AppArmor transition to subprofile - profile not found

Question

I'm trying to write a custom AppArmor profile for a PHP application. The PHP application is run by PHP-FPM (PHP master process). I want to confine everything PHP is executing via shell_exec/exec/proc_open/... with a special profile/hat.

I have the following structure of profiles:

docker-php-fpm
-> ^phpfpmmaster 
-> ^userprogs 

Now the phpfpmmaster (strangely, apparmor does not support dashes in profile names when used in transitions) has a rule to transition to the userprogs profile:

^phpfpmmaster flags=(attach_disconnected,mediate_deleted) {
  ..
  /bin/dash  rCx -> userprogs,
  ..
}

But the audit.log says that AppArmor can't find the profile:

type=AVC msg=audit(1525448842.598:1849368): apparmor="DENIED" operation="exec" info="profile transition not found" error=-13 profile="docker-php-fpm//phpfpmmaster" name="/bin/dash" pid=19686 comm="php-fpm" requested_mask="x" denied_mask="x" fsuid=377118 ouid=0

I understand that this could be because the Cx is looking for the child profile in the ^phpfpmmaster hat. Making it a child profile/hat, apparmor_parser says it can't replace the profile because it is not found.

I then tried naming the hat "phpfpmmaster//userprogs". apparmor_parser accepts this, but still the profile transition failes with "profile transition not found".

How can I confine the /bin/dash execution to a new profile/hat?