macOS TCC Blocked App Despite Full Disk Access Due to Invalid Code Signature

A Flutter-based macOS disk utility called Helm was silently denied Full Disk Access by macOS despite the permission being explicitly granted in System Settings. Investigation revealed that macOS TCC validates an app's full code signature bundle integrity, not just its name or permission entry, before honoring privacy permissions. A codesign verification check exposed a mismatch between the sealed App.framework recorded at build time and the actual framework present in the bundle. The mismatch was traced to an Xcode build system crash that caused Flutter's embed step to run while the app's re-signing step was skipped, leaving a framework from a different build inside the signed bundle. The developer fixed the issue by re-signing the bundle and updated the release script to always verify code signatures on every build path, regardless of whether a Developer ID certificate is present.