[quote='897915022, DTS Engineer'] And please post the bug number here when you’re done. [/quote] Here is the feedback number FB23814474. Once again really appreciate you walking through this with me, this was a genuinely tricky one to pin down. Thanks again!

Oh wow, thank you @DTS Engineer ! That was it. Disabling Enable Debug Dylib Support alone did not fix it, the standalone Release launch still denied. But adding an explicit CloudKit symbol reference did: import CloudKit @main struct YouriBeaconSimulatorApp: App { init() { print(CKRecord.self) } ... } After that, no more deny(1) mach-lookup com.apple.cloudd. Just confirmed it also resolves the issue on an External Distribution build, not just local Release runs. That explains the whole pattern I was seeing. I'm using NSPersistentCloudKitContainer (CoreData+CloudKit), so my code never references any CloudKit symbol directly, CoreData talks to CloudKit dynamically under the hood. With whole-module optimization in Release, the linker had no reason to add a CloudKit.framework load command, since nothing in my source named a CloudKit type. App Sandbox's framework scan never saw CloudKit linked, so it never granted the cloudd exception. Debug worked the whole time for probably an unrelated reason. Enable Debug Dylib Support bundles most of the app into a single dylib for fast incremental builds, which happens to pull in a much broader set of frameworks regardless of whether the code references them. That's what should be the one masking the real problem in every test I ran against Debug. So the underlying issue seems to be that CoreData+CloudKit's dynamic only reference to CloudKit isn't sufficient for App Sandbox to detect and grant the Mach service exception, an explicit static symbol reference somewhere in the app is required for Release/Distribution builds. Any app using CoreData+CloudKit without ever referencing a CloudKit symbol directly would hit this in production. Given that, would it be worth filing this as a separate, more targeted bug, either against the CoreData+CloudKit/App Sandbox interaction, or as a documentation gap? Let me know if you want a fresh Feedback report for it, and I'm happy to include full repro steps. Really appreciate you sticking with this one! this had me stuck for days.

[quote='897632022, Reishandy, /thread/835400?answerId=897632022#897632022, /profile/Reishandy'] Full otool output below. [/quote] . 1. Debug Config + Debug Executable Checked ❯ otool -L /Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Debug/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Debug/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator: @rpath/YouriBeaconSimulator.debug.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0) . 2. Release Config + Debug Executable Checked ❯ otool -L /Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Release/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Release/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator: /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (compatibility version 300.0.0, current version 5026.5.4) /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0) /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2685.60.104) /System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth (compatibility version 1.0.0, current version 195.7.0) /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 5026.5.4) /System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocation (compatibility version 1.0.0, current version 3075.0.8) /System/Library/Frameworks/DeveloperToolsSupport.framework/Versions/A/DeveloperToolsSupport (compatibility version 1.0.0, current version 23.40.26) /System/Library/Frameworks/Security.framework/Versions/A/Security (compatibility version 1.0.0, current version 61901.120.67) /System/Library/Frameworks/SwiftData.framework/Versions/A/SwiftData (compatibility version 0.0.0, current version 0.0.0) /System/Library/Frameworks/SwiftUI.framework/Versions/A/SwiftUI (compatibility version 1.0.0, current version 7.5.3) /System/Library/Frameworks/Symbols.framework/Versions/A/Symbols (compatibility version 1.0.0, current version 190.4.0) /System/Library/Frameworks/UserNotifications.framework/Versions/A/UserNotifications (compatibility version 1.0.0, current version 1.0.0) /System/Library/Frameworks/_SwiftData_SwiftUI.framework/Versions/A/_SwiftData_SwiftUI (compatibility version 1.0.0, current version 135.0.0) /usr/lib/swift/libswiftCore.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0) /usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.2.0, weak) /usr/lib/swift/libswiftCoreLocation.dylib (compatibility version 1.0.0, current version 53.0.0, weak) /usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 1542.100.32) /usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak) /usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 373.2.0, weak) /usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 10.0.0, weak) /usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 951.7.0) /usr/lib/swift/libswiftObservation.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 5.0.0, weak) /usr/lib/swift/libswiftSpatial.dylib (compatibility version 1.0.0, current version 1.0.0, weak) /usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 877.5.1, weak) /usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 128.120.2, weak) /usr/lib/swift/libswift_Builtin_float.dylib (compatibility version 0.0.0, current version 0.0.0, weak) /usr/lib/swift/libswift_Concurrency.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1082.0.0) /usr/lib/swift/libswiftsimd.dylib (compatibility version 1.0.0, current version 23.0.0, weak)

@DTS Engineer Went through your suggested test and found something worth narrowing down further. Following your steps, running the Release scheme from Xcode with the debugger attached does work, no denial. So I ran a few more controlled variants to isolate exactly what flips it: Debug config, debugger attached → works Release config, debugger attached → works Release config, debugger detached (Debug executable unchecked) → denied, full deny(1) mach-lookup com.apple.cloudd cascade, matches the App Store and External Distribution failures exactly The first two share identical build settings with the third except for one thing: whether Xcode's debugger is attached at launch. That's the actual variable that flips the result in my case, not build configuration and not signing identity. To check your CloudKit linking theory, I ran otool -L on all three: The Debug build's output only shows YouriBeaconSimulator.debug.dylib and libSystem.B.dylib nothing else. This turned out to be a red herring rather than a real comparison point: current Xcode Debug builds compile most app code into a separate debug dylib loaded at runtime, so the main executable never shows the real framework graph. Not usable for a linking comparison. The two Release builds, though, are the clean test debugger-attached vs. standalone, same binary, same build settings. Their otool -L output is byte-for-byte identical: same frameworks (AppKit, CoreBluetooth, CoreLocation, SwiftData, SwiftUI, etc.), same versions, nothing missing between the run that works and the run that fails. Neither links CloudKit.framework explicitly, which I'd expect since this is NSPersistentCloudKitContainer (CoreData+CloudKit) rather than a framework the app statically imports. Given the linked-framework set is identical between the working and failing Release runs, I don't think a linking difference explains this one. The discriminator in my case looks like debugger attachment specifically, independent of build configuration or signing type. Full otool output below. (Pardon the AI summary)

. 3. Release Config + Debug Executable Un-Checked ❯ otool -L /Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Release/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Release/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator: /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (compatibility version 300.0.0, current version 5026.5.4) /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0) /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2685.60.104) /System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth (compatibility version 1.0.0, current version 195.7.0) /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 5026.5.4) /System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocation (compatibility version 1.0.0, current version 3075.0.8) /System/Library/Frameworks/DeveloperToolsSupport.framework/Versions/A/DeveloperToolsSupport (compatibility version 1.0.0, current version 23.40.26) /System/Library/Frameworks/Security.framework/Versions/A/Security (compatibility version 1.0.0, current version 61901.120.67) /System/Library/Frameworks/SwiftData.framework/Versions/A/SwiftData (compatibility version 0.0.0, current version 0.0.0) /System/Library/Frameworks/SwiftUI.framework/Versions/A/SwiftUI (compatibility version 1.0.0, current version 7.5.3) /System/Library/Frameworks/Symbols.framework/Versions/A/Symbols (compatibility version 1.0.0, current version 190.4.0) /System/Library/Frameworks/UserNotifications.framework/Versions/A/UserNotifications (compatibility version 1.0.0, current version 1.0.0) /System/Library/Frameworks/_SwiftData_SwiftUI.framework/Versions/A/_SwiftData_SwiftUI (compatibility version 1.0.0, current version 135.0.0) /usr/lib/swift/libswiftCore.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0) /usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.2.0, weak) /usr/lib/swift/libswiftCoreLocation.dylib (compatibility version 1.0.0, current version 53.0.0, weak) /usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 1542.100.32) /usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak) /usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 373.2.0, weak) /usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 10.0.0, weak) /usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 951.7.0) /usr/lib/swift/libswiftObservation.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 5.0.0, weak) /usr/lib/swift/libswiftSpatial.dylib (compatibility version 1.0.0, current version 1.0.0, weak) /usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 877.5.1, weak) /usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 128.120.2, weak) /usr/lib/swift/libswift_Builtin_float.dylib (compatibility version 0.0.0, current version 0.0.0, weak) /usr/lib/swift/libswift_Concurrency.dylib (compatibility version 0.0.0, current version 0.0.0) /usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1082.0.0) /usr/lib/swift/libswiftsimd.dylib (compatibility version 1.0.0, current version 23.0.0, weak) (Pardon the one line straight paste)

[quote='897181022, Reishandy, /thread/835400?answerId=897181022#897181022, /profile/Reishandy'] full output in the next comment [/quote] App Store install Executable=/Applications/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator [Dict] [Key] com.apple.application-identifier [Value] [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.aps-environment [Value] [String] production [Key] com.apple.developer.icloud-container-environment [Value] [String] Production [Key] com.apple.developer.icloud-container-identifiers [Value] [Array] [String] iCloud.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.icloud-services [Value] [Array] [String] CloudKit [Key] com.apple.developer.team-identifier [Value] [String] 6H8PJSZGXA [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.device.bluetooth [Value] [Bool] true [Key] com.apple.security.files.user-selected.read-only [Value] [Bool] true [Key] com.apple.security.network.client [Value] [Bool] true External Distribution Executable=/Users/user/Downloads/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator [Dict] [Key] com.apple.application-identifier [Value] [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.aps-environment [Value] [String] production [Key] com.apple.developer.icloud-container-environment [Value] [String] Production [Key] com.apple.developer.icloud-container-identifiers [Value] [Array] [String] iCloud.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.icloud-services [Value] [Array] [String] CloudKit [Key] com.apple.developer.team-identifier [Value] [String] 6H8PJSZGXA [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.device.bluetooth [Value] [Bool] true [Key] com.apple.security.files.user-selected.read-only [Value] [Bool] true [Key] com.apple.security.network.client [Value] [Bool] true Release scheme, Development signing Executable=/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Release/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator [Dict] [Key] com.apple.application-identifier [Value] [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.aps-environment [Value] [String] development [Key] com.apple.developer.icloud-container-identifiers [Value] [Array] [String] iCloud.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.icloud-services [Value] [Array] [String] CloudKit [Key] com.apple.developer.team-identifier [Value] [String] 6H8PJSZGXA [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.device.bluetooth [Value] [Bool] true [Key] com.apple.security.files.user-selected.read-only [Value] [Bool] true [Key] com.apple.security.get-task-allow [Value] [Bool] true [Key] com.apple.security.network.client [Value] [Bool] true Debug scheme, Development signing Executable=/Users/user/Library/Developer/Xcode/DerivedData/YouriBeaconSimulator-cfzqkuyqxpjvnmghijiizycofmjk/Build/Products/Debug/YouriBeaconSimulator.app/Contents/MacOS/YouriBeaconSimulator [Dict] [Key] com.apple.application-identifier [Value] [String] 6H8PJSZGXA.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.aps-environment [Value] [String] development [Key] com.apple.developer.icloud-container-identifiers [Value] [Array] [String] iCloud.id.reishandy.YouriBeaconSimulator [Key] com.apple.developer.icloud-services [Value] [Array] [String] CloudKit [Key] com.apple.developer.team-identifier [Value] [String] 6H8PJSZGXA [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.device.bluetooth [Value] [Bool] true [Key] com.apple.security.files.user-selected.read-only [Value] [Bool] true [Key] com.apple.security.get-task-allow [Value] [Bool] true [Key] com.apple.security.network.client [Value] [Bool] true

@DTS Engineer Good question, and I tested this specifically because I suspected the same thing you're flagging. The Release-scheme build I referenced was signed with a Development identity, not Distribution. Confirmed via codesign -d --entitlements -, which showed com.apple.security.get-task-allow: true present only on Development signed binaries. So I tested: Debug config, Development signing → works Release config, Development signing → denied (deny(1) mach-lookup com.apple.cloudd) Release config, Distribution signing, External Distribution workflow → denied Release config, Distribution signing, App Store → denied Interestingly, comparing entitlements directly (full output in the next comment): the Debug build and the dev-signed Release build have identical entitlements payloads same keys, same values, both get-task-allow: true, both missing icloud-container-environment, yet one works and one is denied. So for my case the difference doesn't seem to be visible in the entitlements text itself; something else distinguishes the two, possibly the embedded provisioning profile identity even where the entitlements content matches. Entitlements were verified correct on all four variants (icloud-container-identifiers, icloud-services: [CloudKit], matching container ID). App ID / container assignment in the Developer Portal confirmed correct as well.

Seeing the same deny(1) mach-lookup com.apple.cloudd on a sandboxed Mac app (SwiftUI, CloudKit via the standard com.apple.developer.icloud-services/icloud-container-identifiers entitlements, not SwiftData). Environment: macOS 26.5.1, Xcode 26.5 — same as OP. What I've confirmed so far: codesign -d --entitlements - on the App Store–downloaded binary shows correct entitlements: icloud-container-identifiers, icloud-services: [CloudKit], icloud-container-environment: Production, matching App ID/container config in the Developer Portal. App ID in the portal has iCloud capability enabled with the correct container assigned (1 of 1 selected) — ruled out a portal-side misconfiguration. Reproduced independently on a second Mac (different machine, App Store install) with the same deny. One difference from the OP's report: in my case, a local Release-scheme build run via Xcode also gets denied, while the Debug-scheme build works fine. So the discriminator for me looks like Debug vs. Release configuration, not strictly "Xcode-launched vs. TestFlight" as in the OP's finding. Wanted to flag the second-machine repro and the Debug/Release discrepancy in case either is useful signal, since this looks like it could affect any Mac Store/CloudKit app on macOS 26.5.1 rather than being isolated to one project. Ref Project's GitHub Repo