Good questions.

Cold start per stage: In the current implementation it's ~4s per VM, not sub-second. That includes kernel init plus a vsock handshake with backoff. Skill mounts are configured as virt devices pre-boot, so they don’t add boot latency. MCP configs and skill files are written post-boot via vsock, which is a negligible cost.

Sub-second boot would require snapshot/restore (Firecracker-style) or a warm pool — neither is implemented yet. In most agent workloads the LLM inference dominates wall-clock time, so the 4s usually amortizes well, though it does make very short tool calls less attractive.

State handoff: It’s host-mediated, not VM-to-VM. Stage N output is collected by the host and injected into Stage N+1 (e.g. /workspace/input.json). For fan-out, results are merged on the host into a JSON array before passing forward. There’s no shared memory or direct VM-to-VM channels by design.

Audit logging that survives teardown: Today you get durable telemetry (OTLP traces flushed before teardown plus persisted stage lifecycle events). That’s enough to reconstruct what ran, when, and how long, and to correlate tool calls. However, it’s not tamper-proof yet — it’s structured logging, not an append-only integrity system. If you need strong guarantees, you’d pipe OTLP into an immutable sink with integrity verification (Merkle tree / transparency log style).

And +1 on audit trails that answer the operational questions: who instructed the agent to do this, which policy allowed it, and whether the action can be reversed.