Yes, you are correct. Thanks for the terminology help. I have two targets - for Mac App Store distribution (not yet tried) and Developer ID distribution, notarized (currently failing). I have configured for automatic signing and created the archive. From Xcode organizer, the Validate response is: which wants a /Applications install destination and the enabled .security.app-sandbox entitlement. Then, from the Distribute option: So no go. I have not used xcodebuild, but these failures seem to be from some Xcode (15.4) requirement for hardened runtime and sandboxing. This failure right at this stage is what's different than the last years of distributions. I will brush up on xcodebuild and try that. I'll get back if it works, but the sandboxing problem seems to be the first hurdle.

A couple of things have gone right today. First, I filed a bug report (FB14610234) about the ambiguous Validate button in the Xcode Organizer Archives presentation, and a weirdness in that little popup filter at the top left. I've been back through all my build settings for both targets, and there's no mention anywhere anymore of Developer ID certs. I built, notarized and delivered a Developer ID release just an hour ago, and the same code, different target is in Review for App Store distribution right now. I still have a mess having maxed out my Dev ID certificates. I'll reread "The Care and Feeding…".