diff --git a/.forgejo/workflows/grade.yml b/.forgejo/workflows/grade.yml
index 30ebea5..8bf4ea2 100644
--- a/.forgejo/workflows/grade.yml
+++ b/.forgejo/workflows/grade.yml
@@ -2,28 +2,25 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13 config: docker_host: automount -> the job container
-#     gets the host docker socket, so `docker run` drives the host daemon
-#   - the nested grade container mounts the secret + hidden tests straight from
-#     the host (/opt/grade/grade.env, /opt/grade-hidden/...) — never in this
-#     repo, no job-container options, no Actions secrets required
+#   - the job container IS the grade image (grade-c:dev on the host daemon),
+#     so the harness runs directly — no nested docker
+#   - runner.yaml mounts /opt/grade-hidden + /opt/grade/grade.env into every
+#     job container (host paths, never in this repo)
+#   - checkout uses Forgejo's native action (data.forgejo.org) for
+#     forgejo-runner v13
 jobs:
   grade:
     runs-on: docker
     container:
-      image: gitea/runner-images:ubuntu-22.04
+      image: grade-c:dev
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v6
-      - name: Probe workspace
-        run: |
-          { echo "PWD=$PWD"; echo "WS=${GITHUB_WORKSPACE:-unset}"; ls -la /workspace 2>&1 | head -20; ls -la /workspace/*/ 2>/dev/null | head -20; } > /workspace/PROBE.txt 2>&1 || echo "cannot write workspace" > /workspace/PROBE.txt
       - name: Grade (blank fails, solved passes)
         run: |
-          docker run --rm --network=none \
-            -v "$PWD":/work \
-            -v /opt/grade/grade.env:/run/secrets/grade.env:ro \
-            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
-            -v /opt/grade/runner-diag:/diag \
-            grade-c:dev \
-            sh -c 'set -a; . /run/secrets/grade.env; set +a; { echo "SECRET_LEN=${#GRADE_HMAC_SECRET}"; python3 /opt/grade/grade_cli.py run --student /work --hidden /hidden --course CS2060 --assignment record-manager --out /work/results.json; } 2>&1 | tee /diag/latest.log'
-          echo "job-step exit=$?"
+          cd "$GITHUB_WORKSPACE"
+          set -a; . /run/secrets/grade.env; set +a
+          python3 /opt/grade/grade_cli.py run \
+            --student . --hidden /opt/grade-hidden/cs2060/record-manager \
+            --course CS2060 --assignment record-manager \
+            --out results.json 2>&1 | tee /opt/grade/runner-diag/latest.log
+          python3 -c "import json; d=json.load(open('results.json'))['result']; print('VERDICT ok=', d['ok'], 'public=', d['tests']['public'], 'hidden=', d['tests']['hidden'])"