Fix signing and entitlement errors

Recover device builds and Apple capabilities without damaging app identity.

Signing connects the app, bundle identifier, Apple Developer team, certificate, profile, and requested capabilities. Changing several of them together can turn one configuration issue into a new project identity.

Protect the app identity

Check in this order

1. Confirm the correct Apple Developer team is selected.
2. Verify the membership is active and pending Apple agreements are complete.
3. Match the project bundle identifier to the intended App ID and App Store record.
4. Confirm each requested capability is enabled for that identifier.
5. Check that the entitlements file and provisioning profile agree.
6. Reconnect the Apple account if authorization expired, then rebuild.

Typical capability failures

• Sign in with Apple capability or return configuration is missing.
• Push notification entitlement is absent or uses the wrong environment.
• App groups, keychain groups, or associated domains do not match the developer portal.
• iCloud, HealthKit, or another restricted capability is not enabled for the App ID.
• An external coding agent changed the signing team or entitlements.

Certificate limits

If Apple reports a certificate limit, identify which certificate belongs to the current setup before revoking anything. Revocation can break other apps, developers, or Xcode installations using that certificate.