Sandboxed Mac app denied mach-lookup com.apple.cloudd when signed with Mac Team Store Provisioning Profile on macOS 26

I’d like to clarify what you mean by this:

The identical binary works correctly when launched from Xcode

Are you actually talking about an identical binary? Or identical source code?

Consider this sequence:

1. Choose Product > Archive.
2. In the Xcode organiser, upload to TestFlight.
3. Install the app via TestFlight.
4. Confirm that this app has the problem.
5. Delete the app.
6. In the Xcode organiser, click Distribute App and then follow the Debugging workflow.
7. Test that.

Does it have the same problem?

That’s my definition of identical binary, and it’s an important test here because it lets you isolate code signing problems from build problems.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Seeing the same deny(1) mach-lookup com.apple.cloudd on a sandboxed Mac app (SwiftUI, CloudKit via the standard com.apple.developer.icloud-services/icloud-container-identifiers entitlements, not SwiftData).

Environment: macOS 26.5.1, Xcode 26.5 — same as OP.

What I've confirmed so far:

• codesign -d --entitlements - on the App Store–downloaded binary shows correct entitlements: icloud-container-identifiers, icloud-services: [CloudKit], icloud-container-environment: Production, matching App ID/container config in the Developer Portal.
• App ID in the portal has iCloud capability enabled with the correct container assigned (1 of 1 selected) — ruled out a portal-side misconfiguration.
• Reproduced independently on a second Mac (different machine, App Store install) with the same deny.
• One difference from the OP's report: in my case, a local Release-scheme build run via Xcode also gets denied, while the Debug-scheme build works fine. So the discriminator for me looks like Debug vs. Release configuration, not strictly "Xcode-launched vs. TestFlight" as in the OP's finding.

Wanted to flag the second-machine repro and the Debug/Release discrepancy in case either is useful signal, since this looks like it could affect any Mac Store/CloudKit app on macOS 26.5.1 rather than being isolated to one project.

Ref Project's GitHub Repo

a local Release-scheme build run via Xcode also gets denied

Hmmmm, that brings me back to the post a referenced above, namely Isolating Code Signing Problems from Build Problems. There are two axes here:

• Build configuration (Debug or Release)
• Code signing (Development or Distribution)

These variables are sometimes correlated, but they’re not always correlated. So, in your “Release-scheme build” test, what code signing were you using?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer

Good question, and I tested this specifically because I suspected the same thing you're flagging.

The Release-scheme build I referenced was signed with a Development identity, not Distribution. Confirmed via codesign -d --entitlements -, which showed com.apple.security.get-task-allow: true present only on Development signed binaries.

So I tested:

• Debug config, Development signing → works
• Release config, Development signing → denied (deny(1) mach-lookup com.apple.cloudd)
• Release config, Distribution signing, External Distribution workflow → denied
• Release config, Distribution signing, App Store → denied

Interestingly, comparing entitlements directly (full output in the next comment): the Debug build and the dev-signed Release build have identical entitlements payloads same keys, same values, both get-task-allow: true, both missing icloud-container-environment, yet one works and one is denied.

So for my case the difference doesn't seem to be visible in the entitlements text itself; something else distinguishes the two, possibly the embedded provisioning profile identity even where the entitlements content matches. Entitlements were verified correct on all four variants (icloud-container-identifiers, icloud-services: [CloudKit], matching container ID). App ID / container assignment in the Developer Portal confirmed correct as well.

full output in the next comment

1. App Store install

Executable=/Applications/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator
[Dict]
[Key] com.apple.application-identifier
        [Value]
                [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.aps-environment
        [Value]
                [String] production
        [Key] com.apple.developer.icloud-container-environment
        [Value]
                [String] Production
        [Key] com.apple.developer.icloud-container-identifiers
        [Value]
                [Array]
                        [String] iCloud.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.icloud-services
        [Value]
                [Array]
                        [String] CloudKit
        [Key] com.apple.developer.team-identifier
        [Value]
                [String] 6H8PJSZGXA
        [Key] com.apple.security.app-sandbox
        [Value]
                [Bool] true
        [Key] com.apple.security.device.bluetooth
        [Value]
                [Bool] true
        [Key] com.apple.security.files.user-selected.read-only
        [Value]
                [Bool] true
        [Key] com.apple.security.network.client
        [Value]
                [Bool] true

1. External Distribution

Executable=/Users/user/Downloads/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator
[Dict]
[Key] com.apple.application-identifier
        [Value]
                [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.aps-environment
        [Value]
                [String] production
        [Key] com.apple.developer.icloud-container-environment
        [Value]
                [String] Production
        [Key] com.apple.developer.icloud-container-identifiers
        [Value]
                [Array]
                        [String] iCloud.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.icloud-services
        [Value]
                [Array]
                        [String] CloudKit
        [Key] com.apple.developer.team-identifier
        [Value]
                [String] 6H8PJSZGXA
        [Key] com.apple.security.app-sandbox
        [Value]
                [Bool] true
        [Key] com.apple.security.device.bluetooth
        [Value]
                [Bool] true
        [Key] com.apple.security.files.user-selected.read-only
        [Value]
                [Bool] true
        [Key] com.apple.security.network.client
        [Value]
                [Bool] true

1. Release scheme, Development signing

Executable=/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Release/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator
[Dict]
        [Key] com.apple.application-identifier
        [Value]
                [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.aps-environment
        [Value]
                [String] development
        [Key] com.apple.developer.icloud-container-identifiers
        [Value]
                [Array]
                        [String] iCloud.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.icloud-services
        [Value]
                [Array]
                        [String] CloudKit
        [Key] com.apple.developer.team-identifier
        [Value]
                [String] 6H8PJSZGXA
        [Key] com.apple.security.app-sandbox
        [Value]
                [Bool] true
        [Key] com.apple.security.device.bluetooth
        [Value]
                [Bool] true
        [Key] com.apple.security.files.user-selected.read-only
        [Value]
                [Bool] true
        [Key] com.apple.security.get-task-allow
        [Value]
                [Bool] true
        [Key] com.apple.security.network.client
        [Value]
                [Bool] true

1. Debug scheme, Development signing

Executable=/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Debug/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator
[Dict]
        [Key] com.apple.application-identifier
        [Value]
                [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.aps-environment
        [Value]
                [String] development
        [Key] com.apple.developer.icloud-container-identifiers
        [Value]
                [Array]
                        [String] iCloud.id.reishandy.YouriBeaconSimulator
        [Key] com.apple.developer.icloud-services
        [Value]
                [Array]
                        [String] CloudKit
        [Key] com.apple.developer.team-identifier
        [Value]
                [String] 6H8PJSZGXA
        [Key] com.apple.security.app-sandbox
        [Value]
                [Bool] true
        [Key] com.apple.security.device.bluetooth
        [Value]
                [Bool] true
        [Key] com.apple.security.files.user-selected.read-only
        [Value]
                [Bool] true
        [Key] com.apple.security.get-task-allow
        [Value]
                [Bool] true
        [Key] com.apple.security.network.client
        [Value]
                [Bool] true