macOS Remote Control fails security requirements — CUAService app-group entitlement mismatches provisioning profile

Summary

ChatGPT Remote Control on macOS fails during:

Settings → Connections → Remote → Control this Mac → Get started

with:

Couldn't check security requirements. Try again.

The underlying Codex Computer Use (CUA) service launches, but macOS rejects its application-group entitlement because the signed entitlement and embedded provisioning profile do not match.

Environment

• ChatGPT macOS: 26.908.40834 (build 8881)
• macOS: 26.5.2 (25F84)
• Architecture: arm64
• MDM enrollment: No
• DEP enrollment: No
• FileVault: On
• SIP: Enabled
• Gatekeeper assessments: Enabled
• Secure Token: Enabled

Affected helper:

~/.codex/computer-use/Codex Computer Use.app

Bundle identifier: com.openai.sky.CUAService

Team identifier: 2DC432GLL2

Signing authority: Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

Reproduction

1. Open ChatGPT for macOS.
2. Go to Settings → Connections → Remote.
3. Select Control this Mac.
4. Select Connect a device to this Mac.
5. Click Get started.
6. ChatGPT reports Couldn't check security requirements. Try again.

Findings

The CUA service launches from:

~/.codex/computer-use/Codex Computer Use.app/Contents/MacOS/SkyComputerUseService

codesign --verify --deep --strict succeeds with valid on disk and satisfies its Designated Requirement.

However, the app's signed entitlements contain:

com.apple.security.application-groups =
    2DC432GLL2.com.openai.sky.CUAService

while its embedded provisioning profile authorizes:

com.apple.security.application-groups =
    group.com.openai.sky.CUAService
    2DC432GLL2.*

macOS trustd repeatedly reports:

Entitlement com.apple.security.application-groups=(
    "2DC432GLL2.com.openai.codex.notifications",
    "2DC432GLL2.com.openai.sky.CUAService"
) is ignored because of invalid application signature or incorrect provisioning profile

The application-group identifier requested by the signed executable therefore appears not to match the explicitly provisioned application group.

Downstream failure

After the entitlement rejection, ChatGPT logs:

RemoteHostedPIPContent CUAService bootstrap failed:
Error Domain=NSOSStatusErrorDomain Code=-1712

LaunchServices sees the running CUA application at ~/.codex/computer-use/Codex Computer Use.app, with CFBundleIdentifier = com.openai.sky.CUAService and CFBundleExecutable = SkyComputerUseService.

Troubleshooting already performed

• Tested another network / mobile hotspot
• Verified FileVault, SIP, Gatekeeper and Secure Token
• Verified nested CUA app signatures with codesign
• Checked quarantine attributes
• Re-registered bundled CUA components with LaunchServices
• Restarted LaunchServices
• Launched the bundled Computer Use helper/installer directly
• Confirmed SkyComputerUseService actually launches

The problem persists.

Suspected cause

This appears to be a signing/provisioning issue in the distributed Codex Computer Use bundle.

Specifically:

• Signed entitlement: 2DC432GLL2.com.openai.sky.CUAService
• Provisioning profile: group.com.openai.sky.CUAService

macOS consequently rejects/ignores the application-group entitlement, after which CUA bootstrap times out.

Could you confirm whether the CUAService entitlement or provisioning profile in the current macOS build is incorrect?

Start with ~/.codex/computer-use/Codex Computer Use.app and reproduce the Control this Mac flow. Inspect the signed entitlements and embedded provisioning profile for com.openai.sky.CUAService, using the codesign findings in the report as a baseline. Done means the application-group values agree and the CUA service bootstraps without the security-requirements or timeout error.