Explain this failure

1. An owner or admin opens Settings → AI and pastes an Anthropic API key.
2. Seal and save encrypts it in the browser to every server’s key. Unrent stores only the ciphertexts and the last four characters.
3. Test checks the key from a server. Servers added later need the key sealed to them too; the page shows which.

Removing the key deletes every ciphertext and cancels AI jobs that have not started.

The diagnosis runs on the server that failed. The agent gathers the failure output, container state and recent logs, redacts secrets, runs the signatures, and calls api.anthropic.com directly. The root helper has no internet access of its own: it reaches the model through a tunnel that allows only api.anthropic.com:443, and TLS runs end to end, so the tunnel never sees the key or the prompt.

Never sent: secret values, plain variable values, other services’ data. Unrent receives a structured result, checks it, shows it as plain text and keeps it for 30 days.

The answer gives the root cause, a confidence, the log lines it cites (highlighted in the output) and next steps. If it suggests restarting, rolling back or starting the service, that is a button that runs the normal job, with its usual approvals.

Log lines are treated as untrusted data: a line that says “ignore previous instructions” stays inside the evidence, and an answer that proposes anything else, or cites lines it was not shown, is refused.

Each organisation has a monthly token budget, shown with a usage bar in Settings → AI. You pay Anthropic directly; Unrent charges nothing for AI.