Sandbox failing, no masreceipt

Attempting to build and run apps that require a receipt is consistently failing as no masreceipt is stored in the app bundle after the login/password dialog has been submitted.

The log typically contains lines starting:

StoreLegacy: Failed to renew receipt for application at path...

sometimes we get the "app is damaged download again" dialog when attempting to launch

We have tried:

• macOS 10.13.6, Xcode 10.1

• macOS 10.15.6, Xcode 11.6

• logging out from the App Store

• creating a new sandbox account (including in a different region)

• two different projects

• checked apps are signed with valid certs

• rebooting, rebuilding, cleaning project of course

It's worked plenty of time before but we haven't run such tests for months.

Any ideas what we're doing wrong or what we should kick next? TIA