Found while installing decidiq on a clean proof instance from release tarballs (2026-09-01).
The stable release v1.0.2 (created 2026-08-30) carries exactly one asset, decidesk-1.0.2.tar.gz (10.9 MB). That archive is an OLD build: its appinfo/info.xml still says decidesk, lib/Event/ is absent, and it predates the Decidiq hub that the v1.0.2 TAG itself contains. Every prerelease publishes the correct decidiq-.tar.gz with a sha256 sibling (e.g. v1.0.1-unstable.20260824221112, 38.9 MB, hub present); v1.0.2 has no sha256 asset either, which suggests the asset was attached by hand or by a half-failed release run rather than built from the tag.
Consequence: any installer resolving the newest release (App Store style, or the fleet demo composes) installs the stale decidesk build; dossiq's ContractDecisionDelegationService then fails closed and every decidiq round trip is unreachable. The dossiq proof compose is pinned to the newest prerelease as a workaround.
Fix: rebuild and republish the v1.0.2 asset from the tag (correct name decidiq-1.0.2.tar.gz + sha256), or cut v1.0.3 from the release pipeline and delete the misleading asset. Note the repo may still be affected by the signing-credential issue tracked for the renamed apps.
Found while installing decidiq on a clean proof instance from release tarballs (2026-09-01).
The stable release v1.0.2 (created 2026-08-30) carries exactly one asset, decidesk-1.0.2.tar.gz (10.9 MB). That archive is an OLD build: its appinfo/info.xml still says decidesk, lib/Event/ is absent, and it predates the Decidiq hub that the v1.0.2 TAG itself contains. Every prerelease publishes the correct decidiq-.tar.gz with a sha256 sibling (e.g. v1.0.1-unstable.20260824221112, 38.9 MB, hub present); v1.0.2 has no sha256 asset either, which suggests the asset was attached by hand or by a half-failed release run rather than built from the tag.
Consequence: any installer resolving the newest release (App Store style, or the fleet demo composes) installs the stale decidesk build; dossiq's ContractDecisionDelegationService then fails closed and every decidiq round trip is unreachable. The dossiq proof compose is pinned to the newest prerelease as a workaround.
Fix: rebuild and republish the v1.0.2 asset from the tag (correct name decidiq-1.0.2.tar.gz + sha256), or cut v1.0.3 from the release pipeline and delete the misleading asset. Note the repo may still be affected by the signing-credential issue tracked for the renamed apps.