Thank you Quinn, I've opened a DTS support issue, and tagged this thread.

Hey Quinn, thank you for your reply. SHA-256 is identical in both shasum -a 256 WandDesktop.zip and the hash from notarytool. codesign -v -vvv --deep --strict WandDesktop.app: After unziping: WandDesktop.app: valid on disk WandDesktop.app: satisfies its Designated Requirement also ran on the binary, same output.

Can you elaborate? Isn't the flow of notarizing is to zip it with ditto (an option) and only then to send to notarize? Also, the path indicates the binary located inside the .app file, which is inside the zip. "WandDesktop.zip/WandDesktop.app/Contents/MacOS/WandDesktop"