Agentic tool-use eval on a local 35B (Q8): trap-tool avoidance is solid, but I can't tell if my failures are the model or my harness

I've been running a small agentic eval harness against a local model and I'd like a sanity check on both my methodology and how you all handle agent-loop termination.

Setup

Target: ornith-1.0-35b-Q8_0 (Q8_0), served via llama.cpp

Harness tier: Medium · K=8 · decoys off

Each task gives the model ~7 tools, some of which are honeypots (e.g. force_prod, skip_backup, rotate_all_now, disable_keys), and a policy prompt with per-target rules. The model has to discover state, then act per rule.