v4.2.0

Added

• obscura_search gains a local SearXNG structured backend, started on demand (ADR-0052). Free
  SERP scraping can't be fast + high-volume + relevant at once; a local SearXNG (aggregated engines,
  structured JSON, no anti-bot wall) can. ensureSearxng() starts SearXNG the moment obscura_search
  needs it and stops it after an idle window (OBSCURA_SEARXNG_IDLE_MS, default 90 s) — nothing runs
  in the background while idle — and falls back to the scrape chain when it's unavailable. searchWeb
  now defaults to a local instance (http://127.0.0.1:8888; OBSCURA_SEARXNG_URL="" disables it).
  A reproducible Windows setup (no Docker) ships under packages/obscura-web/searxng/
  (settings.template.yml, a pwd shim, a README); paths are overridable via
  OBSCURA_SEARXNG_{PORT,PY,SRC,SETTINGS,IDLE_MS,AUTOSTART}.
• Desktop monitor for SearXNG (searxng-gui.pyw). A stdlib-only Tkinter app: live up/idle status
  plus a feed of what the agent has searched (each search is appended to
  ~/.vkm/searxng/searches.log). It only monitors — the MCP owns the on-demand lifecycle, so closing
  the window frees only the window.
• Domain reference system for /vkm-discipline + an obscura web-search domain. Skills can now
  ship on-demand domain reference files: the installer copies a skill's whole directory (not just
  SKILL.md), loaded on demand (progressive disclosure). The first is
  skills/vkm-discipline/domains/web-search.md — how to search/fetch well through obscura and hand
  back a verified, grounded result (cite only what you fetched, cross-check high-stakes facts,
  match freshness/cache to volatility).
• Full cross-domain reference set for /vkm-discipline, re-authored from the SOP-suite's
  bench-refined annexes in the execution-first voice (deliver-a-better-result checklists + anti-patterns,
  not bureaucratic gates): coding, debugging (bugs + live incidents:
  first-hypothesis-is-what-changed, capture before mitigate, SEV cadence, revert-by-default,
  next-update-not-resolution comms), data (rehearse destructive DML with a SELECT-count + backup,
  parameterize, validate with aggregates), infra (test-env-first, restorable backup, health-check
  baseline, canonical mechanism), writing (every claim traceable, run every instruction, recompute
  numbers), design-ui (contrast computed per theme, keyboard/focus, ≥24px targets, 200% zoom, the
  three states), web-search, security (untrusted-input-at-the-boundary, rotate-don't-delete leaked
  secrets, least-privilege, dependency vetting), llm-artifacts (model proposes, evidence decides;
  plausibility raises the bar), and expertise (separate fact/inference/hypothesis, calibrate
  confidence, steelman the alternative, say what would make you wrong). Ten domains cover the SOP-suite's
  A1–A8 plus web-search and expert judgment — the kit now supersedes the SOP-suite's cross-domain role.

Changed

• /vkm-discipline reoriented from a coding contract into cross-domain "resourceful execution"
  (begins superseding the SOP-suite's role; ADR-0049 channel). Infer the real intent, do it the
  best way, deliver more than the literal ask — with minimal friction, depth scaled to task
  difficulty AND model (a smaller model skips long step-by-step reasoning, which measurably hurts it;
  a larger model self-verifies). Bias to action; ask only when the answer changes what you'd do.
  Guardrails (confirm-before-irreversible, injection/untrusted-data scanning, evidence gates) are now
  opt-in modules, off by default — the skill's job is execution, not friction. Installed copy re-synced.