It took me hours to solve it. Given that someone is using custom scripts to sign and pack while others are using xcode itself, there's only one way to check what ended in your app. Dump you entitlements with
codesign --display --entitlements :- path/to/MyApp.app
and check aps-environment
and application-identifier
.