When it breaks

The failures you will actually meet, in rough order of frequency.

Start with leas doctor

Most of the table below is diagnosable before a build ever starts. leas doctor resolves every credential the way a build would, reads what is actually inside them, and calls Apple and Google to confirm the keys work — in about two seconds.

leas doctor                      # everything, including live API checks
leas doctor --offline            # skip the calls to Apple and Google
leas doctor --json               # machine-readable, for CI

It exits non-zero when anything is broken, so it works as a gate in front of an expensive cloud build. The checks worth knowing about:

• Identifier drift. That app.json, leas.json, and the provisioning profile all name the same app. This is the single most common cause of a failed build, and it is invisible until xcodebuild refuses.
• Certificate and profile together. A certificate the profile does not list cannot sign against it. doctor compares the fingerprint of the certificate inside your .p12 against the ones the profile embeds.
• Ad-hoc masquerading as App Store. A profile that provisions specific devices is an ad-hoc profile. Exporting it with app-store fails late and confusingly.
• Expiry, early. Certificates last three years and profiles one. It warns thirty days out instead of on the morning you need to ship a hotfix.
• The store APIs, for real. It distinguishes a rejected key (401) from a key with no role granted (403), and opens and immediately abandons a Play edit — the only way to prove the service account was actually granted release permission on that app.
• The fleet. That the workflows exist and every secret they reference is present on the repository.