Thank you Quinn — that explains it, and the behaviour you described is exactly what we observed. All three of the original submissions eventually came back Accepted, and the 210-byte test payload correctly came back Invalid. So nothing was actually broken; my test payload was simply queued behind the request that had been pulled in for additional analysis, which is the head-of-line behaviour you described. I had assumed a small unsigned payload would be evaluated independently, and that assumption was wrong. The "the system will learn to recognise them" part is also very visible in the numbers. For the record, in case it helps anyone finding this thread later: First submissions: roughly 36 hours before completing. Today's release build, same app, four submissions back to back (two .app archives and two .pkg installers, arm64 and x86_64): all four Accepted, each within about two minutes. The whole build finished in under ten minutes. So the practical advice for anyone hitting this on a first Developer ID build appears to be: wait, and do not resubmit. Resubmitting only adds more work behind the request that is already being analysed. Thanks also for the Notarisation Resources link — the Q&A with the notary service team answered several other questions I had.