Live menu tree from Otto. Check boxes to multi-select pages or widgets, then click Assign to grant a user or role access to all selected nodes at once. Pages auto-register the first time you open this tab.

Onboard a Cloud Run app

Pick an existing Cloud Run service, give it a subdomain, and Otto will: (1) map the subdomain at Cloud Run, (2) add the page to the sidebar nav, (3) auto-register it in the Permissions tab so you can grant access.

Current umbrella mappings

Subdomains under tools.rebrandsny.com. Cert provisioning takes 5–30 min after a new mapping; refresh to update status.

Add a non-Cloud-Run page

For pages that aren't a Cloud Run service — e.g. an external URL, or a GCS-hosted HTML you've already proxied through Otto via /iframe/<name>.

Onboarded sidebar entries

Cloud Run apps that were onboarded into the main sidebar nav. Use the section dropdown to re-file an entry into a different sidebar section — it stays in the nav, it just moves. Demote is a different thing: it removes the entry from the sidebar and parks it on the App Library staging shelf, where it no longer appears in the nav at all. Generate auth migration gives a paste-ready auth.py replacement that switches the app to umbrella auth.

App Library

Staging shelf at /isaac#app-library. Add free-form links here, or onboard Cloud Run apps directly into a section using the form above with destination = "App Library". Promote moves an entry into the main sidebar nav.

Add a free-form link

Add a section

Cloud Run starter generator

Convert a static HTML/GCS app to Cloud Run with Otto auth pre-wired. Generates main.py, Dockerfile, requirements.txt, and deploy.sh — paste into a new folder, drop your HTML in, deploy.

Onboard an app

The original Onboarding tab does one thing: it maps the subdomain, adds the sidebar row, then patches the service's source and rebuilds it so Otto's login guards it. That is right for an internal tool and wrong for an app that already has its own login, or one that is meant to be open. This tab asks first. The old tab is untouched and still works.

How each onboarded app was onboarded

Everything Otto serves — sidebar entries and App Library cards — with the security mode each one carries. Rows added before this tab existed were all gated, so they read with Otto security. Use Change to move an app between modes in either direction. The project-wide scan adds every Cloud Run service Otto was never introduced to, classified by what is actually guarding it — without sending a single request to the services themselves.

Roles

Pages (manual)

Most pages auto-register from Otto's menu tree. Use this only to add pages outside that tree.