NetworkExtension URL Filter stops during startup only in TestFlight (NEAgentURLFilterErrorDomain Code=3, NEMembershipCheckerErrorDomain Code=3)

one more important thing

I got an approval for Network Extension but apple is mentioning about onboarding ** Your configuration [NE URL Filter] has been approved and is pending onboarding. It has passed all required validation and review steps and will proceed to the onboarding process.**

So does it take time to onboard and even if this onboarding is pending still we can distribute the app to the test flight ?

So does it take time to onboard … ?

Yes.

The approval process has two phases here:

1. First, the approval folks check that your server setup is working.
2. Once that’s done, they kick off the onboarding process.

It seems that you’ve passed step 1, and now you have to wait for step 2 to complete.

even if this onboarding is pending still we can distribute the app to the test flight ?

I suspect you’re missing a “not” in this sentence, so lemme answer it with a statement: Onboarding must be complete for your app to work in TestFlight.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer Thank you for your prompt response. So we will be notified through email only once onboarding process is done by the team ?

So we will be notified through email only once onboarding process is done by the team?

IIUC whether you get an email depends on how you have your notification settings configured. If you go to the Identity & Trust page in the CloudKit Console, it shows the state of your request and there’s a Settings item (under your avatar at the top right) that lets you configure notifications.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Oh, one more thing…

This new onboard process uses a UUID as the request ID. Do you have one of those? If so, can you post it here?

IMPORTANT Please don’t interpret this as an indication that something is wrong. Rather, I’m trying to get a better understanding of this new onboarding process from Apple’s side, and it’d be good to have a real request ID to ‘play’ with.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer UUID: cdafa575-948a-474b-9d5e-ee2719538d46 is a Network Extension URL Filter that is approved and is pending onboarding. Thanks!

@DTS Engineer If you are talking about my request configuration ID then it is d297f734-d414-444e-99ad-04911b1f8b7b

Thank you both. Using those request IDs I was able to confirm my understanding of how this works internally. Specifically, I confirmed that I wasn’t tell any lies in my earlier reply. Which is a relief (-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer So everything looks good and pending onboarding? Is there any other way to observe status changes or just wait for an email?

Thank you for all your help and everything you do :)

Is there any other way to observe status changes … ?

The status should change in the CloudKit Console, and how you’re notified of that depends on your settings in the console.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer Can you tell us how long this usually takes? CloudKit states "Your configuration is initially approved and pending onboarding."

It would be helpful to have more fine grained status updates such as the steps of onboarding or an ETA.

Phase 1 "Your Configuration has been approved" was 7 days ago. Is this a manual process where an Apple engineer has to onboard new configurations by hand?

Can you tell us how long this usually takes?

No, sorry. I don’t have detailed insight into the onboarding process and, even if I did, I don’t want to be making promises on behalf of other people.

Usually I can get a handle on how long these things take based on reports I see from developers here on the forums. In this case, however, I haven’t seen enough folks run through the new process to do that.

You might want to have a look for folks who’ve recently done this for Live Caller ID Lookup. The onboard process is the same for both technologies, and there are more folks working with that tech than with NE URL filters.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer any update on our request** d297f734-d414-444e-99ad-04911b1f8b7b**
because we can still status as Approved on the Request Dashborad https://icloud.developer.apple.com/. So is there going to be any changes in this Status ?

@appasauraus do you have any updates for your request ?

Unfortunately not. I searched the forums for Live Caller ID Lookup, onboarding time can take anywhere from 4-6 months. It's a black box, so we don't know what's going on until it's done onboarding. If there are errors, I guess the process starts all over again, so it could take 1+ year to get an App Store release.

@DTS Engineer @appasauraus My NE URL Filter configuration got onboarded successfully but still I am not able to see running status for the test flight or ad hoc build. I am seeing following errors

<NEPIRChecker: 0x699043680>: -[NEPIRChecker start:responseQueue:completionHandler:]_block_invoke - PIR status returned error <Error Domain=com.apple.CipherML Code=1100 "Unable to query status due to errors: Error details were logged and redacted." UserInfo={NSLocalizedDescription=Unable to query status due to errors: Error details were logged and redacted., NSUnderlyingError=0x699164030 {Error Domain=com.apple.CipherML Code=1800 "Error details were logged and redacted." UserInfo={NSLocalizedDescription=Error details were logged and redacted.}}}>

<NEURLFilterEngine: 0x930c202a0>: handleNewRequest - FINAL RESULT <failClosed> - filter is not up yet

<private> failed to fetch database changes for context <private>: Error Domain=CKErrorDomain Code=4 UserInfo={NSDebugDescription=<private>, NSUnderlyingError=0xc076baf70 {Error Domain=NSURLErrorDomain Code=-1008 UserInfo={NSErrorFailingURLStringKey=<private>, NSErrorFailingURLKey=<private>, _NSURLErrorRelatedURLSessionTaskErrorKey=<private>, _NSURLErrorFailingURLSessionTaskErrorKey=<private>, NSLocalizedDescription=<private>}}}

queryStatus(for:options:) threw an error: Error Domain=NSURLErrorDomain Code=-1009 "The Internet connection appears to be offline." UserInfo={_NSURLErrorNWPathKey=satisfied (Path is satisfied), interface: en0[802.11], ipv4, ipv6, dns, uses wifi, LQM: good, NSErrorFailingURLKey=https://ohttp.protectuswebfilter.com/config, NSUnderlyingError=0xb31171920 {Error Domain=NSPOSIXErrorDomain Code=50 "Network is down" UserInfo={NSDescription=Network is down}}, _NSURLErrorPrivacyProxyFailureKey=true, NSLocalizedDescription=The Internet connection appears to be offline.}

ScheduledActivity(com.apple.CipherML.TokenFetcherTask) threw error: Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLKey=https://protectus-ohttp-gateway-gqdqa3hackhcf9c3.northeurope-01.azurewebsites.net/.well-known/private-token-issuer-directory, NSLocalizedDescription=cancelled}

NESMURLFilterSession[PTSB Protect:80277F0B-C5EA-4159-A507-3EBB2695FD66] in state NESMURLFilterSessionStateStarting: plugin NEURLFilterPlugin(com.expleo.protectus.filter.main[url-filter][inactive]) status changed to stopping with error 3

I went to check on the state of this but then got very confused. There seems to be two Team IDs in play here, 3________5 and 9________M. Which one is applicable here?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer the one which starts with 9 and ends with M

OK. My view of things indicates that that, yes, your team has been successfully onboarded.

That Error details were logged and redacted message is interesting. It doesn’t mean that the error is completely unavailable, but rather than this part of the code chose not to log it because it’s been logged elsewhere. If you monitor the system log for entries in the com.apple.cipherml subsystem and framework, what do you see immediately before that log entry?

See Your Friend the System Log for lots of hints and tips about the system log.

Also:

• Are you targeting iOS or macOS?
• And what OS version are you testing on?
• If you’re targeting iOS, do you have an easy way to try it on macOS? macOS has lots more logging controls than iOS (-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

@DTS Engineer
I am working on iOS 26.6

I see below message on the portal when I hover my cursor over below status

"Error details were logged and redacted"

Before above mentioned error i got below error

queryStatus(for:options:) threw an error: Error Domain=NSURLErrorDomain Code=-1009 "The Internet connection appears to be offline." UserInfo={_NSURLErrorNWPathKey=satisfied (Path is satisfied), interface: en0[802.11], ipv4, ipv6, dns, uses wifi, LQM: good, NSErrorFailingURLKey=https://ohttp.protectuswebfilter.com/config, NSUnderlyingError=0xb5ad06010 {Error Domain=NSPOSIXErrorDomain Code=50 "Network is down" UserInfo={NSDescription=Network is down}}, _NSURLErrorPrivacyProxyFailureKey=true, NSLocalizedDescription=The Internet connection appears to be offline.}

I’m presuming that ohttp.protectuswebfilter.com is your OHTTP gateway?

I think I need to take a proper look at this log. I’m researching the best way to set that up and I’ll reply here with the details, hopefully tomorrow.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I’m researching the best way to set that up …

OK, please do the following:

1. On a test device, install the Phone (General) and VPN (Network Extension) debug profiles. Get those from our Bug Reporting > Profiles and Logs page.
2. Reproduce the problem, and note down the time.
3. Immediately trigger a sysdiagnose log.
4. File a bug, making sure to include the sysdiagnose log and the timestamp from step 2.
5. Reply here with your bug number. I’ll then intercept the bug so that I can look at the log.

Oh, wait, before you do any of that, please try reproducing this on iOS 27, just on the off chance that there’s something in the OS triggering this.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hello @DTS Engineer We have filed a bug. Please find the bug number FB25196629.

As well as we tried to run the same solution on iOS 26.3 and iOS 27.0.1 but on both the versions it keeps failing to start and we are receiving the same error.

@DTS Engineer any update on the bug ?