All development installs fail with 0xe8008018 — online authorization (PPQ) returns REJECT_PROFILE for my paid team

I'm a paid Apple Developer Program member. Apple Developer Support confirmed by phone that my account has no restrictions, but every development-signed app I install on my registered iPhone is rejected.

Environment

  • iPhone 17 Pro,1, iOS 27.0 (24A435), Developer Mode enabled
  • Device registered and enabled in Certificates, Identifiers & Profiles
  • Signed with Apple Development certificates (issuer: WWDR G3), iOS App Development profiles

Error

ApplicationVerificationFailed 0xe8008018: The identity used to sign the executable is no longer valid.

On the device: "This app was not installed because its integrity could not be verified."

Device log during installation

installd(libmis): Performing online authorization.
online-auth-agent: The server returned: {"actions":["REJECT_PROFILE"],"authorized":false,...}
online-auth-agent: Permanently rejected profile: <hash, <profile UUID
installd(libmis): No online authorization (0x2)
installd(libmis): validation failed because of failing online authorization (-402620392)

What I've ruled out

  • Not certificate revocation: trustd reports OCSP status revoked=0 definitive=1 for the whole chain.
  • Not app-specific: a brand-new, empty test app with a newly created App ID and a newly created development profile fails identically.
  • Not certificate-specific: same result with two different Apple Development certificates, each in its own freshly generated profile (three profiles in total, all rejected).
  • The provisioning profiles contain the device UDID and the signing certificate, and the app's entitlements are a subset of the profile's.

Questions

  1. Under what conditions does the online authorization service return REJECT_PROFILE / authorized:false for a paid team whose account shows no restrictions?
  2. Is this a known issue with iOS 27 and development profiles?
  3. Since the device marks each profile as "permanently rejected", how can I restore authorization for my team on this device once the cause is fixed?