

@@ -110,10 +110,39 @@ adom-bridge --target <box> --ai-thread <you> bridge_dev_mode '{"name":"fusion360 An add-in change (`addin/`) also needs the add-in folder copied into the cache and a Fusion restart (`fusion_restart_for_addin {save:true}`), because Fusion loads add-ins at launch. -**Your local build is unsigned.** Released builds are code-signed as Adom Industries, Inc. by the-maintainers. On Windows 11 with Smart App Control on, an unsigned exe can be blocked ("Part of this-app has been blocked"). Test on a machine where Smart App Control is off, or say so on your pull-request and a maintainer will run a signed build for you.+### Running your own build without signing it++You never need to sign anything to contribute. `cargo build` gives you an unsigned+`adom-fusion-bridge.exe`, and on most machines it simply runs. The one thing that can stop it is+Windows 11 **Smart App Control**, which blocks unsigned programs ("Part of this app has been+blocked"). Check your box first, in PowerShell:++```powershell+(Get-MpComputerStatus).SmartAppControlState     # Off, Eval or On+```++- **Off**: your build runs as is. Copy it in behind the dev pin (above) and test. This is the case+  on most developer machines and on any PC upgraded from an older Windows.+- **Eval** (evaluation mode): Windows is still deciding. An unsigned build may be allowed or+  blocked; try it.+- **On**: Windows blocks the unsigned exe. Either test on another box where it is off, or turn it off+  in Windows Security > App & browser control > Smart App Control. Know that Windows does not let you+  turn it back on afterwards without resetting the PC, so prefer a spare or development machine.++Two more notes:++- A build you compile on the box, or copy over with `send_files`, carries no "downloaded from the+  internet" mark, so Windows SmartScreen does not prompt for it.+- If none of your machines can run an unsigned exe, say so on your pull request. A maintainer will+  run your change on a signed build and post the results there.++### We sign the final exe++You send source, never a binary. When a maintainer merges your pull request and ships it, the release+build is compiled from that source and **code-signed as Adom Industries, Inc.** with a trusted+timestamp before it is published, and the release refuses to publish an exe whose signature does not+verify. Everyone who installs the bridge gets that signed exe, so Smart App Control is never a problem+for them.  **Run the verb suite against your box** before you send a change that touches behavior. It drives every daily-tier verb the way an AI does and prints a scorecard:

@@ -105,8 +105,11 @@ the issue. A PR that comes with its evidence merges fast.  ## Two things that trip up a first contribution -- **Local builds are unsigned.** Releases are code-signed by the maintainers; on Windows 11 with Smart App-  Control on, your own build can be blocked. Test where it is off, or ask on the pull request for a signed-  test build.+- **Local builds are unsigned, and that is fine.** Contributors never sign anything: `cargo build` output runs+  as is unless Windows 11 Smart App Control is On. Check with `(Get-MpComputerStatus).SmartAppControlState`.+  Off: just run it behind the dev pin. On: test on another box (turning it off cannot be undone without a PC+  reset), or ask on the pull request for a maintainer to run it signed. Maintainers sign the final exe as+  Adom Industries when they ship the merged change; the release refuses an exe whose signature does not+  verify. CONTRIBUTING.md has the full steps. - **Never make the bridge close a window that is not plainly a dialog.** Fusion's floating Browser panel is   titled "Fusion360", and closing it closes documents. CONTRIBUTING.md has the review and approval steps.