An existing development-signed arm64 iPad Release build succeeds in Xcode, including its code-signing step. Post-build static verification from a restricted automation environment reports CSSMERR_TP_NOT_TRUSTED for Runner, App.framework, and Flutter.framework. The recorded commands were: codesign --verify --deep --strict --verbose=6 <app-path> codesign --display --entitlements - --xml <app-path> The entitlements command returns no XML and reports: binary contains an invalid entitlements blob; OS will ignore these entitlements This warning occurs only for Runner. The two frameworks have no entitlements slots. A public Security framework code-signing trust evaluation returned false, TrustResultValue 0, and an empty detailed result. The error and last underlying error were NSOSStatusErrorDomain / -26276, with description "OSStatus -26276". Existing observations: The Apple Development signing certificate matches the provisioning profile, which includes the target iPad. Keychain Access showed valid certificates using system-default trust. Offline code-page/resource hash and CMS signature checks matched. Offline parsing found matching XML/DER entitlement values within the profile's allowed values. These checks do not establish native trust or installation validity. The host is an Apple Silicon Mac and the target is a physical iPad. We have not isolated a focused Xcode sample that reproduces this issue. The original app contains Flutter and other integrations. We do not know whether the cause is in the artifact, trust evaluation, or the restricted execution environment. An OS log query was denied by that environment; it has not been retried or bypassed. We have not changed certificate trust, re-signed, rebuilt, or attempted installation to work around the verification failure. What supported, narrowly scoped diagnostic procedure would: distinguish a genuine trust-policy rejection from an evaluation that could not complete, diagnose the Runner-only entitlements warning, and establish whether the unchanged artifact is installable? Please advise the minimum redacted evidence or focused sample needed. We are seeking Apple's supported diagnostic route without exporting credentials or weakening trust settings. Attachments: none.