What is an iOS provisioning profile and what three security-relevant fields does it contain that the device checks at app launch?

• A.A) A provisioning profile is a signed XML/plist that embeds: (1) the list of authorized device UDIDs (for development/ad-hoc) or a wildcard for distribution; (2) the app's entitlements (capabilities the app is authorized to use); (3) the certificate(s) authorized to sign the app. The device verifies all three at install and launch time via AMFI (AppleMobileFileIntegrity).
• B.B) A provisioning profile contains only the developer's name and bundle ID; security checks are performed server-side by Apple.
• C.C) Provisioning profiles are only needed for development builds; App Store distribution uses a universal certificate that requires no provisioning profile.