diff --git a/applications/accounts-api/Dockerfile b/applications/accounts-api/Dockerfile
index 0d8f6e645..c3f9ea104 100644
--- a/applications/accounts-api/Dockerfile
+++ b/applications/accounts-api/Dockerfile
@@ -13,5 +13,3 @@ RUN pip3 install --no-cache-dir -r requirements.txt
 COPY backend /usr/src/app
 
 RUN pip3 install -e .
-
-ENTRYPOINT gunicorn --workers=$WORKERS --bind=0.0.0.0:$PORT $MODULE_NAME.__main__:app
diff --git a/applications/accounts-api/backend/requirements.txt b/applications/accounts-api/backend/requirements.txt
index f9289e172..68760177c 100644
--- a/applications/accounts-api/backend/requirements.txt
+++ b/applications/accounts-api/backend/requirements.txt
@@ -1,11 +1,9 @@
-connexion[swagger-ui] >= 2.6.0; python_version>="3.6"
-# 2.3 is the last version that supports python 3.4-3.5
-connexion[swagger-ui] <= 2.3.0; python_version=="3.5" or python_version=="3.4"
-# connexion requires werkzeug but connexion < 2.4.0 does not install werkzeug
-# we must peg werkzeug versions below to fix connexion
-# https://github.com/zalando/connexion/pull/1044
-werkzeug == 2.2.3; python_version=="3.5" or python_version=="3.4"
-swagger-ui-bundle >= 0.0.2
-python_dateutil >= 2.6.0
-setuptools >= 21.0.0
-cloudharness
+connexion[swagger-ui,flask,uvicorn]>=3.0.0,<4.0.0
+swagger-ui-bundle>=1.1.0
+python_dateutil>=2.9.0
+setuptools>=21.0.0
+uvicorn
+# Following some unnecessary requirements to make sure they can be installed
+psycopg2-binary
+sqlalchemy<2.0.0
+scipy
\ No newline at end of file
diff --git a/applications/accounts-api/backend/setup.py b/applications/accounts-api/backend/setup.py
index e16a0a2e5..705dcf730 100644
--- a/applications/accounts-api/backend/setup.py
+++ b/applications/accounts-api/backend/setup.py
@@ -14,10 +14,10 @@
 # http://pypi.python.org/pypi/setuptools
 
 REQUIRES = [
-    "connexion>=2.0.2",
-    "swagger-ui-bundle>=0.0.2",
-    "python_dateutil>=2.6.0",
-    "cloudharness"
+    "connexion[swagger-ui,flask,uvicorn]>=3.0.0,<4.0.0",
+    "Flask",
+    "swagger-ui-bundle",
+    "cloudharness",
 ]
 
 setup(
diff --git a/applications/accounts/deploy/resources/realm.json b/applications/accounts/deploy/resources/realm.json
index 80888301c..c9d38951e 100644
--- a/applications/accounts/deploy/resources/realm.json
+++ b/applications/accounts/deploy/resources/realm.json
@@ -322,6 +322,34 @@
                     "offline_access",
                     "microprofile-jwt"
                 ]
+            },
+            {
+                "clientId": "idp-arc",
+                "name": "idp-arc",
+                "enabled": true,
+                "publicClient": true,
+                "standardFlowEnabled": true,
+                "implicitFlowEnabled": false,
+                "directAccessGrantsEnabled": false,
+                "serviceAccountsEnabled": false,
+                "protocol": "openid-connect",
+                "rootUrl": "{{ .Values.idpArc.rootUrl }}",
+                "redirectUris": [
+                    "{{ .Values.idpArc.rootUrl }}/*"
+                ],
+                "webOrigins": [
+                    "{{ .Values.idpArc.rootUrl }}"
+                ],
+                "attributes": {
+                    "pkce.code.challenge.method": "S256"
+                },
+                "fullScopeAllowed": true,
+                "defaultClientScopes": [
+                    "web-origins", "profile", "roles", "email"
+                ],
+                "optionalClientScopes": [
+                    "offline_access", "{{ .Values.apps.accounts.admin.role }}-scope"
+                ]
             }
         ],
         "clientScopes": [
diff --git a/applications/jupyterlab/Dockerfile b/applications/jupyterlab/Dockerfile
index 9799c8b93..3b142019c 100644
--- a/applications/jupyterlab/Dockerfile
+++ b/applications/jupyterlab/Dockerfile
@@ -77,15 +77,15 @@ USER root
 RUN conda install conda-forge::nest-simulator
 ENV NEST_HOME=/opt/conda
 
-USER jovyan
-
-#### Install Python packages
+#### Install Python packages (as root to avoid permission issues with conda-managed packages)
 
 RUN --mount=type=cache,target=/root/.cache python -m pip install --upgrade pip && \ 
     pip install backports.tarfile>=1.2 # temp fix for error: ImportError: cannot import name 'tarfile' from 'backports'
 RUN --mount=type=cache,target=/root/.cache python -m pip install --upgrade pip &&\ 
     pip install -r requirements.txt --upgrade --no-cache-dir
 
+USER jovyan
+
 #  Compile NEURON mod files for PyNN
 RUN cd /opt/conda/lib/python3.12/site-packages/pyNN/neuron/nmodl && nrnivmodl
 
diff --git a/applications/jupyterlab/requirements.txt b/applications/jupyterlab/requirements.txt
index cce0760db..cd64d940d 100644
--- a/applications/jupyterlab/requirements.txt
+++ b/applications/jupyterlab/requirements.txt
@@ -3,7 +3,7 @@ pyelectro
 neurotune
 
 ####  NEURON & NetPyNE
-neuron
+neuron<9
 
 # Install specific version of NetPyNE
 git+https://github.com/Neurosim-lab/netpyne.git@osbv2#egg=netpyne
diff --git a/applications/netpyne/Dockerfile b/applications/netpyne/Dockerfile
index eca06eea7..f5788e99a 100644
--- a/applications/netpyne/Dockerfile
+++ b/applications/netpyne/Dockerfile
@@ -1,6 +1,6 @@
 
 
-FROM node:18 AS jsbuild
+FROM node:16-bullseye AS jsbuild
 ARG APP_DIR=dependencies/NetPyNE-UI
 ENV FOLDER=netpyne
 
diff --git a/applications/netpyne/dependencies/NetPyNE-UI b/applications/netpyne/dependencies/NetPyNE-UI
deleted file mode 160000
index 73c357ce0..000000000
--- a/applications/netpyne/dependencies/NetPyNE-UI
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 73c357ce07c9ddc6b2a77bfa32fd5e511e389818
diff --git a/applications/netpyne/deploy/values.yaml b/applications/netpyne/deploy/values.yaml
index 542737608..69f9a87d5 100644
--- a/applications/netpyne/deploy/values.yaml
+++ b/applications/netpyne/deploy/values.yaml
@@ -1,7 +1,5 @@
 harness:
   subdomain: netpyne
-  secured: true
-  uri_role_mapping: []
   service:
     auto: false
     port: 80
diff --git a/applications/nfsserver/deploy/values-dev.yaml b/applications/nfsserver/deploy/values-dev.yaml
index 128b140b1..434336ef7 100644
--- a/applications/nfsserver/deploy/values-dev.yaml
+++ b/applications/nfsserver/deploy/values-dev.yaml
@@ -1,4 +1,4 @@
 nfs:
   useDNS: true
 server:
-  diskSize: 80Gi
\ No newline at end of file
+  diskSize: 160Gi
\ No newline at end of file
diff --git a/applications/nfsserver/deploy/values.yaml b/applications/nfsserver/deploy/values.yaml
index 516975127..905cfc9a8 100644
--- a/applications/nfsserver/deploy/values.yaml
+++ b/applications/nfsserver/deploy/values.yaml
@@ -2,7 +2,7 @@
 harness:
   deployment:
     auto: false
-    image: gcr.io/metacellllc/osb/nfsserver:0.7.6
+    image: gcr.io/metacellllc/cloud-harness/nfsserver:featurech-261
 # nfs server pvc disk size (/exports)
 server:
   diskSize: 240Gi
diff --git a/applications/osb-portal/src/components/workspace/WorkspaceFrame.tsx b/applications/osb-portal/src/components/workspace/WorkspaceFrame.tsx
index cc20e2bfe..b0bf46ba5 100644
--- a/applications/osb-portal/src/components/workspace/WorkspaceFrame.tsx
+++ b/applications/osb-portal/src/components/workspace/WorkspaceFrame.tsx
@@ -3,6 +3,10 @@ import { useParams } from "react-router-dom";
 import { AnyAction, Dispatch } from "redux";
 import { PayloadAction } from "@reduxjs/toolkit";
 
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import Typography from "@mui/material/Typography";
+
 import {
   Workspace,
   WorkspaceResource,
@@ -10,6 +14,7 @@ import {
   ResourceStatus,
 } from "../../types/workspace";
 import { UserInfo } from "../../types/user";
+import workspaceService from "../../service/WorkspaceService";
 import WorkspaceResourceService from "../../service/WorkspaceResourceService";
 import { getBaseDomain, getApplicationDomain } from "../../utils";
 
@@ -30,6 +35,8 @@ export const WorkspaceFrame = (props: {
   currentResource: WorkspaceResource;
 }) => {
   const [frameUrl, setFrameUrl] = React.useState(null);
+  const [frameError, setFrameError] = React.useState(false);
+  const [retryToken, setRetryToken] = React.useState(0);
   const { app } = useParams<{ app: string }>();
 
   const { user, workspace, dispatch, currentResource } = props;
@@ -57,7 +64,7 @@ export const WorkspaceFrame = (props: {
       "workspace-frame"
     ) as HTMLIFrameElement;
     const messageListener = (message: MessageEvent<PayloadAction>) => {
-      if (message.source !== iFrame.contentWindow) {
+      if (!iFrame || message.source !== iFrame.contentWindow) {
         return;
       }
       console.debug("Message", message);
@@ -99,24 +106,92 @@ export const WorkspaceFrame = (props: {
   }, [openResource]);
 
   React.useEffect(() => {
-    const applicationDomain = getApplicationDomain(application);
-    const domain = getBaseDomain();
-
-    const userParam = user == null ? "" : `${user.id}`;
-    const type = application.subdomain.slice(0, 4);
-    document.cookie = `workspaceId=${workspace.id};path=/;domain=${domain}`;
-    if(applicationDomain) {
-      setFrameUrl(`//${applicationDomain}/hub/spawn/${userParam}/${workspace.id}${type}${document.location.search ?? ''}`);
-    } else {
-      setFrameUrl(`/testapp?workspaceId=${workspace.id}&type=${type}&user=${userParam}&application=${application.name}`);
-    }
+    let cancelled = false;
+    setFrameError(false);
+    setFrameUrl(null);
+
+    const spawn = async () => {
+      // Make sure the workspace volume is created and ready (bound) before we
+      // spawn the iframe, so the app pod does not fail to mount it.
+      try {
+        await workspaceService.ensureWorkspaceReady(workspace.id);
+      } catch (e) {
+        if (e?.volumeNotReady) {
+          // Transient: the storage is genuinely not bound yet. Surface a
+          // retryable error instead of spawning a pod that would fail to mount.
+          console.error("Workspace volume not ready, not spawning iframe", e);
+          if (!cancelled) {
+            setFrameError(true);
+          }
+          return;
+        }
+        // Any other failure (auth, network, 5xx) is unrelated to volume
+        // readiness; don't block workspace access — fall through and spawn the
+        // iframe as we did before this readiness check existed.
+        console.warn("Workspace readiness check failed, spawning anyway", e);
+      }
+      if (cancelled) {
+        return;
+      }
 
-  }, [application, user, workspace.id]);
+      const applicationDomain = getApplicationDomain(application);
+      const domain = getBaseDomain();
+
+      const userParam = user == null ? "" : `${user.id}`;
+      const type = application.subdomain.slice(0, 4);
+      document.cookie = `workspaceId=${workspace.id};path=/;domain=${domain}`;
+      if (applicationDomain) {
+        setFrameUrl(`//${applicationDomain}/hub/spawn/${userParam}/${workspace.id}${type}${document.location.search ?? ''}`);
+      } else {
+        setFrameUrl(`/testapp?workspaceId=${workspace.id}&type=${type}&user=${userParam}&application=${application.name}`);
+      }
+    };
+
+    spawn();
+
+    return () => {
+      cancelled = true;
+    };
+    // Depend on the primitive inputs the effect actually uses, not the
+    // `application`/`user` object identities — those are rebuilt on unrelated
+    // redux updates and would otherwise reset frameUrl to null (remounting the
+    // iframe via key={frameUrl}) and refire the /open fetch on every re-render.
+  }, [application?.subdomain, application?.name, user?.id, workspace.id, retryToken]);
 
   if (!workspace) {
     return null;
   }
 
+  if (frameError) {
+    return (
+      <Box
+        display="flex"
+        flexDirection="column"
+        alignItems="center"
+        justifyContent="center"
+        flex={1}
+        gap={2}
+        p={4}
+        textAlign="center"
+      >
+        <Typography variant="h6">
+          The workspace is temporarily unavailable
+        </Typography>
+        <Typography variant="body1" color="textSecondary">
+          The workspace storage is not ready yet. This is usually temporary —
+          please try again in a few seconds.
+        </Typography>
+        <Button
+          variant="contained"
+          color="primary"
+          onClick={() => setRetryToken((token) => token + 1)}
+        >
+          Retry
+        </Button>
+      </Box>
+    );
+  }
+
   return (
     <iframe
       id="workspace-frame"
diff --git a/applications/osb-portal/src/service/WorkspaceService.tsx b/applications/osb-portal/src/service/WorkspaceService.tsx
index f14d5f268..6b261c4b3 100644
--- a/applications/osb-portal/src/service/WorkspaceService.tsx
+++ b/applications/osb-portal/src/service/WorkspaceService.tsx
@@ -63,6 +63,37 @@ class WorkspaceService {
     return ws;
   }
 
+  /**
+   * Ensure the workspace volume exists and is ready (bound) before the app
+   * iframe is spawned. The backend blocks up to 5s waiting for the PVC; if it
+   * is still not ready it answers 503, which we surface via `volumeNotReady` so
+   * the caller can show a temporary, retryable error instead of spawning the
+   * iframe. Only a 503 is retryable — other statuses are reported as-is so the
+   * caller can tell a transient storage hiccup from a real auth/not-found error.
+   *
+   * NOTE: this uses fetch rather than `this.workspacesApi` because the generated
+   * client does not yet expose the `/workspace/{id}/open` operation; switch to
+   * the generated client once the apiclient is regenerated from the OpenAPI
+   * spec. The bearer token is taken from the same `accessToken` the client uses.
+   */
+  async ensureWorkspaceReady(id: number): Promise<void> {
+    const response = await fetch(`${workspacesApiUri}/workspace/${id}/open`, {
+      headers: this.accessToken
+        ? { Authorization: `Bearer ${this.accessToken}` }
+        : {},
+    });
+    if (response.ok) {
+      return;
+    }
+    const error: any = new Error(
+      `Could not open workspace ${id} (status ${response.status})`
+    );
+    error.status = response.status;
+    // 503 => volume not ready yet: a transient, retryable server error.
+    error.volumeNotReady = response.status === 503;
+    throw error;
+  }
+
   async refreshResources(selectedWorkspaceId: any) {
     return this.workspacesApi.workspacesControllersWorkspaceControllerImportResources(
       { id: selectedWorkspaceId, inlineObject: {} }
diff --git a/applications/workspaces/deploy/values-dev.yaml b/applications/workspaces/deploy/values-dev.yaml
index 162326408..914c1a783 100644
--- a/applications/workspaces/deploy/values-dev.yaml
+++ b/applications/workspaces/deploy/values-dev.yaml
@@ -5,14 +5,13 @@ harness:
     resources:
       requests:
         memory: 128Mi
-        cpu: 10m
+        cpu: 50m
   deployment:
     resources:
       requests:
-        memory: 128Mi
-        cpu: 10m
-      limits:
         memory: 512Mi
-        cpu: 1500m
+        cpu: 100m
+      limits:
+        memory: 750Mi
 
     
\ No newline at end of file
diff --git a/applications/workspaces/deploy/values.yaml b/applications/workspaces/deploy/values.yaml
index b0c891e73..4d7b7bf6f 100644
--- a/applications/workspaces/deploy/values.yaml
+++ b/applications/workspaces/deploy/values.yaml
@@ -11,10 +11,26 @@ harness:
     path: /api/live
     initialDelaySeconds: 5
     periodSeconds: 15
+    # 1s (the k8s default) is too tight: under node CPU contention even the
+    # trivial /api/live handler can take >1s, which liveness-killed the pod.
+    timeoutSeconds: 5
+    failureThreshold: 6
   readinessProbe:
     path: /api/ready
     initialDelaySeconds: 10
     periodSeconds: 15
+    timeoutSeconds: 5
+  # The server runs 4 gunicorn workers loading a heavy connexion/SQLAlchemy app
+  # and can take well over the ~50s liveness window to start serving — more so
+  # under the CPU contention of a spot-node reschedule storm. Without a startup
+  # probe, liveness kills it mid-boot and it crash-loops. Give it up to ~300s
+  # (30 x 10s) to come up before liveness/readiness apply.
+  startupProbe:
+    path: /api/live
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    failureThreshold: 30
+    timeoutSeconds: 5
   deployment:
     auto: true
     port: 8080
@@ -24,11 +40,12 @@ harness:
       mountpath: /usr/src/app/workspaces/static/workspaces
     resources:
       requests:
-        memory: 128Mi
-        cpu: 20m
-      limits:
         memory: 512Mi
-        cpu: 1500m
+        cpu: 100m
+      limits:
+        # Raised 512Mi -> 1Gi: the app's steady-state RSS sits at ~490Mi, so a
+        # 512Mi limit caused recurring OOMKills (exit 137) under load.
+        memory: 1Gi
   quotas:
     # sets the max number of workspaces per user
     quota-ws-max: 5
diff --git a/applications/workspaces/server/workspaces/controllers/crud/crud_controllers.py b/applications/workspaces/server/workspaces/controllers/crud/crud_controllers.py
index bceea615a..c7af8f87a 100644
--- a/applications/workspaces/server/workspaces/controllers/crud/crud_controllers.py
+++ b/applications/workspaces/server/workspaces/controllers/crud/crud_controllers.py
@@ -19,13 +19,31 @@
 
 class WorkspaceView(BaseModelView):
     service = WorkspaceService()
-    
+
     def post(self, body):
         try:
             return super().post(body)
         except NotAllowed:
             return "Not allowed", 405
 
+    def get(self, id_):
+        """Get a workspace, kicking off best-effort volume creation in the background.
+
+        Volume creation must never make a plain read fail, so it runs in a
+        background thread. The blocking readiness check happens separately when
+        the workspace is fully opened (see workspace_controller.open).
+        """
+        try:
+            workspace = self.service.get(id_)
+        except NotAuthorized:
+            return "Access to the requested resources not authorized", 401
+        except NotFoundException:
+            return f"{self.service.repository} with id {id_} not found.", 404
+        if workspace is None:
+            return f"{self.service.repository} with id {id_} not found.", 404
+        self.service.ensure_volume_background(workspace)
+        return workspace.to_dict(), 200
+
     
         
     def delete(self, id_):
diff --git a/applications/workspaces/server/workspaces/controllers/workspace_controller.py b/applications/workspaces/server/workspaces/controllers/workspace_controller.py
index d52e13d5a..76f04001c 100644
--- a/applications/workspaces/server/workspaces/controllers/workspace_controller.py
+++ b/applications/workspaces/server/workspaces/controllers/workspace_controller.py
@@ -111,3 +111,29 @@ def workspace_clone(id_, body=None):
         return "Not authorized", 401
     except NotAllowed:
         return "Not allowed", 405
+
+
+def open(id_=None, **kwargs):
+    """Prepare a workspace to be fully opened in the app iframe.
+
+    Ensures the workspace volume exists and is bound (mountable). Blocks for up
+    to 5 seconds waiting for the PVC to become ready and, if it is still not
+    ready, returns a recognizable 503 so the frontend can show a temporary error
+    instead of spawning a pod whose volume would fail to mount.
+    """
+    service = WorkspaceService()
+    # Single fetch + authorize (service.get would re-fetch the same row, and it
+    # raises NotAuthorized for a missing workspace, collapsing 404 into 401).
+    entity = service.repository.get(id_)
+    if entity is None:
+        return f"Workspace with id {id_} not found.", 404
+    if not service.is_authorized(entity):
+        return "Access to the requested resources not authorized", 401
+    workspace = service.to_dto(entity)
+
+    if not service.ensure_volume_ready(workspace, timeout=5):
+        return {
+            "error": "volume_not_ready",
+            "message": "The workspace volume is not ready yet. Please retry in a few seconds.",
+        }, 503
+    return {"status": "ready", "workspace_id": id_}, 200
diff --git a/applications/workspaces/server/workspaces/openapi/openapi.yaml b/applications/workspaces/server/workspaces/openapi/openapi.yaml
index 8b2037ce0..c217291ef 100644
--- a/applications/workspaces/server/workspaces/openapi/openapi.yaml
+++ b/applications/workspaces/server/workspaces/openapi/openapi.yaml
@@ -250,6 +250,31 @@ paths:
                     type: integer
                 in: path
                 required: true
+    '/workspace/{id}/open':
+        get:
+            tags:
+                - rest
+            responses:
+                '200':
+                    description: The workspace volume is ready to be mounted.
+                '404':
+                    description: The workspace was not found.
+                '503':
+                    description: The workspace volume is not ready yet. Temporary error, the client should retry.
+            security:
+                - {}
+                -
+                    bearerAuth: []
+            operationId: workspaces.controllers.workspace_controller.open
+            summary: Ensure the workspace volume exists and is ready before opening the workspace.
+        parameters:
+            -
+                name: id
+                description: Workspace ID of the workspace
+                schema:
+                    type: integer
+                in: path
+                required: true
     '/workspace/{id}/thumbnail':
         post:
             requestBody:
diff --git a/applications/workspaces/server/workspaces/service/crud_service.py b/applications/workspaces/server/workspaces/service/crud_service.py
index c968100f2..cdebeb6c6 100644
--- a/applications/workspaces/server/workspaces/service/crud_service.py
+++ b/applications/workspaces/server/workspaces/service/crud_service.py
@@ -2,6 +2,7 @@
 import json
 import os
 import shutil
+import threading
 from typing import List
 
 from cloudharness.service.pvc import create_persistent_volume_claim, delete_persistent_volume_claim
@@ -28,7 +29,7 @@
 from workspaces.persistence.base_crud_persistence import BaseModelRepository
 from workspaces.persistence.models import OSBRepositoryEntity, TOSBRepositoryEntity, TWorkspaceEntity, TWorkspaceResourceEntity, WorkspaceResourceEntity
 from workspaces.service import osbrepository as osbrepository_helper
-from workspaces.service.kubernetes import create_volume
+from workspaces.service.kubernetes import create_volume, wait_for_volume_ready, volume_is_ready
 from workspaces.service.auth import get_auth_client, keycloak_user_id
 from workspaces.service.user_quota_service import get_pvc_size, get_max_workspaces_for_user
 
@@ -171,6 +172,13 @@ class WorkspaceService(BaseModelService):
 
     calculated_fields = {"user"}
 
+    # Per-process guard so repeated reads of the same workspace (e.g. the
+    # portal's polling loop) don't each spawn a thread + Kubernetes API call for
+    # a volume we have already ensured this process lifetime. This is per worker
+    # process, so dedup is only within a worker, not across the fleet.
+    _ensured_volumes = set()
+    _ensured_volumes_lock = threading.Lock()
+
     @staticmethod
     def get_pvc_name(workspace_id):
         return f"workspace-{workspace_id}"
@@ -208,8 +216,7 @@ def post(self, body):
 
         workspace = super().post(body)
 
-        create_volume(name=self.get_pvc_name(workspace.id),
-                      size=self.get_workspace_volume_size(workspace))
+        self.ensure_volume(workspace)
 
         for workspace_resource in workspace.resources:
             WorkspaceresourceService.handle_resource_data(workspace_resource)
@@ -225,6 +232,76 @@ def get_workspace_volume_size(self, ws: Workspace):
         user_id = keycloak_user_id()
         return get_pvc_size(user_id)
 
+    def ensure_volume(self, workspace: Workspace):
+        """Ensure the workspace persistent volume exists, creating it if missing.
+
+        Called when a workspace is created/cloned, so a workspace whose volume is
+        absent (never created, deleted, or migrated from an older deployment) is
+        repaired instead of failing to mount. ``create_volume`` is idempotent: it
+        is a no-op when the PVC already exists.
+        """
+        create_volume(name=self.get_pvc_name(workspace.id),
+                      size=self.get_workspace_volume_size(workspace))
+
+    def ensure_volume_background(self, workspace: Workspace):
+        """Best-effort, non-blocking volume creation used on plain workspace reads.
+
+        The volume is created in a background thread so that simply viewing a
+        workspace never blocks on (or fails because of) the Kubernetes/NFS API.
+        Only the owner's own read triggers creation, sized from their quota; a
+        non-owner viewing a public workspace must not create a PVC sized from
+        their own quota (a missing volume is still repaired synchronously when
+        the workspace is opened, see ``ensure_volume_ready``). A per-process
+        guard avoids respawning a thread for a workspace already ensured.
+        """
+        if workspace.user_id and workspace.user_id != keycloak_user_id():
+            return
+
+        with self._ensured_volumes_lock:
+            if workspace.id in self._ensured_volumes:
+                return
+            self._ensured_volumes.add(workspace.id)
+
+        # Size is computed up-front because it depends on the current request
+        # context (it is read from the authenticated user's quota).
+        name = self.get_pvc_name(workspace.id)
+        size = self.get_workspace_volume_size(workspace)
+
+        def _create():
+            try:
+                create_volume(name=name, size=size)
+            except Exception:
+                logger.warning(
+                    "Background volume creation failed for %s", name, exc_info=True)
+                # Let a later read retry rather than leaving it marked ensured.
+                with self._ensured_volumes_lock:
+                    self._ensured_volumes.discard(workspace.id)
+
+        threading.Thread(target=_create, daemon=True).start()
+
+    def ensure_volume_ready(self, workspace: Workspace, timeout=5) -> bool:
+        """Ensure the volume exists and is bound, blocking up to ``timeout`` seconds.
+
+        Used when fully opening a workspace, right before the app iframe is
+        spawned. Returns True once the PVC is bound and ready to mount, False if
+        it is still not ready after ``timeout`` seconds (NFS flakiness), so the
+        caller can surface a temporary error instead of spawning a pod that would
+        fail to mount.
+
+        Under Immediate binding the PVC is almost always already bound, so the
+        common case returns straight away without creating or waiting — keeping
+        the request off the slow path. (gunicorn runs sync workers, so a
+        genuinely-unbound volume still holds one worker for up to ``timeout``;
+        that is why ``timeout`` is kept small.)
+        """
+        name = self.get_pvc_name(workspace.id)
+        # Common case: already bound — no create, no wait.
+        if volume_is_ready(name):
+            return True
+        # Create if missing (idempotent) and wait for it to bind.
+        self.ensure_volume(workspace)
+        return wait_for_volume_ready(name, timeout=timeout)
+
     @send_event(message_type="workspace", operation="create")
     def clone(self, workspace_id):
         user_id = keycloak_user_id()
@@ -245,8 +322,7 @@ def clone(self, workspace_id):
 
             cloned = self.repository.post(workspace)
 
-            create_volume(name=self.get_pvc_name(cloned.id),
-                          size=self.get_workspace_volume_size(workspace))
+            self.ensure_volume(cloned)
             clone_workspaces_content(workspace_id, cloned.id)
         return cloned
 
diff --git a/applications/workspaces/server/workspaces/service/kubernetes.py b/applications/workspaces/server/workspaces/service/kubernetes.py
index 804a61e91..cc1170477 100644
--- a/applications/workspaces/server/workspaces/service/kubernetes.py
+++ b/applications/workspaces/server/workspaces/service/kubernetes.py
@@ -1,4 +1,7 @@
+import time
+
 from kubernetes.client import V1PersistentVolumeClaim, V1PersistentVolumeClaimSpec, V1ObjectMeta, V1TypedLocalObjectReference, V1ResourceRequirements
+from kubernetes.client.rest import ApiException
 
 from cloudharness import log
 from cloudharness.applications import get_configuration
@@ -11,4 +14,37 @@
 
 def create_volume(name, size="2G"):
     from cloudharness.service import pvc
-    pvc.create_persistent_volume_claim(name=name, size=size, logger=log, useNFS=True)
+    try:
+        pvc.create_persistent_volume_claim(name=name, size=size, logger=log, useNFS=True)
+    except ApiException as e:
+        # create_persistent_volume_claim does a non-atomic exists-then-create,
+        # so two concurrent callers (e.g. the background create on a plain read
+        # and the blocking create when opening) can both pass the existence
+        # check and race; the loser gets 409 AlreadyExists. The PVC exists
+        # either way, so treat that as success rather than failing the request.
+        if e.status == 409:
+            return
+        raise
+
+
+def volume_is_ready(name) -> bool:
+    """A PVC is ready to be mounted once it is bound to a volume."""
+    from cloudharness.service import pvc
+    claim = pvc.get_persistent_volume_claim(name)
+    return bool(claim and claim.status and claim.status.phase == "Bound")
+
+
+def wait_for_volume_ready(name, timeout=5, interval=0.5) -> bool:
+    """Poll the PVC until it is bound or the timeout (seconds) elapses.
+
+    Returns True as soon as the volume is ready, False if it is still not
+    ready after ``timeout`` seconds. Used to guard against NFS flakiness when
+    fully opening a workspace.
+    """
+    deadline = time.monotonic() + timeout
+    while True:
+        if volume_is_ready(name):
+            return True
+        if time.monotonic() >= deadline:
+            return False
+        time.sleep(interval)
diff --git a/applications/workspaces/server/workspaces/service/osbrepository/adapters/dandiadapter.py b/applications/workspaces/server/workspaces/service/osbrepository/adapters/dandiadapter.py
index a1e21325f..0f90d987d 100644
--- a/applications/workspaces/server/workspaces/service/osbrepository/adapters/dandiadapter.py
+++ b/applications/workspaces/server/workspaces/service/osbrepository/adapters/dandiadapter.py
@@ -210,7 +210,7 @@ def _create_copy_asset_task(self, workspace_id, path):
 
         folder = re.search(".*folder=(.*)$", path).group(1)
         folder = f"{self.osbrepository.name}/{folder}"
-        downloadpath = re.search("(.*)\?folder=.*$", path).group(1)
+        downloadpath = re.search(r"(.*)\?folder=.*$", path).group(1)
         print(f"Copy task: {folder} - {downloadpath}")
 
         return workflow.create_copy_task(
diff --git a/deployment-configuration/values-template-dev.yaml b/deployment-configuration/values-template-dev.yaml
index 6b178e827..2a11a72d1 100644
--- a/deployment-configuration/values-template-dev.yaml
+++ b/deployment-configuration/values-template-dev.yaml
@@ -1,2 +1,12 @@
 backup:
-  active: false
\ No newline at end of file
+  active: false
+
+idpArc:
+  rootUrl: "https://idp-arc.idp-arc.dev.metacell.us"
+
+ingress:
+  annotations:
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: "https://idp-arc.idp-arc.dev.metacell.us"
+    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
+    nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type"
diff --git a/deployment/codefresh-dev.yaml b/deployment/codefresh-dev.yaml
index 0c3bd2ece..f09d92a74 100644
--- a/deployment/codefresh-dev.yaml
+++ b/deployment/codefresh-dev.yaml
@@ -11,30 +11,30 @@ steps:
     title: Clone main repository
     type: git-clone
     stage: prepare
-    repo: '${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}'
-    revision: '${{CF_BRANCH}}'
+    repo: ${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}
+    revision: ${{CF_BRANCH}}
     git: github
   post_main_clone:
     title: Post main clone
     type: parallel
     stage: prepare
     steps:
+      clone_NetPyNE_UI_git_1_1_0_netpyne:
+        title: Cloning NetPyNE-UI.git repository...
+        type: git-clone
+        repo: https://github.com/MetaCell/NetPyNE-UI.git
+        revision: 1.1.0
+        working_directory: applications/netpyne/dependencies/
+        git: github
       clone_cloud_harness:
         title: Cloning cloud-harness repository...
         type: git-clone
         stage: prepare
         repo: https://github.com/MetaCell/cloud-harness.git
-        revision: '${{CLOUDHARNESS_BRANCH}}'
+        revision: ${{CLOUDHARNESS_BRANCH}}
         working_directory: .
         git: github
-      clone_NetPyNEUI_git_110_netpyne:
-        title: Cloning NetPyNE-UI.git repository...
-        type: git-clone
-        repo: https://github.com/MetaCell/NetPyNE-UI.git
-        revision: 1.1.0
-        working_directory: applications/netpyne/dependencies/
-        git: github
-      clone_nwb-explorer_git_development_nwb-explorer:
+      clone_nwb_explorer_git_development_nwb_explorer:
         title: Cloning nwb-explorer.git repository...
         type: git-clone
         repo: https://github.com/MetaCell/nwb-explorer.git
@@ -48,8 +48,18 @@ steps:
     working_directory: .
     commands:
     - bash cloud-harness/install.sh
-    - harness-deployment cloud-harness . -d ${{DOMAIN}} -r ${{REGISTRY}} -rs '${{REGISTRY_SECRET}}'
-      -n ${{NAMESPACE}} --write-env -e dev --cache-url '${{IMAGE_CACHE_URL}}' -i osb-portal
+    - export HELM_NAME_ARG="$( [ -n "${{CHART_NAME}}" ] && printf -- "--name %s" "${{CHART_NAME}}"
+      )"
+    - export HELM_CHART_VERSION_ARG="$( [ -n "${{CHART_VERSION}}" ] && printf -- "--chart-version
+      %s" "${{CHART_VERSION}}" )"
+    - export HELM_APP_VERSION_ARG="$( APP_VERSION_RESOLVED="${{APP_VERSION}}"; [ -z
+      "$APP_VERSION_RESOLVED" ] && APP_VERSION_RESOLVED="${{DEPLOYMENT_TAG}}"; [ -n
+      "$APP_VERSION_RESOLVED" ] && printf -- "--app-version %s" "$APP_VERSION_RESOLVED"
+      )"
+    - export HELM_META_ARGS="$HELM_NAME_ARG $HELM_CHART_VERSION_ARG $HELM_APP_VERSION_ARG"
+    - harness-deployment cloud-harness . -d ${{DOMAIN}} -r ${{REGISTRY}} -rsn '${{REGISTRY_SECRET}}'
+      -n ${{NAMESPACE}} --write-env -e dev --cache-url '${{IMAGE_CACHE_URL}}' $HELM_META_ARGS
+      -i osb-portal
     - cat deployment/.env >> ${{CF_VOLUME_PATH}}/env_vars_to_export
     - cat ${{CF_VOLUME_PATH}}/env_vars_to_export
   prepare_deployment_view:
@@ -65,77 +75,55 @@ steps:
     type: parallel
     stage: build
     steps:
-      nwb-explorer:
+      accounts:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
-        image_name: osb/nwb-explorer
-        title: Nwb explorer
-        working_directory: ./applications/nwb-explorer
+        image_name: osb/accounts
+        title: Accounts
+        working_directory: ./.overrides/applications/accounts
         tags:
-        - '${{NWB_EXPLORER_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{ACCOUNTS_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{NWB_EXPLORER_TAG_EXISTS}}', '{{NWB_EXPLORER_TAG_EXISTS}}')
+              buildDoesNotExist: includes('${{ACCOUNTS_TAG_EXISTS}}', '{{ACCOUNTS_TAG_EXISTS}}')
                 == true
-              forceNoCache: includes('${{NWB_EXPLORER_TAG_FORCE_BUILD}}', '{{NWB_EXPLORER_TAG_FORCE_BUILD}}')
+              forceNoCache: includes('${{ACCOUNTS_TAG_FORCE_BUILD}}', '{{ACCOUNTS_TAG_FORCE_BUILD}}')
                 == false
-      cloudharness-frontend-build:
-        type: build
-        stage: build
-        dockerfile: infrastructure/base-images/cloudharness-frontend-build/Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
-        buildkit: true
-        build_arguments:
-        - NOCACHE=${{CF_BUILD_ID}}
-        image_name: osb/cloudharness-frontend-build
-        title: Cloudharness frontend build
-        working_directory: ./cloud-harness
-        tags:
-        - '${{CLOUDHARNESS_FRONTEND_BUILD_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
-        when:
-          condition:
-            any:
-              buildDoesNotExist: includes('${{CLOUDHARNESS_FRONTEND_BUILD_TAG_EXISTS}}',
-                '{{CLOUDHARNESS_FRONTEND_BUILD_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{CLOUDHARNESS_FRONTEND_BUILD_TAG_FORCE_BUILD}}',
-                '{{CLOUDHARNESS_FRONTEND_BUILD_TAG_FORCE_BUILD}}') == false
-      workspaces-dandi-copy:
+      backoffice:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
-        image_name: osb/workspaces-dandi-copy
-        title: Workspaces dandi copy
-        working_directory: ./applications/workspaces/tasks/dandi-copy
+        image_name: osb/backoffice
+        title: Backoffice
+        working_directory: ./applications/backoffice
         tags:
-        - '${{WORKSPACES_DANDI_COPY_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{BACKOFFICE_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{WORKSPACES_DANDI_COPY_TAG_EXISTS}}',
-                '{{WORKSPACES_DANDI_COPY_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{WORKSPACES_DANDI_COPY_TAG_FORCE_BUILD}}',
-                '{{WORKSPACES_DANDI_COPY_TAG_FORCE_BUILD}}') == false
+              buildDoesNotExist: includes('${{BACKOFFICE_TAG_EXISTS}}', '{{BACKOFFICE_TAG_EXISTS}}')
+                == true
+              forceNoCache: includes('${{BACKOFFICE_TAG_FORCE_BUILD}}', '{{BACKOFFICE_TAG_FORCE_BUILD}}')
+                == false
       cloudharness-base:
         type: build
         stage: build
         dockerfile: infrastructure/base-images/cloudharness-base/Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -143,9 +131,9 @@ steps:
         title: Cloudharness base
         working_directory: ./cloud-harness
         tags:
-        - '${{CLOUDHARNESS_BASE_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{CLOUDHARNESS_BASE_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -153,34 +141,33 @@ steps:
                 == true
               forceNoCache: includes('${{CLOUDHARNESS_BASE_TAG_FORCE_BUILD}}', '{{CLOUDHARNESS_BASE_TAG_FORCE_BUILD}}')
                 == false
-      test-e2e:
+      cloudharness-frontend-build:
         type: build
         stage: build
-        dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        dockerfile: infrastructure/base-images/cloudharness-frontend-build/Dockerfile
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
-        image_name: osb/test-e2e
-        title: Test e2e
-        working_directory: ./cloud-harness/test/test-e2e
+        image_name: osb/cloudharness-frontend-build
+        title: Cloudharness frontend build
+        working_directory: ./cloud-harness
         tags:
-        - '${{TEST_E2E_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
-        - latest
+        - ${{CLOUDHARNESS_FRONTEND_BUILD_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{TEST_E2E_TAG_EXISTS}}', '{{TEST_E2E_TAG_EXISTS}}')
-                == true
-              forceNoCache: includes('${{TEST_E2E_TAG_FORCE_BUILD}}', '{{TEST_E2E_TAG_FORCE_BUILD}}')
-                == false
+              buildDoesNotExist: includes('${{CLOUDHARNESS_FRONTEND_BUILD_TAG_EXISTS}}',
+                '{{CLOUDHARNESS_FRONTEND_BUILD_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{CLOUDHARNESS_FRONTEND_BUILD_TAG_FORCE_BUILD}}',
+                '{{CLOUDHARNESS_FRONTEND_BUILD_TAG_FORCE_BUILD}}') == false
       jupyterlab:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -188,9 +175,9 @@ steps:
         title: Jupyterlab
         working_directory: ./applications/jupyterlab
         tags:
-        - '${{JUPYTERLAB_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{JUPYTERLAB_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -202,7 +189,7 @@ steps:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -210,9 +197,9 @@ steps:
         title: Netpyne
         working_directory: ./applications/netpyne
         tags:
-        - '${{NETPYNE_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{NETPYNE_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -220,33 +207,33 @@ steps:
                 == true
               forceNoCache: includes('${{NETPYNE_TAG_FORCE_BUILD}}', '{{NETPYNE_TAG_FORCE_BUILD}}')
                 == false
-      accounts:
+      nwb-explorer:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
-        image_name: osb/accounts
-        title: Accounts
-        working_directory: ./.overrides/applications/accounts
+        image_name: osb/nwb-explorer
+        title: Nwb explorer
+        working_directory: ./applications/nwb-explorer
         tags:
-        - '${{ACCOUNTS_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{NWB_EXPLORER_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{ACCOUNTS_TAG_EXISTS}}', '{{ACCOUNTS_TAG_EXISTS}}')
+              buildDoesNotExist: includes('${{NWB_EXPLORER_TAG_EXISTS}}', '{{NWB_EXPLORER_TAG_EXISTS}}')
                 == true
-              forceNoCache: includes('${{ACCOUNTS_TAG_FORCE_BUILD}}', '{{ACCOUNTS_TAG_FORCE_BUILD}}')
+              forceNoCache: includes('${{NWB_EXPLORER_TAG_FORCE_BUILD}}', '{{NWB_EXPLORER_TAG_FORCE_BUILD}}')
                 == false
       osb-portal:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -254,9 +241,9 @@ steps:
         title: Osb portal
         working_directory: ./applications/osb-portal
         tags:
-        - '${{OSB_PORTAL_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{OSB_PORTAL_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -264,84 +251,130 @@ steps:
                 == true
               forceNoCache: includes('${{OSB_PORTAL_TAG_FORCE_BUILD}}', '{{OSB_PORTAL_TAG_FORCE_BUILD}}')
                 == false
-      backoffice:
+      test-e2e:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
-        image_name: osb/backoffice
-        title: Backoffice
-        working_directory: ./applications/backoffice
+        image_name: osb/test-e2e
+        title: Test e2e
+        working_directory: ./cloud-harness/test/test-e2e
         tags:
-        - '${{BACKOFFICE_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{TEST_E2E_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
+        - latest
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{BACKOFFICE_TAG_EXISTS}}', '{{BACKOFFICE_TAG_EXISTS}}')
+              buildDoesNotExist: includes('${{TEST_E2E_TAG_EXISTS}}', '{{TEST_E2E_TAG_EXISTS}}')
                 == true
-              forceNoCache: includes('${{BACKOFFICE_TAG_FORCE_BUILD}}', '{{BACKOFFICE_TAG_FORCE_BUILD}}')
+              forceNoCache: includes('${{TEST_E2E_TAG_FORCE_BUILD}}', '{{TEST_E2E_TAG_FORCE_BUILD}}')
                 == false
+      workspaces-dandi-copy:
+        type: build
+        stage: build
+        dockerfile: Dockerfile
+        registry: ${{CODEFRESH_REGISTRY}}
+        buildkit: true
+        build_arguments:
+        - NOCACHE=${{CF_BUILD_ID}}
+        image_name: osb/workspaces-dandi-copy
+        title: Workspaces dandi copy
+        working_directory: ./applications/workspaces/tasks/dandi-copy
+        tags:
+        - ${{WORKSPACES_DANDI_COPY_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
+        when:
+          condition:
+            any:
+              buildDoesNotExist: includes('${{WORKSPACES_DANDI_COPY_TAG_EXISTS}}',
+                '{{WORKSPACES_DANDI_COPY_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{WORKSPACES_DANDI_COPY_TAG_FORCE_BUILD}}',
+                '{{WORKSPACES_DANDI_COPY_TAG_FORCE_BUILD}}') == false
     title: Build parallel step 1
   build_application_images_1:
     type: parallel
     stage: build
     steps:
-      workspaces-biomodels-copy:
+      cloudharness-flask:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/workspaces-biomodels-copy
-        title: Workspaces biomodels copy
-        working_directory: ./applications/workspaces/tasks/biomodels-copy
+        image_name: osb/cloudharness-flask
+        title: Cloudharness flask
+        working_directory: ./cloud-harness/infrastructure/common-images/cloudharness-flask
         tags:
-        - '${{WORKSPACES_BIOMODELS_COPY_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{CLOUDHARNESS_FLASK_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{WORKSPACES_BIOMODELS_COPY_TAG_EXISTS}}',
-                '{{WORKSPACES_BIOMODELS_COPY_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{WORKSPACES_BIOMODELS_COPY_TAG_FORCE_BUILD}}',
-                '{{WORKSPACES_BIOMODELS_COPY_TAG_FORCE_BUILD}}') == false
-      workspaces-scan-workspace:
+              buildDoesNotExist: includes('${{CLOUDHARNESS_FLASK_TAG_EXISTS}}', '{{CLOUDHARNESS_FLASK_TAG_EXISTS}}')
+                == true
+              forceNoCache: includes('${{CLOUDHARNESS_FLASK_TAG_FORCE_BUILD}}', '{{CLOUDHARNESS_FLASK_TAG_FORCE_BUILD}}')
+                == false
+      jupyterhub:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/workspaces-scan-workspace
-        title: Workspaces scan workspace
-        working_directory: ./applications/workspaces/tasks/scan-workspace
+        image_name: osb/jupyterhub
+        title: Jupyterhub
+        working_directory: ./.overrides/applications/jupyterhub
         tags:
-        - '${{WORKSPACES_SCAN_WORKSPACE_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{JUPYTERHUB_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{WORKSPACES_SCAN_WORKSPACE_TAG_EXISTS}}',
-                '{{WORKSPACES_SCAN_WORKSPACE_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{WORKSPACES_SCAN_WORKSPACE_TAG_FORCE_BUILD}}',
-                '{{WORKSPACES_SCAN_WORKSPACE_TAG_FORCE_BUILD}}') == false
+              buildDoesNotExist: includes('${{JUPYTERHUB_TAG_EXISTS}}', '{{JUPYTERHUB_TAG_EXISTS}}')
+                == true
+              forceNoCache: includes('${{JUPYTERHUB_TAG_FORCE_BUILD}}', '{{JUPYTERHUB_TAG_FORCE_BUILD}}')
+                == false
+      notifications:
+        type: build
+        stage: build
+        dockerfile: Dockerfile
+        registry: ${{CODEFRESH_REGISTRY}}
+        buildkit: true
+        build_arguments:
+        - NOCACHE=${{CF_BUILD_ID}}
+        - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
+        image_name: osb/notifications
+        title: Notifications
+        working_directory: ./.overrides/applications/notifications/server
+        tags:
+        - ${{NOTIFICATIONS_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
+        when:
+          condition:
+            any:
+              buildDoesNotExist: includes('${{NOTIFICATIONS_TAG_EXISTS}}', '{{NOTIFICATIONS_TAG_EXISTS}}')
+                == true
+              forceNoCache: includes('${{NOTIFICATIONS_TAG_FORCE_BUILD}}', '{{NOTIFICATIONS_TAG_FORCE_BUILD}}')
+                == false
       test-api:
         type: build
         stage: build
         dockerfile: test/test-api/Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -350,9 +383,9 @@ steps:
         title: Test api
         working_directory: ./cloud-harness
         tags:
-        - '${{TEST_API_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{TEST_API_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         - latest
         when:
           condition:
@@ -365,7 +398,7 @@ steps:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -374,9 +407,9 @@ steps:
         title: Workflows extract download
         working_directory: ./cloud-harness/applications/workflows/tasks/extract-download
         tags:
-        - '${{WORKFLOWS_EXTRACT_DOWNLOAD_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKFLOWS_EXTRACT_DOWNLOAD_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -384,80 +417,80 @@ steps:
                 '{{WORKFLOWS_EXTRACT_DOWNLOAD_TAG_EXISTS}}') == true
               forceNoCache: includes('${{WORKFLOWS_EXTRACT_DOWNLOAD_TAG_FORCE_BUILD}}',
                 '{{WORKFLOWS_EXTRACT_DOWNLOAD_TAG_FORCE_BUILD}}') == false
-      workspaces-github-copy:
+      workflows-notify-queue:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/workspaces-github-copy
-        title: Workspaces github copy
-        working_directory: ./applications/workspaces/tasks/github-copy
+        image_name: osb/workflows-notify-queue
+        title: Workflows notify queue
+        working_directory: ./cloud-harness/applications/workflows/tasks/notify-queue
         tags:
-        - '${{WORKSPACES_GITHUB_COPY_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKFLOWS_NOTIFY_QUEUE_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{WORKSPACES_GITHUB_COPY_TAG_EXISTS}}',
-                '{{WORKSPACES_GITHUB_COPY_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{WORKSPACES_GITHUB_COPY_TAG_FORCE_BUILD}}',
-                '{{WORKSPACES_GITHUB_COPY_TAG_FORCE_BUILD}}') == false
-      notifications:
+              buildDoesNotExist: includes('${{WORKFLOWS_NOTIFY_QUEUE_TAG_EXISTS}}',
+                '{{WORKFLOWS_NOTIFY_QUEUE_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{WORKFLOWS_NOTIFY_QUEUE_TAG_FORCE_BUILD}}',
+                '{{WORKFLOWS_NOTIFY_QUEUE_TAG_FORCE_BUILD}}') == false
+      workflows-send-result-event:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/notifications
-        title: Notifications
-        working_directory: ./.overrides/applications/notifications/server
+        image_name: osb/workflows-send-result-event
+        title: Workflows send result event
+        working_directory: ./cloud-harness/applications/workflows/tasks/send-result-event
         tags:
-        - '${{NOTIFICATIONS_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKFLOWS_SEND_RESULT_EVENT_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{NOTIFICATIONS_TAG_EXISTS}}', '{{NOTIFICATIONS_TAG_EXISTS}}')
-                == true
-              forceNoCache: includes('${{NOTIFICATIONS_TAG_FORCE_BUILD}}', '{{NOTIFICATIONS_TAG_FORCE_BUILD}}')
-                == false
-      jupyterhub:
+              buildDoesNotExist: includes('${{WORKFLOWS_SEND_RESULT_EVENT_TAG_EXISTS}}',
+                '{{WORKFLOWS_SEND_RESULT_EVENT_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{WORKFLOWS_SEND_RESULT_EVENT_TAG_FORCE_BUILD}}',
+                '{{WORKFLOWS_SEND_RESULT_EVENT_TAG_FORCE_BUILD}}') == false
+      workspaces-biomodels-copy:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/jupyterhub
-        title: Jupyterhub
-        working_directory: ./.overrides/applications/jupyterhub
+        image_name: osb/workspaces-biomodels-copy
+        title: Workspaces biomodels copy
+        working_directory: ./applications/workspaces/tasks/biomodels-copy
         tags:
-        - '${{JUPYTERHUB_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKSPACES_BIOMODELS_COPY_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{JUPYTERHUB_TAG_EXISTS}}', '{{JUPYTERHUB_TAG_EXISTS}}')
-                == true
-              forceNoCache: includes('${{JUPYTERHUB_TAG_FORCE_BUILD}}', '{{JUPYTERHUB_TAG_FORCE_BUILD}}')
-                == false
+              buildDoesNotExist: includes('${{WORKSPACES_BIOMODELS_COPY_TAG_EXISTS}}',
+                '{{WORKSPACES_BIOMODELS_COPY_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{WORKSPACES_BIOMODELS_COPY_TAG_FORCE_BUILD}}',
+                '{{WORKSPACES_BIOMODELS_COPY_TAG_FORCE_BUILD}}') == false
       workspaces-figshare-copy:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -466,9 +499,9 @@ steps:
         title: Workspaces figshare copy
         working_directory: ./applications/workspaces/tasks/figshare-copy
         tags:
-        - '${{WORKSPACES_FIGSHARE_COPY_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKSPACES_FIGSHARE_COPY_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -476,131 +509,108 @@ steps:
                 '{{WORKSPACES_FIGSHARE_COPY_TAG_EXISTS}}') == true
               forceNoCache: includes('${{WORKSPACES_FIGSHARE_COPY_TAG_FORCE_BUILD}}',
                 '{{WORKSPACES_FIGSHARE_COPY_TAG_FORCE_BUILD}}') == false
-      workflows-send-result-event:
-        type: build
-        stage: build
-        dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
-        buildkit: true
-        build_arguments:
-        - NOCACHE=${{CF_BUILD_ID}}
-        - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/workflows-send-result-event
-        title: Workflows send result event
-        working_directory: ./cloud-harness/applications/workflows/tasks/send-result-event
-        tags:
-        - '${{WORKFLOWS_SEND_RESULT_EVENT_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
-        when:
-          condition:
-            any:
-              buildDoesNotExist: includes('${{WORKFLOWS_SEND_RESULT_EVENT_TAG_EXISTS}}',
-                '{{WORKFLOWS_SEND_RESULT_EVENT_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{WORKFLOWS_SEND_RESULT_EVENT_TAG_FORCE_BUILD}}',
-                '{{WORKFLOWS_SEND_RESULT_EVENT_TAG_FORCE_BUILD}}') == false
-      workflows-notify-queue:
+      workspaces-github-copy:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/workflows-notify-queue
-        title: Workflows notify queue
-        working_directory: ./cloud-harness/applications/workflows/tasks/notify-queue
+        image_name: osb/workspaces-github-copy
+        title: Workspaces github copy
+        working_directory: ./applications/workspaces/tasks/github-copy
         tags:
-        - '${{WORKFLOWS_NOTIFY_QUEUE_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKSPACES_GITHUB_COPY_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{WORKFLOWS_NOTIFY_QUEUE_TAG_EXISTS}}',
-                '{{WORKFLOWS_NOTIFY_QUEUE_TAG_EXISTS}}') == true
-              forceNoCache: includes('${{WORKFLOWS_NOTIFY_QUEUE_TAG_FORCE_BUILD}}',
-                '{{WORKFLOWS_NOTIFY_QUEUE_TAG_FORCE_BUILD}}') == false
-      cloudharness-flask:
+              buildDoesNotExist: includes('${{WORKSPACES_GITHUB_COPY_TAG_EXISTS}}',
+                '{{WORKSPACES_GITHUB_COPY_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{WORKSPACES_GITHUB_COPY_TAG_FORCE_BUILD}}',
+                '{{WORKSPACES_GITHUB_COPY_TAG_FORCE_BUILD}}') == false
+      workspaces-scan-workspace:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_BASE=${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
-        image_name: osb/cloudharness-flask
-        title: Cloudharness flask
-        working_directory: ./cloud-harness/infrastructure/common-images/cloudharness-flask
+        image_name: osb/workspaces-scan-workspace
+        title: Workspaces scan workspace
+        working_directory: ./applications/workspaces/tasks/scan-workspace
         tags:
-        - '${{CLOUDHARNESS_FLASK_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKSPACES_SCAN_WORKSPACE_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{CLOUDHARNESS_FLASK_TAG_EXISTS}}', '{{CLOUDHARNESS_FLASK_TAG_EXISTS}}')
-                == true
-              forceNoCache: includes('${{CLOUDHARNESS_FLASK_TAG_FORCE_BUILD}}', '{{CLOUDHARNESS_FLASK_TAG_FORCE_BUILD}}')
-                == false
+              buildDoesNotExist: includes('${{WORKSPACES_SCAN_WORKSPACE_TAG_EXISTS}}',
+                '{{WORKSPACES_SCAN_WORKSPACE_TAG_EXISTS}}') == true
+              forceNoCache: includes('${{WORKSPACES_SCAN_WORKSPACE_TAG_FORCE_BUILD}}',
+                '{{WORKSPACES_SCAN_WORKSPACE_TAG_FORCE_BUILD}}') == false
     title: Build parallel step 2
   build_application_images_2:
     type: parallel
     stage: build
     steps:
-      workspaces:
+      accounts-api:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_FLASK=${{REGISTRY}}/osb/cloudharness-flask:${{CLOUDHARNESS_FLASK_TAG}}
-        image_name: osb/workspaces
-        title: Workspaces
-        working_directory: ./applications/workspaces/server
+        image_name: osb/accounts-api
+        title: Accounts api
+        working_directory: ./applications/accounts-api
         tags:
-        - '${{WORKSPACES_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{ACCOUNTS_API_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{WORKSPACES_TAG_EXISTS}}', '{{WORKSPACES_TAG_EXISTS}}')
+              buildDoesNotExist: includes('${{ACCOUNTS_API_TAG_EXISTS}}', '{{ACCOUNTS_API_TAG_EXISTS}}')
                 == true
-              forceNoCache: includes('${{WORKSPACES_TAG_FORCE_BUILD}}', '{{WORKSPACES_TAG_FORCE_BUILD}}')
+              forceNoCache: includes('${{ACCOUNTS_API_TAG_FORCE_BUILD}}', '{{ACCOUNTS_API_TAG_FORCE_BUILD}}')
                 == false
-      accounts-api:
+      common:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_FLASK=${{REGISTRY}}/osb/cloudharness-flask:${{CLOUDHARNESS_FLASK_TAG}}
-        image_name: osb/accounts-api
-        title: Accounts api
-        working_directory: ./applications/accounts-api
+        image_name: osb/common
+        title: Common
+        working_directory: ./.overrides/applications/common/server
         tags:
-        - '${{ACCOUNTS_API_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{COMMON_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{ACCOUNTS_API_TAG_EXISTS}}', '{{ACCOUNTS_API_TAG_EXISTS}}')
+              buildDoesNotExist: includes('${{COMMON_TAG_EXISTS}}', '{{COMMON_TAG_EXISTS}}')
                 == true
-              forceNoCache: includes('${{ACCOUNTS_API_TAG_FORCE_BUILD}}', '{{ACCOUNTS_API_TAG_FORCE_BUILD}}')
+              forceNoCache: includes('${{COMMON_TAG_FORCE_BUILD}}', '{{COMMON_TAG_FORCE_BUILD}}')
                 == false
       volumemanager:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -609,9 +619,9 @@ steps:
         title: Volumemanager
         working_directory: ./cloud-harness/applications/volumemanager/server
         tags:
-        - '${{VOLUMEMANAGER_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{VOLUMEMANAGER_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -623,7 +633,7 @@ steps:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
@@ -632,9 +642,9 @@ steps:
         title: Workflows
         working_directory: ./cloud-harness/applications/workflows/server
         tags:
-        - '${{WORKFLOWS_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKFLOWS_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
@@ -642,28 +652,28 @@ steps:
                 == true
               forceNoCache: includes('${{WORKFLOWS_TAG_FORCE_BUILD}}', '{{WORKFLOWS_TAG_FORCE_BUILD}}')
                 == false
-      common:
+      workspaces:
         type: build
         stage: build
         dockerfile: Dockerfile
-        registry: '${{CODEFRESH_REGISTRY}}'
+        registry: ${{CODEFRESH_REGISTRY}}
         buildkit: true
         build_arguments:
         - NOCACHE=${{CF_BUILD_ID}}
         - CLOUDHARNESS_FLASK=${{REGISTRY}}/osb/cloudharness-flask:${{CLOUDHARNESS_FLASK_TAG}}
-        image_name: osb/common
-        title: Common
-        working_directory: ./.overrides/applications/common/server
+        image_name: osb/workspaces
+        title: Workspaces
+        working_directory: ./applications/workspaces/server
         tags:
-        - '${{COMMON_TAG}}'
-        - '${{DEPLOYMENT_PUBLISH_TAG}}-dev'
-        - '${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}'
+        - ${{WORKSPACES_TAG}}
+        - ${{DEPLOYMENT_PUBLISH_TAG}}-dev
+        - ${{CF_BRANCH_TAG_NORMALIZED_LOWER_CASE}}
         when:
           condition:
             any:
-              buildDoesNotExist: includes('${{COMMON_TAG_EXISTS}}', '{{COMMON_TAG_EXISTS}}')
+              buildDoesNotExist: includes('${{WORKSPACES_TAG_EXISTS}}', '{{WORKSPACES_TAG_EXISTS}}')
                 == true
-              forceNoCache: includes('${{COMMON_TAG_FORCE_BUILD}}', '{{COMMON_TAG_FORCE_BUILD}}')
+              forceNoCache: includes('${{WORKSPACES_TAG_FORCE_BUILD}}', '{{WORKSPACES_TAG_FORCE_BUILD}}')
                 == false
     title: Build parallel step 3
   tests_unit:
@@ -675,7 +685,7 @@ steps:
         commands:
         - pip install -r /usr/src/app/test-requirements.txt
         - pytest /usr/src/app/
-        image: '${{REGISTRY}}/osb/workspaces:${{WORKSPACES_TAG}}'
+        image: ${{REGISTRY}}/osb/workspaces:${{WORKSPACES_TAG}}
   deployment:
     stage: deploy
     type: helm
@@ -684,18 +694,18 @@ steps:
     arguments:
       helm_version: 3.6.2
       chart_name: deployment/helm
-      release_name: '${{NAMESPACE}}'
-      kube_context: '${{CLUSTER_NAME}}'
-      namespace: '${{NAMESPACE}}'
-      chart_version: '${{CF_BUILD_ID}}'
+      release_name: ${{NAMESPACE}}
+      kube_context: ${{CLUSTER_NAME}}
+      namespace: ${{NAMESPACE}}
+      chart_version: ${{CF_BUILD_ID}}
       cmd_ps: --wait --timeout 600s --create-namespace
       custom_value_files:
       - ./deployment/helm/values.yaml
       custom_values:
-      - apps_notifications_harness_secrets_email-user=${{EMAIL-USER}}
-      - apps_notifications_harness_secrets_email-password=${{EMAIL-PASSWORD}}
-      - apps_workspaces_harness_secrets_github-user=${{GITHUB-USER}}
-      - apps_workspaces_harness_secrets_github-token=${{GITHUB-TOKEN}}
+      - 'apps_notifications_harness_secrets_email-user="${{EMAIL-USER}}"'
+      - 'apps_notifications_harness_secrets_email-password="${{EMAIL-PASSWORD}}"'
+      - 'apps_workspaces_harness_secrets_github-user="${{GITHUB-USER}}"'
+      - 'apps_workspaces_harness_secrets_github-token="${{GITHUB-TOKEN}}"'
     image: codefresh/cfstep-helm:3.6.2
     environment:
     - CHART_REF=./deployment/helm
@@ -714,20 +724,20 @@ steps:
     commands:
     - kubectl config use-context ${{CLUSTER_NAME}}
     - kubectl config set-context --current --namespace=${{NAMESPACE}}
-    - kubectl rollout status deployment/accounts-api
-    - kubectl rollout status deployment/notifications
+    - kubectl rollout status deployment/common
     - kubectl rollout status deployment/netpyne-gk
-    - kubectl rollout status deployment/accounts
-    - kubectl rollout status deployment/workspaces
-    - kubectl rollout status deployment/argo-gk
+    - kubectl rollout status deployment/notifications
     - kubectl rollout status deployment/backoffice
     - kubectl rollout status deployment/admin-gk
-    - kubectl rollout status deployment/volumemanager
+    - kubectl rollout status deployment/workspaces
     - kubectl rollout status deployment/osb-portal
     - kubectl rollout status deployment/www-gk
-    - kubectl rollout status deployment/events-gk
+    - kubectl rollout status deployment/accounts
+    - kubectl rollout status deployment/accounts-api
     - kubectl rollout status deployment/workflows
-    - kubectl rollout status deployment/common
+    - kubectl rollout status deployment/volumemanager
+    - kubectl rollout status deployment/events-gk
+    - kubectl rollout status deployment/argo-gk
     - sleep 60
     when:
       condition:
@@ -737,7 +747,7 @@ steps:
     stage: qa
     title: Api tests
     working_directory: /home/test
-    image: '${{REGISTRY}}/osb/test-api:${{TEST_API_TAG}}'
+    image: ${{REGISTRY}}/osb/test-api:${{TEST_API_TAG}}
     fail_fast: false
     commands:
     - echo $APP_NAME
@@ -745,8 +755,8 @@ steps:
       common_api_test:
         title: common api test
         volumes:
-        - '${{CF_REPO_NAME}}/.overrides/applications/common:/home/test'
-        - '${{CF_REPO_NAME}}/deployment/helm/values.yaml:/opt/cloudharness/resources/allvalues.yaml'
+        - ${{CF_REPO_NAME}}/.overrides/applications/common:/home/test
+        - ${{CF_REPO_NAME}}/deployment/helm/values.yaml:/opt/cloudharness/resources/allvalues.yaml
         environment:
         - APP_URL=https://common.${{DOMAIN}}/api
         commands:
@@ -755,8 +765,8 @@ steps:
       workflows_api_test:
         title: workflows api test
         volumes:
-        - '${{CF_REPO_NAME}}/cloud-harness/applications/workflows:/home/test'
-        - '${{CF_REPO_NAME}}/deployment/helm/values.yaml:/opt/cloudharness/resources/allvalues.yaml'
+        - ${{CF_REPO_NAME}}/cloud-harness/applications/workflows:/home/test
+        - ${{CF_REPO_NAME}}/deployment/helm/values.yaml:/opt/cloudharness/resources/allvalues.yaml
         environment:
         - APP_URL=https://workflows.${{DOMAIN}}/api
         commands:
@@ -770,7 +780,7 @@ steps:
     stage: qa
     title: End to end tests
     working_directory: /home/test
-    image: '${{REGISTRY}}/osb/test-e2e:${{TEST_E2E_TAG}}'
+    image: ${{REGISTRY}}/osb/test-e2e:${{TEST_E2E_TAG}}
     fail_fast: false
     commands:
     - npx puppeteer browsers install chrome
@@ -779,13 +789,13 @@ steps:
       jupyterhub_e2e_test:
         title: jupyterhub e2e test
         volumes:
-        - '${{CF_REPO_NAME}}/.overrides/applications/jupyterhub/test/e2e:/home/test/__tests__/jupyterhub'
+        - ${{CF_REPO_NAME}}/.overrides/applications/jupyterhub/test/e2e:/home/test/__tests__/jupyterhub
         environment:
         - APP_URL=https://hub.${{DOMAIN}}
       osb-portal_e2e_test:
         title: osb-portal e2e test
         volumes:
-        - '${{CF_REPO_NAME}}/applications/osb-portal/test/e2e:/home/test/__tests__/osb-portal'
+        - ${{CF_REPO_NAME}}/applications/osb-portal/test/e2e:/home/test/__tests__/osb-portal
         environment:
         - APP_URL=https://www.${{DOMAIN}}
     when:
@@ -804,222 +814,344 @@ steps:
     type: parallel
     stage: publish
     steps:
-      publish_cloudharness-base:
+      publish_accounts:
         stage: publish
         type: push
-        title: Cloudharness base
-        candidate: '${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}'
+        title: Accounts
+        candidate: ${{REGISTRY}}/osb/accounts:${{ACCOUNTS_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_cloudharness-frontend-build:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{ACCOUNTS_PUBLISH_SKIP}}', '{{ACCOUNTS_PUBLISH_SKIP}}')
+                == true
+      publish_accounts-api:
         stage: publish
         type: push
-        title: Cloudharness frontend build
-        candidate: '${{REGISTRY}}/osb/cloudharness-frontend-build:${{CLOUDHARNESS_FRONTEND_BUILD_TAG}}'
+        title: Accounts api
+        candidate: ${{REGISTRY}}/osb/accounts-api:${{ACCOUNTS_API_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_cloudharness-flask:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{ACCOUNTS_API_PUBLISH_SKIP}}', '{{ACCOUNTS_API_PUBLISH_SKIP}}')
+                == true
+      publish_backoffice:
         stage: publish
         type: push
-        title: Cloudharness flask
-        candidate: '${{REGISTRY}}/osb/cloudharness-flask:${{CLOUDHARNESS_FLASK_TAG}}'
+        title: Backoffice
+        candidate: ${{REGISTRY}}/osb/backoffice:${{BACKOFFICE_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_notifications:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{BACKOFFICE_PUBLISH_SKIP}}', '{{BACKOFFICE_PUBLISH_SKIP}}')
+                == true
+      publish_cloudharness-base:
         stage: publish
         type: push
-        title: Notifications
-        candidate: '${{REGISTRY}}/osb/notifications:${{NOTIFICATIONS_TAG}}'
+        title: Cloudharness base
+        candidate: ${{REGISTRY}}/osb/cloudharness-base:${{CLOUDHARNESS_BASE_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_accounts:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{CLOUDHARNESS_BASE_PUBLISH_SKIP}}', '{{CLOUDHARNESS_BASE_PUBLISH_SKIP}}')
+                == true
+      publish_cloudharness-flask:
         stage: publish
         type: push
-        title: Accounts
-        candidate: '${{REGISTRY}}/osb/accounts:${{ACCOUNTS_TAG}}'
+        title: Cloudharness flask
+        candidate: ${{REGISTRY}}/osb/cloudharness-flask:${{CLOUDHARNESS_FLASK_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_volumemanager:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{CLOUDHARNESS_FLASK_PUBLISH_SKIP}}', '{{CLOUDHARNESS_FLASK_PUBLISH_SKIP}}')
+                == true
+      publish_cloudharness-frontend-build:
         stage: publish
         type: push
-        title: Volumemanager
-        candidate: '${{REGISTRY}}/osb/volumemanager:${{VOLUMEMANAGER_TAG}}'
+        title: Cloudharness frontend build
+        candidate: 
+          ${{REGISTRY}}/osb/cloudharness-frontend-build:${{CLOUDHARNESS_FRONTEND_BUILD_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_jupyterhub:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{CLOUDHARNESS_FRONTEND_BUILD_PUBLISH_SKIP}}',
+                '{{CLOUDHARNESS_FRONTEND_BUILD_PUBLISH_SKIP}}') == true
+      publish_common:
         stage: publish
         type: push
-        title: Jupyterhub
-        candidate: '${{REGISTRY}}/osb/jupyterhub:${{JUPYTERHUB_TAG}}'
+        title: Common
+        candidate: ${{REGISTRY}}/osb/common:${{COMMON_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_common:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{COMMON_PUBLISH_SKIP}}', '{{COMMON_PUBLISH_SKIP}}')
+                == true
+      publish_jupyterhub:
         stage: publish
         type: push
-        title: Common
-        candidate: '${{REGISTRY}}/osb/common:${{COMMON_TAG}}'
+        title: Jupyterhub
+        candidate: ${{REGISTRY}}/osb/jupyterhub:${{JUPYTERHUB_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workflows-send-result-event:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{JUPYTERHUB_PUBLISH_SKIP}}', '{{JUPYTERHUB_PUBLISH_SKIP}}')
+                == true
+      publish_jupyterlab:
         stage: publish
         type: push
-        title: Workflows send result event
-        candidate: '${{REGISTRY}}/osb/workflows-send-result-event:${{WORKFLOWS_SEND_RESULT_EVENT_TAG}}'
+        title: Jupyterlab
+        candidate: ${{REGISTRY}}/osb/jupyterlab:${{JUPYTERLAB_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workflows-extract-download:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{JUPYTERLAB_PUBLISH_SKIP}}', '{{JUPYTERLAB_PUBLISH_SKIP}}')
+                == true
+      publish_netpyne:
         stage: publish
         type: push
-        title: Workflows extract download
-        candidate: '${{REGISTRY}}/osb/workflows-extract-download:${{WORKFLOWS_EXTRACT_DOWNLOAD_TAG}}'
+        title: Netpyne
+        candidate: ${{REGISTRY}}/osb/netpyne:${{NETPYNE_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workflows-notify-queue:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{NETPYNE_PUBLISH_SKIP}}', '{{NETPYNE_PUBLISH_SKIP}}')
+                == true
+      publish_notifications:
         stage: publish
         type: push
-        title: Workflows notify queue
-        candidate: '${{REGISTRY}}/osb/workflows-notify-queue:${{WORKFLOWS_NOTIFY_QUEUE_TAG}}'
+        title: Notifications
+        candidate: ${{REGISTRY}}/osb/notifications:${{NOTIFICATIONS_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workflows:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{NOTIFICATIONS_PUBLISH_SKIP}}', '{{NOTIFICATIONS_PUBLISH_SKIP}}')
+                == true
+      publish_nwb-explorer:
         stage: publish
         type: push
-        title: Workflows
-        candidate: '${{REGISTRY}}/osb/workflows:${{WORKFLOWS_TAG}}'
+        title: Nwb explorer
+        candidate: ${{REGISTRY}}/osb/nwb-explorer:${{NWB_EXPLORER_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workspaces-biomodels-copy:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{NWB_EXPLORER_PUBLISH_SKIP}}', '{{NWB_EXPLORER_PUBLISH_SKIP}}')
+                == true
+      publish_osb-portal:
         stage: publish
         type: push
-        title: Workspaces biomodels copy
-        candidate: '${{REGISTRY}}/osb/workspaces-biomodels-copy:${{WORKSPACES_BIOMODELS_COPY_TAG}}'
+        title: Osb portal
+        candidate: ${{REGISTRY}}/osb/osb-portal:${{OSB_PORTAL_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workspaces-figshare-copy:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{OSB_PORTAL_PUBLISH_SKIP}}', '{{OSB_PORTAL_PUBLISH_SKIP}}')
+                == true
+      publish_volumemanager:
         stage: publish
         type: push
-        title: Workspaces figshare copy
-        candidate: '${{REGISTRY}}/osb/workspaces-figshare-copy:${{WORKSPACES_FIGSHARE_COPY_TAG}}'
+        title: Volumemanager
+        candidate: ${{REGISTRY}}/osb/volumemanager:${{VOLUMEMANAGER_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workspaces-scan-workspace:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{VOLUMEMANAGER_PUBLISH_SKIP}}', '{{VOLUMEMANAGER_PUBLISH_SKIP}}')
+                == true
+      publish_workflows:
         stage: publish
         type: push
-        title: Workspaces scan workspace
-        candidate: '${{REGISTRY}}/osb/workspaces-scan-workspace:${{WORKSPACES_SCAN_WORKSPACE_TAG}}'
+        title: Workflows
+        candidate: ${{REGISTRY}}/osb/workflows:${{WORKFLOWS_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workspaces-github-copy:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKFLOWS_PUBLISH_SKIP}}', '{{WORKFLOWS_PUBLISH_SKIP}}')
+                == true
+      publish_workflows-extract-download:
         stage: publish
         type: push
-        title: Workspaces github copy
-        candidate: '${{REGISTRY}}/osb/workspaces-github-copy:${{WORKSPACES_GITHUB_COPY_TAG}}'
+        title: Workflows extract download
+        candidate: ${{REGISTRY}}/osb/workflows-extract-download:${{WORKFLOWS_EXTRACT_DOWNLOAD_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workspaces-dandi-copy:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKFLOWS_EXTRACT_DOWNLOAD_PUBLISH_SKIP}}',
+                '{{WORKFLOWS_EXTRACT_DOWNLOAD_PUBLISH_SKIP}}') == true
+      publish_workflows-notify-queue:
         stage: publish
         type: push
-        title: Workspaces dandi copy
-        candidate: '${{REGISTRY}}/osb/workspaces-dandi-copy:${{WORKSPACES_DANDI_COPY_TAG}}'
+        title: Workflows notify queue
+        candidate: ${{REGISTRY}}/osb/workflows-notify-queue:${{WORKFLOWS_NOTIFY_QUEUE_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_workspaces:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKFLOWS_NOTIFY_QUEUE_PUBLISH_SKIP}}', '{{WORKFLOWS_NOTIFY_QUEUE_PUBLISH_SKIP}}')
+                == true
+      publish_workflows-send-result-event:
         stage: publish
         type: push
-        title: Workspaces
-        candidate: '${{REGISTRY}}/osb/workspaces:${{WORKSPACES_TAG}}'
+        title: Workflows send result event
+        candidate: 
+          ${{REGISTRY}}/osb/workflows-send-result-event:${{WORKFLOWS_SEND_RESULT_EVENT_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_netpyne:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKFLOWS_SEND_RESULT_EVENT_PUBLISH_SKIP}}',
+                '{{WORKFLOWS_SEND_RESULT_EVENT_PUBLISH_SKIP}}') == true
+      publish_workspaces:
         stage: publish
         type: push
-        title: Netpyne
-        candidate: '${{REGISTRY}}/osb/netpyne:${{NETPYNE_TAG}}'
+        title: Workspaces
+        candidate: ${{REGISTRY}}/osb/workspaces:${{WORKSPACES_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_accounts-api:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKSPACES_PUBLISH_SKIP}}', '{{WORKSPACES_PUBLISH_SKIP}}')
+                == true
+      publish_workspaces-biomodels-copy:
         stage: publish
         type: push
-        title: Accounts api
-        candidate: '${{REGISTRY}}/osb/accounts-api:${{ACCOUNTS_API_TAG}}'
+        title: Workspaces biomodels copy
+        candidate: ${{REGISTRY}}/osb/workspaces-biomodels-copy:${{WORKSPACES_BIOMODELS_COPY_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_osb-portal:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKSPACES_BIOMODELS_COPY_PUBLISH_SKIP}}',
+                '{{WORKSPACES_BIOMODELS_COPY_PUBLISH_SKIP}}') == true
+      publish_workspaces-dandi-copy:
         stage: publish
         type: push
-        title: Osb portal
-        candidate: '${{REGISTRY}}/osb/osb-portal:${{OSB_PORTAL_TAG}}'
+        title: Workspaces dandi copy
+        candidate: ${{REGISTRY}}/osb/workspaces-dandi-copy:${{WORKSPACES_DANDI_COPY_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_backoffice:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKSPACES_DANDI_COPY_PUBLISH_SKIP}}', '{{WORKSPACES_DANDI_COPY_PUBLISH_SKIP}}')
+                == true
+      publish_workspaces-figshare-copy:
         stage: publish
         type: push
-        title: Backoffice
-        candidate: '${{REGISTRY}}/osb/backoffice:${{BACKOFFICE_TAG}}'
+        title: Workspaces figshare copy
+        candidate: ${{REGISTRY}}/osb/workspaces-figshare-copy:${{WORKSPACES_FIGSHARE_COPY_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_nwb-explorer:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKSPACES_FIGSHARE_COPY_PUBLISH_SKIP}}',
+                '{{WORKSPACES_FIGSHARE_COPY_PUBLISH_SKIP}}') == true
+      publish_workspaces-github-copy:
         stage: publish
         type: push
-        title: Nwb explorer
-        candidate: '${{REGISTRY}}/osb/nwb-explorer:${{NWB_EXPLORER_TAG}}'
+        title: Workspaces github copy
+        candidate: ${{REGISTRY}}/osb/workspaces-github-copy:${{WORKSPACES_GITHUB_COPY_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
-      publish_jupyterlab:
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKSPACES_GITHUB_COPY_PUBLISH_SKIP}}', '{{WORKSPACES_GITHUB_COPY_PUBLISH_SKIP}}')
+                == true
+      publish_workspaces-scan-workspace:
         stage: publish
         type: push
-        title: Jupyterlab
-        candidate: '${{REGISTRY}}/osb/jupyterlab:${{JUPYTERLAB_TAG}}'
+        title: Workspaces scan workspace
+        candidate: ${{REGISTRY}}/osb/workspaces-scan-workspace:${{WORKSPACES_SCAN_WORKSPACE_TAG}}
         tags:
-        - '${{DEPLOYMENT_PUBLISH_TAG}}'
+        - ${{DEPLOYMENT_PUBLISH_TAG}}
         - latest
-        registry: '${{REGISTRY_PUBLISH_URL}}'
+        registry: ${{REGISTRY_PUBLISH_URL}}
+        when:
+          condition:
+            all:
+              skipPublish: includes('${{WORKSPACES_SCAN_WORKSPACE_PUBLISH_SKIP}}',
+                '{{WORKSPACES_SCAN_WORKSPACE_PUBLISH_SKIP}}') == true
     when:
       condition:
         all: