What is an iOS provisioning profile and what three security-relevant fields does it contain that the device checks at app launch?

• A.A provisioning profile is a signed XML/plist that embeds: (1) the list of authorized device UDIDs (for development/ad-hoc) or a wildcard for distribution; (2) the app's entitlements (capabilities the app is authorized to use); (3) the certificate(s) authorized to sign the app. The device verifies all three at install and launch time via AMFI (AppleMobileFileIntegrity).
• B.A provisioning profile is a development artifact alone and a store build carries no profile at all (the submission strips it during processing): the device checks the signature against Apple's own root and nothing else at launch. Entitlements travel inside the binary's code signature instead.
• C.A provisioning profile records the developer's name and the bundle identifier (the file is a plain property list): the device reads it for display purposes and never for a security decision. Every enforcement happens in the code signature.