diff --git a/ansible/cord-inv b/ansible/cord-inv
index c0ec4c8..9994c8e 100644
--- a/ansible/cord-inv
+++ b/ansible/cord-inv
@@ -1,6 +1,11 @@
 [head]
 ${headnode_ip} ansible_user=${headnode_user} ansible_ssh_pass=${headnode_pass} ansible_port=${headnode_port}
 
-[compute]
+[build]
+localhost ansible_connection=local
 
+[config]
+localhost ansible_connection=local
+
+[compute]
 
diff --git a/build.gradle b/build.gradle
index 4809470..1cbe5a4 100644
--- a/build.gradle
+++ b/build.gradle
@@ -197,50 +197,49 @@
 tasks.addRule(new DockerPublishRule(project, project(':maas').prime))
 tasks.addRule(new DockerTagRule(project))
 
-task CopyCord(type: Exec) {
+task PIcreateConfig(type: Exec) {
   dependsOn writeYamlConfig
   dependsOn writeInventory
 
-  executable = "ansible"
-  args = [ "-i", "genconfig/cord-inv", "-b", "--extra-vars", "@./genconfig/config.yml", "-m", "synchronize", "-a", "src='../../' dest='$config.common.cord_dir'", "head" ]
-}
-
-task ChownCord(type: Exec) {
-  dependsOn CopyCord
-
-  executable = "ansible"
-  args = [ "-i", "genconfig/cord-inv", "-b", "--extra-vars", "@./genconfig/config.yml", "-m", "file", "-a", "state='directory' dest='$config.common.cord_dir' recurse='yes' owner='$config.headnode.ansible_user'", "head" ]
-}
-
-task PIinstallPKI(type: Exec) {
-  workingDir "platform-install"
-  executable = "ansible-playbook"
-  args = [ "-i", "../genconfig/cord-inv",
-    "--extra-vars", "@../genconfig/config.yml",
-    "pki-install-playbook.yml" ]
-}
-
-task PIcreateProfile(type: Exec) {
-  dependsOn PIinstallPKI
-
   workingDir "platform-install"
   executable = "ansible-playbook"
   args = [ "-i", "../genconfig/cord-inv",
     "--extra-vars", "@../genconfig/config.yml",
     "--extra-vars", "deploy_docker_tag="+targetTag,
     "--extra-vars", "deploy_docker_registry=docker-registry:5000/",
-    "cord-profile-playbook.yml" ]
+    "cord-config-playbook.yml" ]
+}
+
+task PIcopyCord(type: Exec) {
+  dependsOn PIcreateConfig
+
+  workingDir "platform-install"
+  executable = "ansible-playbook"
+  args = [ "-i", "../genconfig/cord-inv",
+    "--extra-vars", "@../genconfig/config.yml",
+    "copy-cord-playbook.yml" ]
+}
+
+task PIcopyProfile(type: Exec) {
+  dependsOn PIcreateConfig
+
+  workingDir "platform-install"
+  executable = "ansible-playbook"
+  args = [ "-i", "../genconfig/cord-inv",
+    "--extra-vars", "@../genconfig/config.yml",
+    "copy-profile-playbook.yml" ]
 }
 
 task PIprepPlatform(type: Exec) {
-  dependsOn CopyCord
-  dependsOn ChownCord
-  dependsOn PIcreateProfile
+  dependsOn PIcreateConfig
+  dependsOn PIcopyCord
+  dependsOn PIcopyProfile
 
-  def ansible_cmd = "cd $config.common.cord_dir/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @$config.common.cord_dir/build/genconfig/config.yml prep-platform-playbook.yml"
-
-  executable = "ssh"
-  args = ["-p", "$config.headnode.ansible_ssh_port", "$config.headnode.ansible_user@$config.headnode.ip", ansible_cmd ]
+  workingDir "platform-install"
+  executable = "ansible-playbook"
+  args = [ "-i", "../genconfig/cord-inv",
+    "--extra-vars", "@../genconfig/config.yml",
+    "prep-platform-playbook.yml" ]
 }
 
 task PIdeployOpenStack (type: Exec) {
@@ -255,23 +254,26 @@
 }
 
 task PIdeployONOS (type: Exec) {
-  def extra_vars = "--extra-vars deploy_docker_tag="+targetTag+" --extra-vars deploy_docker_registry=docker-registry:5000/"
-  def ansible_cmd = "cd $config.common.cord_dir/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @$config.common.cord_dir/build/genconfig/config.yml "+extra_vars+" deploy-onos-playbook.yml"
 
-  executable = "ssh"
-  args = ["-p", "$config.headnode.ansible_ssh_port", "$config.headnode.ansible_user@$config.headnode.ip", ansible_cmd ]
+  workingDir "platform-install"
+  executable = "ansible-playbook"
+  args = [ "-i", "../genconfig/cord-inv",
+    "--extra-vars", "@../genconfig/config.yml",
+    "--extra-vars", "deploy_docker_tag="+targetTag,
+    "--extra-vars", "deploy_docker_registry=docker-registry:5000/",
+    "deploy-onos-playbook.yml" ]
 }
 
 task PIdeployXOS (type: Exec) {
   def extra_vars = "--extra-vars deploy_docker_tag="+targetTag+" --extra-vars deploy_docker_registry=docker-registry:5000/"
-  def ansible_cmd = "cd $config.common.cord_dir/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @$config.common.cord_dir/build/genconfig/config.yml "+extra_vars+" launch-xos-playbook.yml"
+  def ansible_cmd = "cd /opt/cord/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @/opt/cord/build/genconfig/config.yml "+extra_vars+" launch-xos-playbook.yml"
 
   executable = "ssh"
   args = ["-p", "$config.headnode.ansible_ssh_port", "$config.headnode.ansible_user@$config.headnode.ip", ansible_cmd ]
 }
 
 task PIsetupAutomation (type: Exec) {
-  def ansible_cmd = "cd $config.common.cord_dir/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @$config.common.cord_dir/build/genconfig/config.yml cord-automation-playbook.yml"
+  def ansible_cmd = "cd /opt/cord/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @/opt/cord/build/genconfig/config.yml cord-automation-playbook.yml"
 
   executable = "ssh"
   args = ["-p", "$config.headnode.ansible_ssh_port", "$config.headnode.ansible_user@$config.headnode.ip", ansible_cmd ]
@@ -286,14 +288,12 @@
 
 task postDeployTests (type: Exec) {
 
-  def ansible_cmd = "cd $config.common.cord_dir/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @$config.common.cord_dir/build/genconfig/config.yml pod-test-playbook.yml"
+  def ansible_cmd = "cd /opt/cord/build/platform-install; ansible-playbook -i inventory/head-localhost --extra-vars @/opt/cord/build/genconfig/config.yml pod-test-playbook.yml"
 
   executable = "ssh"
   args = ["-p", "$config.headnode.ansible_ssh_port", "$config.headnode.ansible_user@$config.headnode.ip", ansible_cmd ]
 }
 
-
-
 project(':maas').prime.dependsOn writeYamlConfig
 project(':maas').prime.dependsOn writeInventory
 
@@ -306,12 +306,14 @@
 // Ensure nginx:candidate exists
 project(':orchestration:xos').buildImages.dependsOn rootProject."tagnginx"
 
+// make PI config tasks run before maas deploy
+project(':maas').deployBase.dependsOn PIcopyProfile
+
 // For corebuilder
 project(':platform-install').buildImages.dependsOn project(':orchestration:xos').buildImages
 
 task PIdeployPlatform {
-     dependsOn CopyCord
-     dependsOn ChownCord
+     dependsOn PIcopyCord
      dependsOn project(':onos-apps').deploy
      dependsOn project(':maas').deployBase
      dependsOn PIprepPlatform
@@ -321,8 +323,7 @@
      dependsOn PIsetupAutomation
 }
 
-ChownCord.mustRunAfter CopyCord
-PIprepPlatform.mustRunAfter ChownCord
+PIprepPlatform.mustRunAfter PIcopyCord
 PIdeployOpenStack.mustRunAfter PIprepPlatform
 PIdeployONOS.mustRunAfter PIdeployOpenStack
 PIdeployXOS.mustRunAfter PIdeployONOS
diff --git a/config/cord_in_a_box.yml b/config/cord_in_a_box.yml
index f3ce426..b93d496 100644
--- a/config/cord_in_a_box.yml
+++ b/config/cord_in_a_box.yml
@@ -18,13 +18,14 @@
   # set to the "flavor" of cord you want to install
   cord_profile: 'rcord'
 
-  # set paths to appropriate values
-  cord_dir: '/opt/cord'
-  cord_profile_dir: '/opt/cord_profile'
+  # cord dir is shared to corddev VM, may need redirection to work
   credentials_dir: '/opt/credentials'
   pki_dir: '/opt/pki'
   ssh_pki_dir: '/opt/ssh_pki'
 
+  # for cord in a box, config = build, so set config_cord_dir to /opt/cord
+  config_cord_dir: '/cord'
+
   # Specifies tasks within the head node provisioning not to execute, including:
   #
   # switch_support -   don't download the switch ONL images as there are no
diff --git a/config/default.yml b/config/default.yml
index 3799407..ade946a 100644
--- a/config/default.yml
+++ b/config/default.yml
@@ -17,9 +17,7 @@
   # set to the profile of cord you want to install
   cord_profile: 'rcord'
 
-  # directories on the head node that the cord dir is copied to, and profile is created in
-  cord_dir: '/opt/cord'
-  cord_profile_dir: '/opt/cord_profile'
+  # cord dir is shared to corddev VM, causing permissions issues if these aren't set
   credentials_dir: '/opt/credentials'
   pki_dir: '/opt/pki'
   ssh_pki_dir: '/opt/ssh_pki'
diff --git a/config/ecord_global_in_a_box.yml b/config/ecord_global_in_a_box.yml
index 1956c67..6c8478c 100644
--- a/config/ecord_global_in_a_box.yml
+++ b/config/ecord_global_in_a_box.yml
@@ -17,8 +17,6 @@
 
   # set to the "flavor" of cord you want to install
   cord_profile: 'ecord-global'
-  cord_dir: '/opt/cord'
-  cord_profile_dir: '/opt/cord_profile'
 
   # Specifies tasks within the head node provisioning not to execute, including:
   #
diff --git a/config/ecord_in_a_box.yml b/config/ecord_in_a_box.yml
index 827ff04..9c5f50e 100644
--- a/config/ecord_in_a_box.yml
+++ b/config/ecord_in_a_box.yml
@@ -17,8 +17,6 @@
 
   # set to the "flavor" of cord you want to install
   cord_profile: 'ecord'
-  cord_dir: '/opt/cord'
-  cord_profile_dir: '/opt/cord_profile'
 
   # Specifies tasks within the head node provisioning not to execute, including:
   #
diff --git a/config/onlab_develop_pod.yml b/config/onlab_develop_pod.yml
index 6f3ce06..7e97199 100644
--- a/config/onlab_develop_pod.yml
+++ b/config/onlab_develop_pod.yml
@@ -13,9 +13,7 @@
   # set to the profile of cord you want to install
   cord_profile: 'rcord'
 
-  # directories on the head node that the cord dir is copied to, and profile is created in
-  cord_dir: '/opt/cord'
-  cord_profile_dir: '/opt/cord_profile'
+  # cord dir is shared to corddev VM, causing permissions issues if these aren't set
   credentials_dir: '/opt/credentials'
   pki_dir: '/opt/pki'
   ssh_pki_dir: '/opt/ssh_pki'
diff --git a/config/sample.yml b/config/sample.yml
index 4a5adbc..0e37ebe 100644
--- a/config/sample.yml
+++ b/config/sample.yml
@@ -11,9 +11,7 @@
   # set to the profile of cord you want to install
   cord_profile: 'rcord'
 
-  # directories on the head node that the cord dir is copied to, and profile is created in
-  cord_dir: '/opt/cord'
-  cord_profile_dir: '/opt/cord_profile'
+  # cord dir is shared to corddev VM, causing permissions issues if these aren't set
   credentials_dir: '/opt/credentials'
   pki_dir: '/opt/pki'
   ssh_pki_dir: '/opt/ssh_pki'
diff --git a/scripts/cord-in-a-box.sh b/scripts/cord-in-a-box.sh
index 8bfe450..45c2f64 100755
--- a/scripts/cord-in-a-box.sh
+++ b/scripts/cord-in-a-box.sh
@@ -208,8 +208,12 @@
   # It allows SSH'ing to the machine via 'ssh corddev'
   sudo su $USER -c "VAGRANT_CWD=$VAGRANT_CWD vagrant ssh-config corddev prod > $SSHCONFIG"
 
+  # copy host SSH key to corddev, allow it access on prod (vagrant ssh key already has access)
   scp ~/.ssh/id_rsa* corddev:.ssh
   ssh corddev "chmod go-r ~/.ssh/id_rsa"
+
+  scp ~/.ssh/id_rsa.pub prod:/tmp/install_id_rsa.pub
+  ssh prod "cat /tmp/install_id_rsa.pub >> ~/.ssh/authorized_keys"
 }
 
 function install_head_node() {